66a92897df1331d18c8724c70ff80d89a1743629fb5f348aa64d339df3765d67

Sharing

Copy URL Twitter E-mail

General

Target

66a92897df1331d18c8724c70ff80d89a1743629fb5f348aa64d339df3765d67
Size

10.0MB
MD5

5bc3fd9985683960f193ded2b081a294
SHA1

2a2d73423ba848e23ba9465dd10e16d340c4ec3c
SHA256

66a92897df1331d18c8724c70ff80d89a1743629fb5f348aa64d339df3765d67
SHA512

c9a6238e90b9c77ccf61caee6a4ef7cb5fe27891c41759e4af8a4cfbb2e779e93bb06acda97498a3c1e1a35b6e091d6302dc92daad85de7aa785cf69eee8e305
SSDEEP

196608:8Nqmc7dPaitaAPdH/wxaHbUQcQ7Vm+kmfA4mkm:8Nqmc7QZoiEHbUQcWDAa

Score

1^/10

Malware Config

Signatures

Files

66a92897df1331d18c8724c70ff80d89a1743629fb5f348aa64d339df3765d67
.exe windows:4 windows x86 arch:x86

ee1447e4a709a93822052ef2a0e18daa

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

91:b5:ec:c5:b2:fb:f7:69:b9:0f:f9:d8:60:ff:4b:75:30:8a:d9:1a
Signer

Actual PE Digest

91:b5:ec:c5:b2:fb:f7:69:b9:0f:f9:d8:60:ff:4b:75:30:8a:d9:1a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

excel.pdb

Imports

advapi32

RegCloseKey
RegEnumValueW
RegOpenKeyExW
GetLengthSid
FreeSid
EqualSid
LookupAccountNameW
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
AllocateAndInitializeSid
LookupAccountSidW
GetAce
RevertToSelf
AccessCheck
MapGenericMask
OpenThreadToken
ImpersonateSelf
GetSecurityDescriptorLength
GetAclInformation
GetSecurityDescriptorDacl
SetEntriesInAclW
GetExplicitEntriesFromAclW
BuildTrusteeWithSidW
OpenProcessToken
MakeSelfRelativeSD
MakeAbsoluteSD
GetPrivateObjectSecurity
SetPrivateObjectSecurity
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExA
RegOpenKeyExA
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegOpenKeyA
RegQueryValueExW

gdi32

GetStockObject
CreateSolidBrush
SetWindowExtEx
SetViewportExtEx
SetWindowOrgEx
DPtoLP
LPtoDP
SetMapMode
SetTextColor
SetBkColor
SaveDC
RestoreDC
IntersectClipRect
GetRgnBox
CombineRgn
SetRectRgn
ExcludeClipRect
GetClipBox
GetPaletteEntries
GetNearestPaletteIndex
GetTextFaceW
GetTextMetricsW
SetBkMode
SetROP2
SetBrushOrgEx
GetNearestColor
CreateCompatibleBitmap
GetDIBits
GetBkColor
GetTextColor
EnumFontFamiliesW
GetViewportExtEx
GetWindowExtEx
GetMapMode
CreatePatternBrush
SetBitmapBits
CreateDIBPatternBrush
GetWindowOrgEx
BitBlt
CreateBitmap
CreateBrushIndirect
CreateHatchBrush
CreatePen
ExtCreatePen
PlayMetaFileRecord
PlayEnhMetaFileRecord
DeleteMetaFile
DeleteEnhMetaFile
MoveToEx
GetCurrentPositionEx
LineTo
PatBlt
Ellipse
Arc
Pie
DeleteDC
CreateCompatibleDC
StretchBlt
CreatePolygonRgn
Escape
Polygon
CreateRectRgn
CreateRectRgnIndirect
CloseMetaFile
EnumMetaFile
CreateMetaFileW
SetMetaFileBitsEx
GetWinMetaFileBits
GetEnhMetaFileHeader
SetWinMetaFileBits
GetMetaFileBitsEx
PlayEnhMetaFile
EnumEnhMetaFile
GdiComment
ScaleViewportExtEx
SetPixel
GetPixel
GetBitmapBits
Polyline
GdiFlush
RealizePalette
SelectPalette
CreatePalette
GetSystemPaletteEntries
SetDIBits
CreateDIBSection
RoundRect
Rectangle
CreateRoundRectRgn
OffsetRgn
PaintRgn
GetTextExtentPointA
GetCharWidthA
SetTextAlign
GetTextAlign
GetCurrentObject
SetMapperFlags
EnumObjects
UnrealizeObject
EndDoc
AbortDoc
ExtEscape
EndPage
StretchDIBits
SetStretchBltMode
SetAbortProc
StartPage
CreateICW
InvertRgn
GetEnhMetaFileBits
SetEnhMetaFileBits
GetObjectType
CopyEnhMetaFileW
CopyMetaFileW
CreateDIBitmap
CreateFontIndirectW
GetObjectW
GetTextExtentPointW
GetCharWidthW
ExtTextOutW
ExtTextOutA
GetClipRgn
GetTextExtentExPointW
TextOutW
GetTextExtentPoint32W
SetViewportOrgEx
CreateFontA
CreateBitmapIndirect
GetObjectA
SelectClipRgn
GetDeviceCaps
EnumFontsW
GetTextCharsetInfo
DeleteObject
SelectObject
GetOutlineTextMetricsW

