51b95254f1e3aab6f4a84859d6e074b2a21a4f6385d44d9bfeb2f2e864e7081c

Sharing

Copy URL

Twitter E-mail

General

Target

51b95254f1e3aab6f4a84859d6e074b2a21a4f6385d44d9bfeb2f2e864e7081c
Size

183KB
MD5

54a27b8d9e7b19f25ba355947969f8ce
SHA1

dac6f2b3af956a45e6e86cfa66b84d6261864fc6
SHA256

51b95254f1e3aab6f4a84859d6e074b2a21a4f6385d44d9bfeb2f2e864e7081c
SHA512

fb3e826bca02de5a0d3ad239a4074796aa540e48323e034ccda37c3030cfb8d38cc880501a6b9920106522fae898f38e179b0feb1d544671da76a2f2045a0f25
SSDEEP

3072:PQMnTNANueInBl76QO9tZgW1mJ5zhMBOKTQiOkDlMM6uB01kOXaYYJ8vS4Qy/EAt:oXNueIBt6QwrgQmbNMBO+QiOQl2BS4Xf

Score

1^/10

Malware Config

Signatures

Files

51b95254f1e3aab6f4a84859d6e074b2a21a4f6385d44d9bfeb2f2e864e7081c
.exe windows:6 windows x86 arch:x86

602bf9af676e237616e2b9dba6e4fa7c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:53

Not After

16-09-2011 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-09-2006 01:55

Not After

16-09-2011 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04-04-2006 17:44

Not After

26-04-2012 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-04-2006 19:43

Not After

04-10-2007 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a0:29:43:e5:63:7c:52:7a:bc:12:79:c7:2c:99:78:11:bc:2f:34:b5
Signer

Actual PE Digest

a0:29:43:e5:63:7c:52:7a:bc:12:79:c7:2c:99:78:11:bc:2f:34:b5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

windiff.pdb

Imports

advapi32

RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA

kernel32

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
DeleteCriticalSection
ReadFile
GetModuleHandleA
FreeLibrary
LoadLibraryA
WaitForSingleObject
CreateProcessA
CreateThread
GlobalUnlock
GlobalLock
GetThreadLocale
SetFilePointer
GetStdHandle
GetProcAddress
GetCurrentDirectoryA
SetCurrentDirectoryA
GetExitCodeProcess
LocalAlloc
LocalLock
FindNextFileA
LocalHandle
LocalUnlock
LocalFree
CopyFileA
SetFileTime
FindFirstFileA
FindClose
GetFileSize
GetFileTime
WriteFile
lstrlenA
DeleteFileA
lstrcmpA
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
OutputDebugStringA
RtlUnwind
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GlobalHandle
ExitProcess
FlushFileBuffers
ExpandEnvironmentStringsA
SetFileAttributesA
GlobalFree
GetFileAttributesA
WideCharToMultiByte
GetACP
MultiByteToWideChar
IsDBCSLeadByte
MulDiv
GetTickCount
GetTempPathA
GetTempFileNameA
GetFullPathNameA
CreateFileA
CloseHandle
lstrcmpiA
CompareFileTime
GlobalAlloc

gdi32

SetROP2
GetTextExtentPoint32A
ExtTextOutW
SetAbortProc
StartDocA
AbortDoc
EndDoc
DeleteDC
StartPage
EndPage
SetTextColor
ExtTextOutA
GetTextExtentPointA
GetDeviceCaps
SetBkColor
GetTextMetricsA
CreateFontA
DeleteObject
CreatePen
CreateSolidBrush
MoveToEx
LineTo
SelectObject
Rectangle
GetStockObject
GetTextExtentPoint32W

user32

LoadStringA
SetWindowPlacement
GetWindowPlacement
PostMessageA
DestroyMenu
TrackPopupMenu
ClientToScreen
EnableMenuItem
GetSubMenu
LoadMenuA
InvalidateRect
GetMenu
SetWindowTextA
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
ScreenToClient
GetCursorPos
LoadIconA
DestroyWindow
SystemParametersInfoA
CheckMenuItem
PostQuitMessage
SetFocus
UpdateWindow
CreateWindowExA
LoadAcceleratorsA
GetMessageA
InvertRect
DrawFocusRect
CreateDialogParamA
IsDialogMessageA
GetKeyState
ScrollWindow
ValidateRect
SetScrollRange
SetScrollPos
SetScrollInfo
MoveWindow
SetWindowLongA
PtInRect
RedrawWindow
ReleaseCapture
SetCapture
DrawTextA
GetFocus
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterWindowMessageA
AttachThreadInput
GetSysColor
GetWindowTextLengthA
GetParent
GetDesktopWindow
GetWindowRect
OffsetRect
SetWindowPos
CharPrevA
CharNextA
DialogBoxParamA
GetDlgItem
EnableWindow
CharLowerBuffA
ShowWindow
CheckRadioButton
SendDlgItemMessageA
GetDlgItemTextA
EndDialog
CheckDlgButton
SetDlgItemTextA
SetCursor
LoadCursorA
RegisterClassA
DefWindowProcA
BeginPaint
EndPaint
MessageBoxA
GetDC
GetClientRect
GetWindowLongA
PeekMessageA
FillRect
SendMessageA
ReleaseDC
CopyRect
IsDlgButtonChecked

msvcrt

__p__fmode
__set_app_type
memmove
?terminate@@YAXXZ
_controlfp
isleadbyte
_snprintf
_itoa
wctomb
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_iob
_errno
strpbrk
_strnicmp
strtok
calloc
system
_ltoa
exit
isalpha
_fullpath
_stricmp
_mkdir
malloc
strcspn
strncmp
_strdup
toupper
islower
tolower
isspace
isdigit
_getcwd
free
atoi
strchr
strrchr
strstr
memset
memcpy
wcspbrk

comdlg32

PrintDlgA
GetSaveFileNameA
GetOpenFileNameA
ChooseFontA

shell32

ShellAboutA

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

602bf9af676e237616e2b9dba6e4fa7c

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

a0:29:43:e5:63:7c:52:7a:bc:12:79:c7:2c:99:78:11:bc:2f:34:b5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comdlg32

shell32

Sections

.text Size: 123KB - Virtual size: 122KB

.data Size: 1KB - Virtual size: 9KB

.tls Size: 16KB - Virtual size: 16KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 8KB - Virtual size: 12KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

a0:29:43:e5:63:7c:52:7a:bc:12:79:c7:2c:99:78:11:bc:2f:34:b5
Signer

.text
Size: 123KB - Virtual size: 122KB

.data
Size: 1KB - Virtual size: 9KB

.tls
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 8KB - Virtual size: 12KB