GraalSetup[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

GraalSetup.exe
Size

2.8MB
MD5

31fc30307b60ca588c737930d73ad2ea
SHA1

88769a6b9103afff138bf6841cd46f3c0ca0632c
SHA256

a4fe031e16b78b6ea7e125cde3466587fc79af0ec148ae768f8abf00ed9ab6f6
SHA512

a702d02a64555c746c0eabe4bfe0022271354af330e4467fab23c75d391650a91f7b1b5da8c67a9c34f2d9f72a95e6df6f8ca916a5173f596172adb184466f9e
SSDEEP

49152:hlY1+c+OUi7KbKsfZ0/m1ilI3VPOpI7pwSQeBhHDGjPz2MZYYLcYpNjE:hl/c+c2b1xSha3VBDBhjSy3CTjE

Score

1^/10

Malware Config

Signatures

Files

GraalSetup.exe
.exe windows:5 windows x86 arch:x86

26185df057e3d7060b5c07eb5dce051e

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:fa:dd:d8:94:93:2e:2d:4d:c8:40:87:46:f5:07:bc
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-03-2014 00:00

Not After

08-05-2015 12:00

Subject

CN=Eurocenter Games,O=Eurocenter Games,L=Paris,ST=Ile-de-France,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

20-05-2014 00:00

Not After

03-06-2015 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:f1:e9:c6:bc:a1:89:d6:30:6a:d3:26:0c:09:68:f2:ce:05:73:8f
Signer

Actual PE Digest

47:f1:e9:c6:bc:a1:89:d6:30:6a:d3:26:0c:09:68:f2:ce:05:73:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryA

