1045b0b441c50d7268f9fbcc19a23093f9efae22c0fc006a28e11190f7115fa4

Sharing

Copy URL

Twitter E-mail

General

Target

1045b0b441c50d7268f9fbcc19a23093f9efae22c0fc006a28e11190f7115fa4
Size

274KB
MD5

9d6fd73873666d91d219cc5cebbaeff9
SHA1

022ff1a36b2cafdc5197120634076cef6fac5c50
SHA256

1045b0b441c50d7268f9fbcc19a23093f9efae22c0fc006a28e11190f7115fa4
SHA512

8333dfd50715e11dc848a45e45dd87bf49ca7437c1b64fbfd0a0efa41711374fe75e08a1fa8b609df80464d173f1a711d4627876e78b969f2d014ff0f6b9e8c0
SSDEEP

6144:nF6fMGHY2jNSUW2bcNpp4asiNCM68xtEdz4ibA9R2f3pRphO92yW:E0GH/h3IbNNo8xt84ibSe5Rpw9TW

Score

1^/10

Malware Config

Signatures

Files

1045b0b441c50d7268f9fbcc19a23093f9efae22c0fc006a28e11190f7115fa4
.zip

Password: infected
c04433797667c205da21d0b783bdbbbd6ba3ca3d62f43f6e7e911ccdf09007cb
.exe windows:5 windows x86 arch:x86

065e875405f3b49af26f8ede3fdf4925

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-02-2016 00:00

Not After

13-02-2019 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-02-2016 00:00

Not After

13-02-2019 12:00

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:65:ac:61:65:73:74:8b:28:46:4a:21:96:46:19:3a:89:ef:28:a0:a6:c7:02:7d:47:70:56:8b:f8:e4:5f:2d
Signer

Actual PE Digest

3f:65:ac:61:65:73:74:8b:28:46:4a:21:96:46:19:3a:89:ef:28:a0:a6:c7:02:7d:47:70:56:8b:f8:e4:5f:2d

Digest Algorithm

sha256

PE Digest Matches

false

e3:40:e9:19:8f:cd:4d:5d:a2:5c:7d:c1:e8:45:73:73:00:02:77:87
Signer

Actual PE Digest

e3:40:e9:19:8f:cd:4d:5d:a2:5c:7d:c1:e8:45:73:73:00:02:77:87

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLocalTime
FindResourceExW
WriteConsoleOutputCharacterA
FindResourceW
InterlockedIncrement
GetModuleHandleExW
SetConsoleScreenBufferSize
SetTapeParameters
GetModuleHandleW
SetFileTime
TzSpecificLocalTimeToSystemTime
GetLocaleInfoW
SizeofResource
SetSystemTimeAdjustment
GetConsoleAliasW
GetFileAttributesW
SetTimeZoneInformation
TerminateProcess
GetCompressedFileSizeA
GlobalUnlock
DisconnectNamedPipe
GetLastError
SetFileAttributesA
GetAtomNameA
OpenWaitableTimerW
LocalAlloc
SetConsoleWindowInfo
FindAtomA
GlobalFindAtomW
GlobalWire
lstrcatW
VirtualProtect
GetCurrentProcessId
LocalFree
lstrcpyW
LCMapStringW
LocalFileTimeToFileTime
GetStartupInfoW
RaiseException
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FatalAppExitA
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FlushFileBuffers
ReadFile
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 309KB - Virtual size: 308KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.layot
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.new
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

065e875405f3b49af26f8ede3fdf4925

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6fCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3f:65:ac:61:65:73:74:8b:28:46:4a:21:96:46:19:3a:89:ef:28:a0:a6:c7:02:7d:47:70:56:8b:f8:e4:5f:2dSigner

e3:40:e9:19:8f:cd:4d:5d:a2:5c:7d:c1:e8:45:73:73:00:02:77:87Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 309KB - Virtual size: 308KB

.data Size: 6KB - Virtual size: 167KB

.layot Size: 512B - Virtual size: 1B

.tls Size: 512B - Virtual size: 9B

.new Size: 17KB - Virtual size: 17KB

.rsrc Size: 34KB - Virtual size: 34KB

.reloc Size: 7KB - Virtual size: 7KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3f:65:ac:61:65:73:74:8b:28:46:4a:21:96:46:19:3a:89:ef:28:a0:a6:c7:02:7d:47:70:56:8b:f8:e4:5f:2d
Signer

e3:40:e9:19:8f:cd:4d:5d:a2:5c:7d:c1:e8:45:73:73:00:02:77:87
Signer

.text
Size: 309KB - Virtual size: 308KB

.data
Size: 6KB - Virtual size: 167KB

.layot
Size: 512B - Virtual size: 1B

.tls
Size: 512B - Virtual size: 9B

.new
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 34KB - Virtual size: 34KB

.reloc
Size: 7KB - Virtual size: 7KB