724b6c0238483bc2b34ad69bcb0f5beda53ea339986717127b3a23cd4c504c71

Sharing

Copy URL Twitter E-mail

General

Target

724b6c0238483bc2b34ad69bcb0f5beda53ea339986717127b3a23cd4c504c71
Size

858KB
MD5

394f10eb05764cd14414036f23e12824
SHA1

4ed99316112866be33d4379a143ad361cee95f41
SHA256

724b6c0238483bc2b34ad69bcb0f5beda53ea339986717127b3a23cd4c504c71
SHA512

fe8ec2d99f4218ae7ad36de859397a361272291aab4dcf22ad3d7101992a85383787fe89485f927efdd6971e494588e3b6886dea21499413833c025b96ac3f03
SSDEEP

24576:AeFtZQHhR0yxy6buxmeVzxTbTuySQjvIZc5OM15C+IrFYnM:ZtZkOKxS4eVzIe5d1E+oFYnM

Score

1^/10

Malware Config

Signatures

Files

724b6c0238483bc2b34ad69bcb0f5beda53ea339986717127b3a23cd4c504c71
.exe windows:5 windows x86 arch:x86

e4785a88838a313a635d15b1c179cf82

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d0:28:a3:6b:be:4e:c1:b7:fb:f8:0d:51:7a:1b:56:c6
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/01/2016, 00:00

Not After

09/03/2019, 23:59

Subject

CN=Alfredo Anibal Santos Silva,O=Alfredo Anibal Santos Silva,POSTALCODE=66660,STREET=Rue du grand large+STREET=Résidence les angéliques,L=Port vendres,ST=Languedoc - Roussillon,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:13:43:c6:65:7d:a1:66:dc:89:ca:79:57:a5:c7:e7:c8:a0:18:3b
Signer

Actual PE Digest

f6:13:43:c6:65:7d:a1:66:dc:89:ca:79:57:a5:c7:e7:c8:a0:18:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\VisualStudio\Projects\UltraAdwareKiller\Release\UltraAdwareKiller.pdb

Imports

kernel32

GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
HeapFree
HeapAlloc
GetACP
GetModuleHandleExW
GetStdHandle
LoadLibraryExW
RaiseException
RtlUnwind
Thread32First
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetEnvironmentStringsW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
QueryPerformanceFrequency
ProcessIdToSessionId
GetCurrentProcessId
WTSGetActiveConsoleSessionId
SuspendThread
LockResource
LoadResource
SizeofResource
FindResourceW
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
FreeEnvironmentStringsW
IsValidLocale
TerminateProcess
WaitForSingleObject
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
CreateDirectoryW
InterlockedDecrement
Sleep
GetExitCodeProcess
GetProcessId
CreateProcessW
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetFileType
GetProcessHeap
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
WriteConsoleW
OpenThread
GetProcAddress
LoadLibraryW
FreeLibrary
SetPriorityClass
GetPrivateProfileSectionW
GetPrivateProfileIntW
SetFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
UnmapViewOfFile
GetStartupInfoW
GetLocalTime
Thread32Next
TerminateThread
GetCPInfo
ExitProcess
GetModuleFileNameW
SetFilePointer
WriteFile
SetFilePointerEx
GetFileSize
FileTimeToSystemTime
RemoveDirectoryW
MoveFileExW
SetFileAttributesW
GetFileAttributesW
GetLastError
DeleteFileW
ReadFile
GetFileSizeEx
CreateFileW
GetTempPathW
GetSystemWindowsDirectoryW
GetLongPathNameW
GetSystemDirectoryW
SleepEx
CreateThread
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
GetExitCodeThread
SetLastError
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileStringW
ExpandEnvironmentStringsW
WideCharToMultiByte
LocalAlloc
LocalFree
FindNextFileW
FindClose
FindFirstFileW
CloseHandle
GetLocaleInfoW

user32

GetFocus
TrackPopupMenu
DispatchMessageW
TranslateMessage
PeekMessageW
EnableWindow
GetMenuItemInfoW
SetMenuItemInfoW
SetClassLongW
GetSysColor
DeleteMenu
SystemParametersInfoW
GetWindowRect
SetWindowPos
SendMessageW
CreateWindowExW
GetIconInfo
GetDC
DrawIconEx
ReleaseDC
DestroyIcon
GetClientRect
RedrawWindow
RemoveMenu
InsertMenuItemW
wsprintfW
MapWindowPoints
InvalidateRect
SetWindowRgn
FillRect
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowInfo
DefWindowProcW
EnumChildWindows
GetClassNameW
EnumWindows
GetWindowLongW
WindowFromPoint
GetSystemMetrics
SetFocus
FindWindowExW
SetCursor
GetUpdateRect
BeginPaint
GetWindowDC
GetSysColorBrush
EndPaint
GetMessageW
IsDialogMessageW
GetClassLongW
LoadCursorW
GetClassInfoExW
AdjustWindowRectEx
ShowWindow
DestroyWindow
DestroyMenu
UnregisterClassW
DestroyAcceleratorTable
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
RegisterClassExW
TranslateAcceleratorW
CreateAcceleratorTableW
CopyImage
SetMenuDefaultItem
SetWindowLongW
UpdateWindow
DefDlgProcW
ChildWindowFromPoint
GetMenuItemID
GetWindowRgn
CreatePopupMenu
SetMenuInfo
ExitWindowsEx
FindWindowW
SetForegroundWindow
GetParent