Exports

Exports

?AesCbcDecrypt@@YAHPAUAes@@PAEPBEI@Z
?AesCbcEncrypt@@YAHPAUAes@@PAEPBEI@Z
?AesSetIV@@YAHPAUAes@@PBE@Z
?AesSetKey@@YAHPAUAes@@PBEI1H@Z
?Arc4Process@@YAXPAUArc4@@PAEPBEI@Z
?Arc4SetKey@@YAXPAUArc4@@PBEI@Z
?CyaSSL_CIPHER_get_name@CyaInt@@YAPBDPBUCYASSL_CIPHER@1@@Z
?CyaSSL_CTX_OCSP_set_options@CyaInt@@YAJPAUCYASSL_CTX@1@J@Z
?CyaSSL_CTX_OCSP_set_override_url@CyaInt@@YAHPAUCYASSL_CTX@1@PBD@Z
?CyaSSL_CTX_SetCACb@CyaInt@@YAXPAUCYASSL_CTX@1@P6AXPAEHH@Z@Z
?CyaSSL_CTX_check_private_key@CyaInt@@YAHPAUCYASSL_CTX@1@@Z
?CyaSSL_CTX_free@CyaInt@@YAXPAUCYASSL_CTX@1@@Z
?CyaSSL_CTX_load_verify_buffer@CyaInt@@YAHPAUCYASSL_CTX@1@PBEJH@Z
?CyaSSL_CTX_load_verify_locations@CyaInt@@YAHPAUCYASSL_CTX@1@PBD1@Z
?CyaSSL_CTX_new@CyaInt@@YAPAUCYASSL_CTX@1@PAUCYASSL_METHOD@1@@Z
?CyaSSL_CTX_set_cipher_list@CyaInt@@YAHPAUCYASSL_CTX@1@PBD@Z
?CyaSSL_CTX_set_group_messages@CyaInt@@YAHPAUCYASSL_CTX@1@@Z
?CyaSSL_CTX_set_session_cache_mode@CyaInt@@YAJPAUCYASSL_CTX@1@J@Z
?CyaSSL_CTX_set_timeout@CyaInt@@YAHPAUCYASSL_CTX@1@I@Z
?CyaSSL_CTX_set_verify@CyaInt@@YAXPAUCYASSL_CTX@1@HP6AHHPAUCYASSL_X509_STORE_CTX@1@@Z@Z
?CyaSSL_CTX_use_PrivateKey_buffer@CyaInt@@YAHPAUCYASSL_CTX@1@PBEJH@Z
?CyaSSL_CTX_use_PrivateKey_file@CyaInt@@YAHPAUCYASSL_CTX@1@PBDH@Z
?CyaSSL_CTX_use_certificate_buffer@CyaInt@@YAHPAUCYASSL_CTX@1@PBEJH@Z
?CyaSSL_CTX_use_certificate_chain_buffer@CyaInt@@YAHPAUCYASSL_CTX@1@PBEJ@Z
?CyaSSL_CTX_use_certificate_chain_file@CyaInt@@YAHPAUCYASSL_CTX@1@PBD@Z
?CyaSSL_CTX_use_certificate_file@CyaInt@@YAHPAUCYASSL_CTX@1@PBDH@Z
?CyaSSL_CertManagerDisableCRL@CyaInt@@YAHPAUCYASSL_CERT_MANAGER@1@@Z
?CyaSSL_CertManagerEnableCRL@CyaInt@@YAHPAUCYASSL_CERT_MANAGER@1@H@Z
?CyaSSL_CertManagerFree@CyaInt@@YAXPAUCYASSL_CERT_MANAGER@1@@Z
?CyaSSL_CertManagerLoadCA@CyaInt@@YAHPAUCYASSL_CERT_MANAGER@1@PBD1@Z
?CyaSSL_CertManagerNew@CyaInt@@YAPAUCYASSL_CERT_MANAGER@1@XZ
?CyaSSL_CertManagerVerify@CyaInt@@YAHPAUCYASSL_CERT_MANAGER@1@PBDH@Z
?CyaSSL_CertManagerVerifyBuffer@CyaInt@@YAHPAUCYASSL_CERT_MANAGER@1@PBEJH@Z
?CyaSSL_Cleanup@CyaInt@@YAHXZ
?CyaSSL_Debugging_OFF@@YAXXZ
?CyaSSL_Debugging_ON@@YAHXZ
?CyaSSL_ERR_error_string@CyaInt@@YAPADKPAD@Z
?CyaSSL_ERR_error_string_n@CyaInt@@YAXKPADK@Z
?CyaSSL_ERR_print_errors_fp@CyaInt@@YAXPAU_iobuf@@H@Z
?CyaSSL_FreeArrays@CyaInt@@YAXPAUCYASSL@1@@Z
?CyaSSL_GetObjectSize@CyaInt@@YAHXZ
?CyaSSL_Init@CyaInt@@YAHXZ
?CyaSSL_KeepArrays@CyaInt@@YAXPAUCYASSL@1@@Z
?CyaSSL_SetIOReadCtx@CyaInt@@YAXPAUCYASSL@1@PAX@Z
?CyaSSL_SetIOReadFlags@CyaInt@@YAXPAUCYASSL@1@H@Z
?CyaSSL_SetIORecv@CyaInt@@YAXPAUCYASSL_CTX@1@P6AHPAUCYASSL@1@PADHPAX@Z@Z
?CyaSSL_SetIOSend@CyaInt@@YAXPAUCYASSL_CTX@1@P6AHPAUCYASSL@1@PADHPAX@Z@Z
?CyaSSL_SetIOWriteCtx@CyaInt@@YAXPAUCYASSL@1@PAX@Z
?CyaSSL_SetIOWriteFlags@CyaInt@@YAXPAUCYASSL@1@H@Z
?CyaSSL_SetLoggingCb@@YAHP6AXHQBD@Z@Z
?CyaSSL_SetTmpDH@CyaInt@@YAHPAUCYASSL@1@PBEH1H@Z
?CyaSSL_SetVersion@CyaInt@@YAHPAUCYASSL@1@H@Z
?CyaSSL_X509_NAME_oneline@CyaInt@@YAPADPAUCYASSL_X509_NAME@1@PADH@Z
?CyaSSL_X509_free@CyaInt@@YAXPAUCYASSL_X509@1@@Z
?CyaSSL_X509_get_issuer_name@CyaInt@@YAPAUCYASSL_X509_NAME@1@PAUCYASSL_X509@1@@Z
?CyaSSL_X509_get_subjectCN@CyaInt@@YAPADPAUCYASSL_X509@1@@Z
?CyaSSL_X509_get_subject_name@CyaInt@@YAPAUCYASSL_X509_NAME@1@PAUCYASSL_X509@1@@Z
?CyaSSL_check_domain_name@CyaInt@@YAHPAUCYASSL@1@PBD@Z
?CyaSSL_connect@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_connect_cert@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_dtls@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_dtls_get_current_timeout@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_dtls_get_peer@CyaInt@@YAHPAUCYASSL@1@PAXPAI@Z
?CyaSSL_dtls_got_timeout@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_dtls_set_peer@CyaInt@@YAHPAUCYASSL@1@PAXI@Z
