887d2bfc8cd9387cd16d34616f9734fd12fac09875e5e48059cea8018064fe51N

Sharing

Copy URL Twitter E-mail

General

Target

887d2bfc8cd9387cd16d34616f9734fd12fac09875e5e48059cea8018064fe51N
Size

2.5MB
MD5

10b20ead53ad4150340716f444248cd0
SHA1

6908e664eddee3edd80ff238f8fe2d8fa3d45b71
SHA256

887d2bfc8cd9387cd16d34616f9734fd12fac09875e5e48059cea8018064fe51
SHA512

f938325e1b3faad2f06da8605821d84302538614e5141a31c5d937cf7e38eac8518f626221c529e3539233b921de1f053e869e49062e96456efc70e5cc93bbfb
SSDEEP

49152:DpKG4rXfWljKuXSLv2nmnM4atqZdd1v+0Krb7e:D0G4Df4WuiKnmnM4aqTPKrba

Score

1^/10

Malware Config

Signatures

Files

887d2bfc8cd9387cd16d34616f9734fd12fac09875e5e48059cea8018064fe51N
.exe windows:5 windows x86 arch:x86

e77d6119758ae88950c35e8f7a774e8c

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

06/02/2024, 14:52

Not After

02/02/2025, 09:32

Subject

CN=Open Source Developer\, Noriyuki Miyazaki,O=Open Source Developer,L=Sapporo,ST=Hokkaido,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

06/02/2024, 14:52

Not After

02/02/2025, 09:32

Subject

CN=Open Source Developer\, Noriyuki Miyazaki,O=Open Source Developer,L=Sapporo,ST=Hokkaido,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:da:a3:d1:72:bf:80:de:65:bb:93:c7:bc:c3:33:2a:95:47:e8:8e:e9:73:06:ff:03:12:23:0e:38:fb:1d:ac
Signer

Actual PE Digest

6d:da:a3:d1:72:bf:80:de:65:bb:93:c7:bc:c3:33:2a:95:47:e8:8e:e9:73:06:ff:03:12:23:0e:38:fb:1d:ac

Digest Algorithm

sha256

PE Digest Matches

true

33:94:7f:69:08:6b:0a:49:dd:ec:5a:c2:8f:9e:27:9d:b6:9d:00:f6
Signer

Actual PE Digest

33:94:7f:69:08:6b:0a:49:dd:ec:5a:c2:8f:9e:27:9d:b6:9d:00:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
LoadLibraryExA
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
LCMapStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
IsValidLocale
GetOEMCP
IsValidCodePage
GetStringTypeW
GetCPInfo
ExitProcess
GetStdHandle
HeapQueryInformation
GetFileType
SetStdHandle
GetCommandLineA
GetModuleHandleExW
VirtualQuery
GetSystemInfo
RtlUnwind
OutputDebugStringW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FileTimeToLocalFileTime
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
FileTimeToSystemTime
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GetThreadLocale
DuplicateHandle
UnlockFile
SetEndOfFile
LockFile
GetFullPathNameW
GetFileSize
FlushFileBuffers
GetCurrentProcessId
lstrcmpA
GetCurrentThread
CreateEventW
SetEvent
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryA
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
FormatMessageW
MulDiv
LocalFree
GlobalFree
GetModuleHandleA
SetLastError
OutputDebugStringA
GetACP
FreeLibrary
VirtualFree
VirtualAlloc
OpenMutexW
ReleaseMutex
DeviceIoControl
SetFilePointer
ReadFile
GetDriveTypeW
DefineDosDeviceW
LoadLibraryW
MultiByteToWideChar
GetPrivateProfileStringW
GetTickCount
VerifyVersionInfoW
GetVersionExW
GetWindowsDirectoryW
GetCurrentProcess
VerSetConditionMask
FindNextFileW
FindFirstFileW
FindClose
lstrlenW
lstrcmpW
LoadLibraryExW
VirtualProtect
GetTimeZoneInformation
GetProcAddress
GetModuleHandleW
WritePrivateProfileStringW
GetVolumeInformationW
GetDiskFreeSpaceExW
WideCharToMultiByte
GlobalLock
GlobalUnlock
GlobalAlloc
GetComputerNameW
GetLocalTime
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetTempPathW
WriteFile
DeleteFileW
CreateFileW
GetPrivateProfileIntW
GetModuleFileNameW
Sleep
CreateMutexW
SetErrorMode
CloseHandle
CreateDirectoryW
GetCommandLineW
GetUserDefaultLCID
FindResourceW
SizeofResource
LockResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
GetConsoleMode
DecodePointer

