8309167a3c354e7c9fbc4da75e626190N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8309167a3c354e7c9fbc4da75e626190N.exe
Size

300KB
MD5

8309167a3c354e7c9fbc4da75e626190
SHA1

c6f5f071b5c3abb50d9a8e297f2aee762846f266
SHA256

9a7fac10fe0ee58e5b61da22d740a7387d1f9e5168946c05b79de56199698e1a
SHA512

eb956ab46b007746a90213725ed9211d2c6da58da96e82cf7e46d7be5f5af8133f27fb2ca6e8a06052627967bfc3f1515da8b1c2972b9ef27d05b45c1a5e8565
SSDEEP

6144:ASNn7p8F1g+oG1IZgaZ7pOOF2JsUBV+UdvrEFp7hKqkkkkkkkkkkkkkkkkkkkEkX:xn7p8F1g+oG1IZgaZ7pF2J9BjvrEH7tc

Score

1^/10

Malware Config

Signatures

Files

8309167a3c354e7c9fbc4da75e626190N.exe
.exe windows:6 windows x86 arch:x86

6fd1c67b79af1ea44f7e5d30b1500226

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:34:12:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14/05/2012, 21:39

Not After

14/08/2013, 21:49

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

de:d7:11:57:34:79:60:c3:3a:90:8a:e8:69:cb:a6:d6:ff:30:13:fa:ff:a2:c1:20:3c:35:f4:e1:8d:90:03:e4
Signer

Actual PE Digest

de:d7:11:57:34:79:60:c3:3a:90:8a:e8:69:cb:a6:d6:ff:30:13:fa:ff:a2:c1:20:3c:35:f4:e1:8d:90:03:e4

Digest Algorithm

sha256

PE Digest Matches

false

6c:4b:1d:45:78:22:d7:cd:6a:e9:86:c8:f3:c3:d7:f6:93:92:fa:8a
Signer

Actual PE Digest

6c:4b:1d:45:78:22:d7:cd:6a:e9:86:c8:f3:c3:d7:f6:93:92:fa:8a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

sn.pdb

Imports

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW

kernel32

GetVersion
GetModuleHandleW
HeapReAlloc
SetFilePointerEx
RtlUnwind
MultiByteToWideChar
CloseHandle
FlushFileBuffers
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GlobalUnlock
GetStdHandle
GetOEMCP
IsValidCodePage
GetTickCount64
QueryPerformanceCounter
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
InterlockedDecrement
InterlockedIncrement
FlsFree
FlsSetValue
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
LoadLibraryW
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
WriteConsoleW

mscoree

StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx

crypt32

CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject

user32

OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SetErrorInfo

Sections

.text
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fd1c67b79af1ea44f7e5d30b1500226

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:05:13:36:00:00:00:00:00:1aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:06:34:12:00:00:00:00:00:03Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

de:d7:11:57:34:79:60:c3:3a:90:8a:e8:69:cb:a6:d6:ff:30:13:fa:ff:a2:c1:20:3c:35:f4:e1:8d:90:03:e4Signer

6c:4b:1d:45:78:22:d7:cd:6a:e9:86:c8:f3:c3:d7:f6:93:92:fa:8aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

mscoree

crypt32

user32

ole32

oleaut32

Sections

.text Size: 175KB - Virtual size: 175KB

.data Size: 4KB - Virtual size: 17KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 21KB

61:19:cc:93:00:01:00:00:00:66
Certificate

61:05:13:36:00:00:00:00:00:1a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:06:34:12:00:00:00:00:00:03
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

de:d7:11:57:34:79:60:c3:3a:90:8a:e8:69:cb:a6:d6:ff:30:13:fa:ff:a2:c1:20:3c:35:f4:e1:8d:90:03:e4
Signer

6c:4b:1d:45:78:22:d7:cd:6a:e9:86:c8:f3:c3:d7:f6:93:92:fa:8a
Signer

.text
Size: 175KB - Virtual size: 175KB

.data
Size: 4KB - Virtual size: 17KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 21KB