?CyaSSL_flush_sessions@CyaInt@@YAXPAUCYASSL_CTX@1@J@Z
?CyaSSL_free@CyaInt@@YAXPAUCYASSL@1@@Z
?CyaSSL_get_alert_history@CyaInt@@YAHPAUCYASSL@1@PAUCYASSL_ALERT_HISTORY@1@@Z
?CyaSSL_get_cipher@CyaInt@@YAPBDPAUCYASSL@1@@Z
?CyaSSL_get_current_cipher@CyaInt@@YAPAUCYASSL_CIPHER@1@PAUCYASSL@1@@Z
?CyaSSL_get_current_cipher_suite@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_get_error@CyaInt@@YAHPAUCYASSL@1@H@Z
?CyaSSL_get_fd@CyaInt@@YAHPBUCYASSL@1@@Z
?CyaSSL_get_peer_certificate@CyaInt@@YAPAUCYASSL_X509@1@PAUCYASSL@1@@Z
?CyaSSL_get_session@CyaInt@@YAPAUCYASSL_SESSION@1@PAUCYASSL@1@@Z
?CyaSSL_get_shutdown@CyaInt@@YAHPBUCYASSL@1@@Z
?CyaSSL_get_using_nonblock@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_get_version@CyaInt@@YAPBDPAUCYASSL@1@@Z
?CyaSSL_is_init_finished@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_library_init@CyaInt@@YAHXZ
?CyaSSL_load_error_strings@CyaInt@@YAXXZ
?CyaSSL_make_eap_keys@CyaInt@@YAHPAUCYASSL@1@PAXIPBD@Z
?CyaSSL_negotiate@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_new@CyaInt@@YAPAUCYASSL@1@PAUCYASSL_CTX@1@@Z
?CyaSSL_peek@CyaInt@@YAHPAUCYASSL@1@PAXH@Z
?CyaSSL_pending@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_read@CyaInt@@YAHPAUCYASSL@1@PAXH@Z
?CyaSSL_recv@CyaInt@@YAHPAUCYASSL@1@PAXHH@Z
?CyaSSL_send@CyaInt@@YAHPAUCYASSL@1@PBXHH@Z
?CyaSSL_session_reused@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_set_cipher_list@CyaInt@@YAHPAUCYASSL@1@PBD@Z
?CyaSSL_set_compression@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_set_fd@CyaInt@@YAHPAUCYASSL@1@H@Z
?CyaSSL_set_group_messages@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_set_session@CyaInt@@YAHPAUCYASSL@1@PAUCYASSL_SESSION@1@@Z
?CyaSSL_set_timeout@CyaInt@@YAHPAUCYASSL@1@I@Z
?CyaSSL_set_using_nonblock@CyaInt@@YAXPAUCYASSL@1@H@Z
?CyaSSL_set_verify@CyaInt@@YAXPAUCYASSL@1@HP6AHHPAUCYASSL_X509_STORE_CTX@1@@Z@Z
?CyaSSL_shutdown@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_use_PrivateKey_buffer@CyaInt@@YAHPAUCYASSL@1@PBEJH@Z
?CyaSSL_use_certificate_buffer@CyaInt@@YAHPAUCYASSL@1@PBEJH@Z
?CyaSSL_use_certificate_chain_buffer@CyaInt@@YAHPAUCYASSL@1@PBEJ@Z
?CyaSSL_want_read@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_want_write@CyaInt@@YAHPAUCYASSL@1@@Z
?CyaSSL_write@CyaInt@@YAHPAUCYASSL@1@PBXH@Z
?CyaSSLv23_client_method@CyaInt@@YAPAUCYASSL_METHOD@1@XZ
?CyaSSLv3_client_method@CyaInt@@YAPAUCYASSL_METHOD@1@XZ
?CyaTLSv1_1_client_method@CyaInt@@YAPAUCYASSL_METHOD@1@XZ
?CyaTLSv1_2_client_method@CyaInt@@YAPAUCYASSL_METHOD@1@XZ
?CyaTLSv1_client_method@CyaInt@@YAPAUCYASSL_METHOD@1@XZ
?FreeRsaKey@CyaInt@@YAXPAURsaKey@1@@Z
?HmacFinal@@YAXPAUHmac@@PAE@Z
?HmacSetKey@@YAXPAUHmac@@HPBEI@Z
?HmacUpdate@@YAXPAUHmac@@PBEI@Z
?InitMd5@@YAXPAUMd5@@@Z
?InitRng@@YAHPAURNG@@@Z
?InitRsaKey@CyaInt@@YAXPAURsaKey@1@PAX@Z
?InitSha256@@YAXPAUSha256@@@Z
?InitSha@@YAXPAUSha@@@Z
?Md5Final@@YAXPAUMd5@@PAE@Z
?Md5Update@@YAXPAUMd5@@PBEI@Z
?RNG_GenerateBlock@@YAXPAURNG@@PAEI@Z
?RNG_GenerateByte@@YAEPAURNG@@@Z
?RsaEncryptSize@CyaInt@@YAHPAURsaKey@1@@Z
?RsaPrivateDecrypt@CyaInt@@YAHPBEIPAEIPAURsaKey@1@@Z
?RsaPrivateDecryptInline@CyaInt@@YAHPAEIPAPAEPAURsaKey@1@@Z
?RsaPrivateKeyDecode@CyaInt@@YAHPBEPAIPAURsaKey@1@I@Z
?RsaPublicEncrypt@CyaInt@@YAHPBEIPAEIPAURsaKey@1@PAURNG@@@Z
?RsaPublicKeyDecode@CyaInt@@YAHPBEPAIPAURsaKey@1@I@Z
?RsaSSL_Sign@CyaInt@@YAHPBEIPAEIPAURsaKey@1@PAURNG@@@Z
?RsaSSL_Verify@CyaInt@@YAHPBEIPAEIPAURsaKey@1@@Z
?RsaSSL_VerifyInline@CyaInt@@YAHPAEIPAPAEPAURsaKey@1@@Z
?SSL_ResourceFree@CyaInt@@YAXPAUCYASSL@1@@Z
?Sha256Final@@YAXPAUSha256@@PAE@Z
?Sha256Update@@YAXPAUSha256@@PBEI@Z
?ShaFinal@@YAXPAUSha@@PAE@Z
?ShaUpdate@@YAXPAUSha@@PBEI@Z
adler32
adler32_combine
adler32_combine64
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

