dc8ccd9f85c348af5a7ed1d96d0bd44a800f9a4f9b09a25aea1db22ee5b6b88c

Sharing

Copy URL Twitter E-mail

General

Target

dc8ccd9f85c348af5a7ed1d96d0bd44a800f9a4f9b09a25aea1db22ee5b6b88c
Size

15KB
MD5

74b472b907474f90d85433a94776fba6
SHA1

665339a9ae1417df8476402689e4cbefb4bef0fd
SHA256

dc8ccd9f85c348af5a7ed1d96d0bd44a800f9a4f9b09a25aea1db22ee5b6b88c
SHA512

b84c72e18ddce451ed4acd6029141421b149aaf7dbf1ef05d0e3c3ff1ae22023e43cd120a136796f7a55bc4473a17c1da8910dc421755b6188abfe43d8473f7f
SSDEEP

192:wXCvaizlRWmzDXstL9w0HpXrfa7vPKgnR9cl7HciS7jJIK8g2ysG7uGauospvx4b:wyvaiWmPctC0HpXry7XK0miXIpic

Score

1^/10

Malware Config

Signatures

Files

dc8ccd9f85c348af5a7ed1d96d0bd44a800f9a4f9b09a25aea1db22ee5b6b88c
.dll windows:5 windows x64 arch:x64

971dfc63bbe71362340ee19954fc1d7b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:8d:54:06:d7:1c:89:dd:84:53:bc:6d:50:57:89:7d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/09/2015, 00:00

Not After

23/09/2017, 23:59

Subject

CN=Pelikan Software KFT,O=Pelikan Software KFT,POSTALCODE=2094,STREET=Nagykovácsi út 6\, S ép. 2.,L=Nagykovácsi,ST=Nagykovácsi,C=HU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:42:fd:3e:53:e4:af:ad:1a:c3:c9:84:30:99:61:dc:10:8c:c3:4e
Signer

Actual PE Digest

eb:42:fd:3e:53:e4:af:ad:1a:c3:c9:84:30:99:61:dc:10:8c:c3:4e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Pelikan\Rev_7.0\P0\bin\v10_x64_Release\modules\tga.pdb

Imports

kernel32

RtlFillMemory

pecore

?iv_delete@@YAXPEAX@Z
?iv_new@@YAPEAX_K@Z
?strncmp@pe@@YAHPEBD0_K@Z
?SetValue@Unknown@iv@@UEAAJIAEBVVariant@2@@Z
?GetValue@Unknown@iv@@UEAAJIAEAVVariant@2@@Z
?GetTypeId@Unknown@iv@@UEAAPEBUGuid@2@XZ
?IsTypeOf@Unknown@iv@@UEAA_NAEBUGuid@2@@Z
?Release@Unknown@iv@@UEAAIXZ
?AddRef@Unknown@iv@@UEAAIXZ
??0Unknown@iv@@QEAA@XZ
?QuerySettings@ivFlt@iv@@UEAAJ_NPEAVivUIPages@2@@Z
?Range@ivFlt2d@iv@@UEAA_N_N@Z
?QueryInterface@ivFlt2d@iv@@UEAAJAEBUGuid@2@PEAPEAX@Z
?CreateInterface@iv@@YAJAEBUGuid@1@PEAPEAX@Z
?Init@Variant@iv@@QEAAXI@Z
??1Variant@iv@@QEAA@XZ
?pe_Error@iv@@YAXPEBDZZ

Exports

Exports

pe_entrypoint

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

971dfc63bbe71362340ee19954fc1d7b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

57:8d:54:06:d7:1c:89:dd:84:53:bc:6d:50:57:89:7dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

eb:42:fd:3e:53:e4:af:ad:1a:c3:c9:84:30:99:61:dc:10:8c:c3:4eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

pecore

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 20B

.pdata Size: 512B - Virtual size: 216B

.reloc Size: 512B - Virtual size: 152B

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

57:8d:54:06:d7:1c:89:dd:84:53:bc:6d:50:57:89:7d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

eb:42:fd:3e:53:e4:af:ad:1a:c3:c9:84:30:99:61:dc:10:8c:c3:4e
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 20B

.pdata
Size: 512B - Virtual size: 216B

.reloc
Size: 512B - Virtual size: 152B