aa91624045b4221b677e0450d3f84c6afe98b9d618fdb9edba62359a9fd2531f

Sharing

Copy URL Twitter E-mail

General

Target

aa91624045b4221b677e0450d3f84c6afe98b9d618fdb9edba62359a9fd2531f
Size

109KB
MD5

4b47a2432fbc42bb3febcdcdf79d2542
SHA1

1fdaa89f581c7c37738ab2fc66243b929c224c55
SHA256

aa91624045b4221b677e0450d3f84c6afe98b9d618fdb9edba62359a9fd2531f
SHA512

184a3564c623b9dac41325a7d710b586fc59172379e08b20ee56aaf02a74b724fc2c1015ca442db34109024e5f58c07131f5ac3084ce04ac1b6156c2bc6f2017
SSDEEP

1536:7RMAXf8zncn9wugA0ZH1e/4cHhDQAN9qTV5mpW0e0yalz4EBo8:2AXf8znpugJrcJN9qJ5dFNMz4EW8

Score

1^/10

Malware Config

Signatures

Files

aa91624045b4221b677e0450d3f84c6afe98b9d618fdb9edba62359a9fd2531f
.exe windows:6 windows x64 arch:x64

81e8df403db740749cdecbc2fc97b63e

Code Sign

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

82:a2:b4:a9:ab:79:38:2f:1f:c1:cf:1a:33:98:98:f9:7e:a8:75:d2
Signer

Actual PE Digest

82:a2:b4:a9:ab:79:38:2f:1f:c1:cf:1a:33:98:98:f9:7e:a8:75:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WaHostBootstrapper.pdb

Imports

advapi32

RegisterEventSourceW
OpenProcessToken
GetTokenInformation
EventWrite
RegCreateKeyExW
CreateProcessAsUserW
DeregisterEventSource
EventRegister
ReportEventW
RegCloseKey
RegSetValueExW
LookupAccountSidW
LookupAccountNameW
AllocateLocallyUniqueId
AllocateAndInitializeSid
FreeSid
ConvertSidToStringSidW
CreateWellKnownSid
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
RegDeleteKeyW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptDestroyHash
CryptHashData
CheckTokenMembership
EventUnregister

kernel32

WaitForMultipleObjects
ResumeThread
FindFirstFileW
FreeLibrary
LoadLibraryW
GetProcAddress
FindClose
LocalFree
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetVersionExW
CopyFileW
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
DeviceIoControl
LocalAlloc
TlsFree
GetSystemTime
TlsAlloc
GetFileTime
AcquireSRWLockShared
InitializeSRWLock
MoveFileW
GetFileSizeEx
FlushFileBuffers
ReleaseSRWLockShared
TlsSetValue
AcquireSRWLockExclusive
OutputDebugStringW
ReleaseSRWLockExclusive
CompareFileTime
TlsGetValue
SetFilePointer
DeleteFileW
FindNextFileW
SetUnhandledExceptionFilter
Sleep
SetEnvironmentVariableW
GetCurrentProcess
ExpandEnvironmentStringsW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
SetLastError
GetLastError
CreateFileW
GetProcessHeap
HeapFree
HeapAlloc
CreateDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
GetFileAttributesW
WriteFile
TerminateProcess

msvcrt

clock
_wcsicmp
memcpy
_exit
_vsnwprintf
_putws
wcsrchr
memmove
wcschr
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
memset
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
malloc
free

ntdll

RtlVirtualUnwind
NtQueryInformationProcess
RtlLookupFunctionEntry
RtlCaptureContext
RtlInitUnicodeString
RtlLengthRequiredSid

rpcrt4

UuidCreate
NdrServerCall2
NdrServerCallAll
NdrClientCall3
RpcStringFreeW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerInqCallAttributesW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen
SysStringLen
SysAllocString

userenv

ExpandEnvironmentStringsForUserW

crypt32

CryptBinaryToStringW

mswasri

RdGetLocalResource
RdCloseLocalResource
RdGetLocalResourceName
RdGetRuntimeExecutionEnvironment
RdGetConfigurationPath
RdRegisterCallback
RdGetSystemConfigurationSetting
RdUninitializeRuntime
RdGetApplicationConfigurationSetting
RdGetResourceRoot
RdInitializeRuntimeEx

secur32

LsaFreeReturnBuffer

xmllite

CreateXmlReader

shlwapi

SHCreateStreamOnFileW

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 618B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81e8df403db740749cdecbc2fc97b63e

Code Sign

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8aCertificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

82:a2:b4:a9:ab:79:38:2f:1f:c1:cf:1a:33:98:98:f9:7e:a8:75:d2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

ole32

oleaut32

userenv

crypt32

mswasri

secur32

xmllite

shlwapi

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 618B

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

82:a2:b4:a9:ab:79:38:2f:1f:c1:cf:1a:33:98:98:f9:7e:a8:75:d2
Signer

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 618B