d46c22ad7a5918d888a47c67211ad460N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

d46c22ad7a5918d888a47c67211ad460N.exe
Size

1.0MB
MD5

d46c22ad7a5918d888a47c67211ad460
SHA1

eed7651bc49b5d96857b1a09d5146e051fa8b18d
SHA256

76be0118a6d679d5bf54c54be2149aad1abbcc540bb712593f289daf11f62507
SHA512

0c9702d3d9b2ebb3bbe46d1655791f7d0b9c46e275e7695320edb37975a50265f35a72f4b44abecc9224b10438843d7aeb9cd62f6f02372dbad54ec756fec2de
SSDEEP

12288:qqflDDoYeF20NNHCW8k45hox9l7pUHFX6EQ2XbhV:q00E0NNHCWZmO7aHBNbX

Score

1^/10

Malware Config

Signatures

Files

d46c22ad7a5918d888a47c67211ad460N.exe
.exe windows:1 windows x86 arch:x86

3cff6a264a1d694a36fac2c685f6a919

Code Sign

8d:1e:c0:93:13:08:0a:08:d8:43:9d:e1:bf:76:84:32
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

04-11-2020 00:00

Not After

04-11-2021 23:59

Subject

CN=Ilmelä Ikikesä Oy,O=Ilmelä Ikikesä Oy,POSTALCODE=00640,STREET=Töllinmäki 3 B,L=Helsinki,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:71:bf:6f:6d:67:b6:83:23:b6:55:60:1d:2e:6c:93:4b:e3:bf:4b
Signer

Actual PE Digest

93:71:bf:6f:6d:67:b6:83:23:b6:55:60:1d:2e:6c:93:4b:e3:bf:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetLastError
VirtualAllocEx
GetModuleHandleA
GetModuleFileNameA
SetLastError
GetTickCount
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
FreeLibrary
GetSystemInfo
LoadLibraryA
GetProcAddress
DeleteFileW
MoveFileW
CreateFileW
GetFileAttributesW
CreateDirectoryW
RemoveDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetEnvironmentVariableW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
GetEnvironmentStringsA
FreeEnvironmentStringsA
FormatMessageA
CreateSemaphoreA
GetLogicalDriveStringsA
GlobalAddAtomA
GetDriveTypeA
GetSystemDirectoryA
GetWindowsDirectoryA
GetDiskFreeSpaceA
GetVolumeInformationA
CreateProcessA
FindFirstFileA
GetVersionExA
CompareStringA
GetLocaleInfoA
GetDateFormatA
EnumCalendarInfoA
GetModuleFileNameW
GetCommandLineW
SetFileAttributesW
GetVolumeInformationW
CreateProcessW
FindFirstFileW
FindNextFileW
CompareStringW
GetLocaleInfoW
GlobalAlloc
GlobalReAlloc
GlobalSize
GlobalLock
GlobalUnlock
GlobalMemoryStatus
VirtualFree
TerminateProcess
GetExitCodeProcess
GetExitCodeThread
SetErrorMode
GlobalDeleteAtom
FindClose
GetFileTime
SetFileTime
DuplicateHandle
MulDiv
GetLocalTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
CreatePipe
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
VerifyVersionInfoW
ContinueDebugEvent
SetConsoleMode
GlobalUnWire
InterlockedExchangeAdd
OpenSemaphoreA
ReplaceFileW
GetConsoleAliasA
IsBadHugeWritePtr

user32

BeginPaint
GetClientRect
DrawTextA
EndPaint
PostQuitMessage
DefWindowProcA
LoadIconA
DefWindowProcW
GetWindow
EnumDisplaySettingsExA
BroadcastSystemMessageW
GetDialogBaseUnits
SetShellWindow
OemToCharBuffW
WinHelpA
GetWindowLongW
UnhookWindowsHookEx
GetMenuDefaultItem
GetParent
WINNLSEnableIME
RegisterShellHookWindow
RegisterWindowMessageW
IsCharAlphaNumericW
GetProcessWindowStation
IMPQueryIMEA
UnionRect
RealChildWindowFromPoint
GetNextDlgGroupItem
GetUserObjectInformationW
SetWindowPos
UpdateLayeredWindow
OpenWindowStationA
SetWindowsHookExW

gdi32

GetEnhMetaFileA
GetEnhMetaFileBits
GetStockObject
CreateSolidBrush
AddFontResourceA
ExcludeClipRect
GetTextAlign
EndPage
FONTOBJ_vGetInfo
GetStringBitmapW
GetMetaFileA
EngAlphaBlend
GdiSetLastError
GetCharABCWidthsFloatW
GetCharacterPlacementW
SetBkMode
SetFontEnumeration
GetPaletteEntries
OffsetWindowOrgEx
ExtCreatePen
GetPolyFillMode
GdiFullscreenControl
SetPolyFillMode

comdlg32

GetOpenFileNameA
GetSaveFileNameA
ChooseColorA
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyW
RegQueryValueExA

ole32

OleInitialize
OleUninitialize
CoUninitialize
CoCreateInstance
CLSIDFromProgID
CoInitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

GetErrorInfo

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_GetImageCount
ImageList_SetImageCount
ImageList_Add
ImageList_Replace
ImageList_AddMasked
ImageList_DrawEx
ImageList_DrawIndirect
ImageList_Remove
ImageList_Copy
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock

winmm

PlaySoundA

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_controlfp

Sections

.text
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 616KB - Virtual size: 615KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3cff6a264a1d694a36fac2c685f6a919

Code Sign

8d:1e:c0:93:13:08:0a:08:d8:43:9d:e1:bf:76:84:32Certificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

93:71:bf:6f:6d:67:b6:83:23:b6:55:60:1d:2e:6c:93:4b:e3:bf:4bSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

comctl32

winmm

msvcrt

Sections

.text Size: 346KB - Virtual size: 345KB

.rdata Size: 99KB - Virtual size: 98KB

.data Size: 616KB - Virtual size: 615KB

8d:1e:c0:93:13:08:0a:08:d8:43:9d:e1:bf:76:84:32
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

93:71:bf:6f:6d:67:b6:83:23:b6:55:60:1d:2e:6c:93:4b:e3:bf:4b
Signer

.text
Size: 346KB - Virtual size: 345KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 616KB - Virtual size: 615KB