Size: 1.4MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fbndyrix
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tlrwuvpz
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

26185df057e3d7060b5c07eb5dce051e

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

03:fa:dd:d8:94:93:2e:2d:4d:c8:40:87:46:f5:07:bcCertificate

Extended Key Usages

Key Usages

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

47:f1:e9:c6:bc:a1:89:d6:30:6a:d3:26:0c:09:68:f2:ce:05:73:8fSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

Size: 1.4MB - Virtual size: 3.2MB

.rsrc Size: 2KB - Virtual size: 3KB

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 1.6MB

fbndyrix Size: 1.4MB - Virtual size: 1.4MB

tlrwuvpz Size: 512B - Virtual size: 4KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

03:fa:dd:d8:94:93:2e:2d:4d:c8:40:87:46:f5:07:bc
Certificate

06:64:01:46:e9:80:e0:0e:60:a1:4d:8f:44:4a:59:58
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

47:f1:e9:c6:bc:a1:89:d6:30:6a:d3:26:0c:09:68:f2:ce:05:73:8f
Signer

.rsrc
Size: 2KB - Virtual size: 3KB

.idata
Size: 512B - Virtual size: 4KB

fbndyrix
Size: 1.4MB - Virtual size: 1.4MB

tlrwuvpz
Size: 512B - Virtual size: 4KB