user32

RealChildWindowFromPoint
GetSysColorBrush
WindowFromPoint
CharUpperW
ClientToScreen
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
RegisterClipboardFormatW
PostQuitMessage
TranslateMessage
GetMessageW
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
MapDialogRect
GetClassNameW
GetClassLongW
PtInRect
EqualRect
GetSysColor
ScreenToClient
UnregisterClassW
EnableWindow
InvalidateRect
GetClientRect
MessageBoxW
AdjustWindowRectEx
GetWindowTextLengthW
RemovePropW
GetPropW
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
SetActiveWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
SetCapture
ReleaseCapture
PostThreadMessageW
IntersectRect
CharNextW
CopyAcceleratorTableW
InvalidateRgn
SetRect
GetClassInfoW
RegisterClassW
CallWindowProcW
GetMessageTime
IsRectEmpty
SetWindowContextHelpId
MessageBeep
GetTopWindow
RegisterWindowMessageW
SendMessageW
UnregisterDeviceNotification
PostMessageW
WaitForInputIdle
IsWindowVisible
IsIconic
SetTimer
KillTimer
GetSystemMetrics
GetMenuState
DrawMenuBar
DestroyMenu
CheckMenuItem
GetSubMenu
DrawIcon
SetForegroundWindow
GetWindowTextW
FillRect
GetWindowRect
EnumWindows
GetWindowThreadProcessId
CheckMenuRadioItem
LoadIconW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterDeviceNotificationW
CopyRect
MonitorFromRect
CreateMenu
CreatePopupMenu
TrackPopupMenu
InsertMenuItemW
GetCursorPos
LoadImageW
wsprintfW
EnableMenuItem
RedrawWindow
AppendMenuW
ModifyMenuW
GetNextDlgGroupItem
RemoveMenu
SetScrollPos
GetScrollPos
SetScrollRange
SetCursor
GetMessagePos
PeekMessageW
DispatchMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetFocus
GetMenuItemCount
GetMenuItemID
GetParent
SetRectEmpty
SendDlgItemMessageA
GetWindowInfo
AdjustWindowRect
GetMenuBarInfo
OffsetRect
MapWindowPoints
GetWindowDC
GetMenuItemInfoW
DefWindowProcW
FrameRect
PrintWindow
SetWindowLongW
GetWindowLongW
ReleaseDC
GetDC
TranslateAcceleratorW
LoadAcceleratorsW
SystemParametersInfoW
SetPropW
LoadCursorW

gdi32

GetRgnBox
GetMapMode
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
SetBkMode
ExtSelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetClipBox
Escape
SetBkColor
CreateBitmap
GetPixel
CreatePatternBrush
GetTextColor
GetBkColor
CreateSolidBrush
MoveToEx
BitBlt
DeleteDC
EnumFontFamiliesExW
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteObject
GetBitmapBits
GetDeviceCaps
SetMapMode
GetObjectW
GetTextExtentPoint32W
LineTo
SelectObject
SetBitmapBits
SetTextColor
CreateDIBSection
SetDIBColorTable

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

OpenSCManagerW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceW
QueryServiceStatus
OpenServiceW
CloseServiceHandle
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
FreeSid
AllocateAndInitializeSid
AddAccessAllowedAce
RegCloseKey

shell32

ShellExecuteW
ord680
SHAppBarMessage
Shell_NotifyIconW
SHGetSpecialFolderPathW
CommandLineToArgvW

comctl32

ImageList_ReplaceIcon
_TrackMouseEvent
InitCommonControlsEx

shlwapi

UrlCreateFromPathW
PathFindFileNameW
SHDeleteKeyW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
PathFindExtensionW

uxtheme

SetWindowTheme
OpenThemeData
CloseThemeData

ole32

CoGetClassObject
CLSIDFromString
CoRevokeClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
OleFlushClipboard
OleIsCurrentClipboard
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromProgID
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter

oleaut32

SysAllocStringLen
VariantChangeType
VariantCopy
LoadRegTypeLi
DispCallFunc
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
SafeArrayDestroy
SysAllocString
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
SafeArrayGetElement
VariantClear
VariantInit
SysFreeString

gdiplus

GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipDrawImageI
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImageEncoders
GdiplusStartup
GdipGetImageGraphicsContext
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFileICM

winmm

mciSendCommandW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

setupapi

SetupDiGetClassDevsW
CM_Get_Device_IDW
SetupDiEnumDeviceInfo

oleacc

LresultFromObject
CreateStdAccessibleObject

Sections

.text
Size: 797KB - Virtual size: 796KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e77d6119758ae88950c35e8f7a774e8c

Code Sign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45Certificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

6d:da:a3:d1:72:bf:80:de:65:bb:93:c7:bc:c3:33:2a:95:47:e8:8e:e9:73:06:ff:03:12:23:0e:38:fb:1d:acSigner

33:94:7f:69:08:6b:0a:49:dd:ec:5a:c2:8f:9e:27:9d:b6:9d:00:f6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

winmm

version

wintrust

crypt32

setupapi

oleacc

Sections

.text Size: 797KB - Virtual size: 796KB

.rdata Size: 242KB - Virtual size: 242KB

.data Size: 15KB - Virtual size: 57KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

2a:40:05:f1:0b:2e:57:68:09:a7:d1:c2:86:60:28:45
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

6d:da:a3:d1:72:bf:80:de:65:bb:93:c7:bc:c3:33:2a:95:47:e8:8e:e9:73:06:ff:03:12:23:0e:38:fb:1d:ac
Signer

33:94:7f:69:08:6b:0a:49:dd:ec:5a:c2:8f:9e:27:9d:b6:9d:00:f6
Signer

.text
Size: 797KB - Virtual size: 796KB

.rdata
Size: 242KB - Virtual size: 242KB

.data
Size: 15KB - Virtual size: 57KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB