8a50da782bcaf3a375561edb0fb64fd0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8a50da782bcaf3a375561edb0fb64fd0N.exe
Size

430KB
MD5

8a50da782bcaf3a375561edb0fb64fd0
SHA1

95701630b190e7549f32334ab7b78bd9b944a332
SHA256

7ba109fa97029cd382eea6a0ad0321e66d327dc544a299dab53fd8bcdae02a41
SHA512

5e8ccb5223189c159a775ed676f0e79dade0a89fc8455c35d06ea1401bfda65d57195491fa6d62b1871388163073075699783f0826ed594d21d500f3eaa3407c
SSDEEP

6144:3qORZlAYgjHXbv9r/31o/ZrrDCI1ZVZPPzMNKh3PfcKrKywia:3qiZ9cHr9rf1qraIeKpdGyXa

Score

1^/10

Malware Config

Signatures

Files

8a50da782bcaf3a375561edb0fb64fd0N.exe
.exe windows:5 windows x86 arch:x86

c51f33ed5e54a835a330d7e4c8fd52be

Code Sign

f3:75:f9:1d:3d:e5:d0:e2
Certificate

Issuer

CN=Mozilla Fake CA

Not Before

25/09/2015, 14:02

Not After

12/06/2035, 14:02

Subject

CN=Mozilla Fake SPC

f8:d0:22:f2:ca:36:33:8d:aa:19:53:06:49:be:df:13:41:b6:7d:18
Signer

Actual PE Digest

f8:d0:22:f2:ca:36:33:8d:aa:19:53:06:49:be:df:13:41:b6:7d:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\src\obj-firefox\toolkit\mozapps\update\updater\updater.pdb

Imports

kernel32

MoveFileExW
WideCharToMultiByte
LocalAlloc
SetLastError
GetCurrentProcess
FreeLibrary
LoadLibraryW
GetDriveTypeW
WriteFile
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileW
MoveFileW
GetTimeZoneInformation
WriteConsoleW
LCMapStringW
CopyFileW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
OutputDebugStringW
SetConsoleCtrlHandler
FlushFileBuffers
GetFullPathNameW
SetEnvironmentVariableA
SetFilePointerEx
FatalAppExitA
HeapSize
CreateSemaphoreW
GetTickCount
TlsFree
TlsSetValue
FormatMessageW
GetPrivateProfileStringW
LocalFree
OpenProcess
CreateProcessW
WaitForSingleObject
GetLastError
CloseHandle
SetFilePointer
SetEndOfFile
GetTempFileNameW
GetLongPathNameW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
MultiByteToWideChar
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GetModuleFileNameW
Sleep
SetDllDirectoryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
CompareStringW
GetSystemDirectoryW
TlsGetValue
TlsAlloc
TerminateProcess
CreateEventW
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetStdHandle
ReadConsoleW
RtlUnwind
RaiseException
LoadLibraryExA
GetCommandLineW
HeapFree
HeapAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
FileTimeToSystemTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetFileAttributesExW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
CreateThread
GetCurrentThreadId
ExitThread
ReadFile
HeapReAlloc
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetCurrentThread
GetProcessHeap
GetStdHandle
DeleteCriticalSection
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetFullPathNameA

user32

GetClientRect
wsprintfW
LoadIconW
GetParent
GetDesktopWindow
SetWindowLongW
SendMessageW
OffsetRect
CopyRect
ScreenToClient
GetWindowRect
GetWindowLongW
SetWindowTextW
ReleaseDC
GetDC
DrawTextW
SetTimer
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos

gdi32

SelectObject

advapi32

QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerA
CloseServiceHandle
LookupPrivilegeValueA
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegQueryInfoKeyW
RegEnumKeyExW
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptVerifySignatureA
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptAcquireContextA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CreateProcessAsUserW
StartServiceW

wintrust

WinVerifyTrust

shell32

ShellExecuteExW

shlwapi

PathRemoveFileSpecW
PathCommonPrefixW
PathAppendW
PathStripToRootW
PathUnquoteSpacesW

Sections

.text
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c51f33ed5e54a835a330d7e4c8fd52be

Code Sign

f3:75:f9:1d:3d:e5:d0:e2Certificate

f8:d0:22:f2:ca:36:33:8d:aa:19:53:06:49:be:df:13:41:b6:7d:18Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

wintrust

shell32

shlwapi

Sections

.text Size: 261KB - Virtual size: 260KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 9KB - Virtual size: 21KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 11KB - Virtual size: 11KB

f3:75:f9:1d:3d:e5:d0:e2
Certificate

f8:d0:22:f2:ca:36:33:8d:aa:19:53:06:49:be:df:13:41:b6:7d:18
Signer

.text
Size: 261KB - Virtual size: 260KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 9KB - Virtual size: 21KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 11KB - Virtual size: 11KB