gdi32

OffsetRgn
FillRgn
CombineRgn
CreateRectRgn
GetStockObject
SetBkMode
SetBkColor
SetTextColor
CreateSolidBrush
GetBkColor
BitBlt
ExtSelectClipRgn
SetStretchBltMode
CreateCompatibleBitmap
DeleteDC
SelectObject
CreateCompatibleDC
GetObjectW
CreateDIBSection
CreateFontW
DeleteObject
CreatePatternBrush
ExcludeClipRect
SelectClipRgn
GetTextExtentPoint32W
SetBrushOrgEx
StretchBlt
PatBlt

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW
RegCreateKeyW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetKeySecurity
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
TreeResetNamedSecurityInfoW
GetAce
EqualSid
IsValidAcl
GetNamedSecurityInfoW
AddAce
GetLengthSid
IsValidSid
InitializeAcl
CreateWellKnownSid
LookupAccountNameW
ConvertStringSidToSidW
GetTokenInformation
ConvertSidToStringSidW
RegLoadKeyW
LookupAccountSidW
RegUnLoadKeyW
SystemFunction036

shell32

SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ord190
SHOpenFolderAndSelectItems
ord6
ExtractIconExW
DragQueryPoint
DragFinish
DragQueryFileW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

shlwapi

ord487
PathParseIconLocationW
PathFindOnPathW
PathFileExistsW
PathIsDirectoryW

netapi32

NetApiBufferFree
NetUserEnum

version

GetFileVersionInfoW
VerQueryValueW

sfc

SfcIsFileProtected

userenv

ExpandEnvironmentStringsForUserW
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryW

gdiplus

GdipFillRectangleI
GdipFillPath
GdipDrawString
GdipDrawImageRect
GdipDrawImageI
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipCreateRegionPath
GdipDeleteRegion
GdipGetRegionHRgn
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdiplusShutdown
GdipFillRectangle
GdipDrawPath
GdipDrawRectangleI
GdipDrawArc
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHWND
GdipCreateFromHDC
GdipAddPathPolygon
ord1
GdipAddPathLine
GdipClosePathFigure
GdipResetPath
GdipDeletePath
GdipCreatePath
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetPenDashStyle
GdipSetPenEndCap
GdipDeletePen
GdipCreatePen1
GdipSetLineColors
GdipCreateLineBrushFromRectI
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM

psapi

EnumProcesses
GetModuleFileNameExW

comctl32

ord410
ord411
ImageList_Remove
ImageList_Create
ImageList_Add
ImageList_GetIcon
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_GetImageCount
ord413
ord412
ImageList_Replace

uxtheme

SetWindowTheme

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

wininet

InternetReadFile
InternetGetConnectedState
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
FtpGetFileSize
FtpOpenFileW

msi

ord70
ord16

Sections

.text
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4785a88838a313a635d15b1c179cf82

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

d0:28:a3:6b:be:4e:c1:b7:fb:f8:0d:51:7a:1b:56:c6Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

f6:13:43:c6:65:7d:a1:66:dc:89:ca:79:57:a5:c7:e7:c8:a0:18:3bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

version

sfc

userenv

gdiplus

psapi

comctl32

uxtheme

wtsapi32

wininet

msi

Sections

.text Size: 394KB - Virtual size: 393KB

.rdata Size: 207KB - Virtual size: 206KB

.data Size: 4KB - Virtual size: 7KB

.gfids Size: 1024B - Virtual size: 528B

.rsrc Size: 225KB - Virtual size: 225KB

.reloc Size: 19KB - Virtual size: 19KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

d0:28:a3:6b:be:4e:c1:b7:fb:f8:0d:51:7a:1b:56:c6
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

f6:13:43:c6:65:7d:a1:66:dc:89:ca:79:57:a5:c7:e7:c8:a0:18:3b
Signer

.text
Size: 394KB - Virtual size: 393KB

.rdata
Size: 207KB - Virtual size: 206KB

.data
Size: 4KB - Virtual size: 7KB

.gfids
Size: 1024B - Virtual size: 528B

.rsrc
Size: 225KB - Virtual size: 225KB

.reloc
Size: 19KB - Virtual size: 19KB