kernel32

SetLastError
GetModuleFileNameW
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
GetVersionExA
WinExec
GetSystemDefaultLCID
MulDiv
GetVersionExW
lstrlenW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
IsDBCSLeadByte
IsDBCSLeadByteEx
GetACP
GetDriveTypeW
GetFileSize
GlobalSize
GetFileTime
SetFileTime
GetVolumeInformationW
LockFile
UnlockFile
GetCurrentDirectoryW
MoveFileW
DeleteFileW
SetFilePointer
SetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
WriteFile
CreateFileW
SearchPathW
CloseHandle
ReadFile
GlobalReAlloc
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTickCount
SetErrorMode
GetShortPathNameW
LoadResource
FindResourceW
GetLocalTime
LocalFileTimeToFileTime
SystemTimeToFileTime
FreeLibrary
GlobalHandle
FileTimeToSystemTime
FileTimeToLocalFileTime
LCMapStringW
GetStringTypeW
CompareStringA
IsBadReadPtr
lstrcmpW
RaiseException
GetUserDefaultLCID
GetOEMCP
lstrcmpiA
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoW
LocalAlloc
LocalFree
GetCurrentThread
GlobalAddAtomW
LoadLibraryA
GetTempPathW
GetCurrentProcess
WideCharToMultiByte
GetCommandLineW
MultiByteToWideChar
GetWindowsDirectoryW
GetTempFileNameW
IsBadWritePtr
SetUnhandledExceptionFilter
TerminateProcess
VirtualAlloc
GetSystemTime
CreateMutexW
InterlockedIncrement
InterlockedDecrement
ReleaseMutex
WaitForSingleObject
GetEnvironmentVariableW
GetSystemDefaultLangID
LockResource
SizeofResource
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateThread
InitializeCriticalSection
SetThreadPriority
CreateThread
VirtualFree
IsValidCodePage
EnumSystemLocalesW
EnumCalendarInfoW
FreeResource
GetFullPathNameW
GetLogicalDrives
IsValidLocale
GlobalGetAtomNameW
GlobalDeleteAtom
SetHandleCount
OpenFile
LoadLibraryExA
GetStartupInfoA
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
VirtualProtect
UnhandledExceptionFilter
GetDriveTypeA
GetVolumeInformationA
GetCurrentDirectoryA
FindFirstFileA
FindNextFileA
FormatMessageA
GetSystemDirectoryW
LoadLibraryExW
LoadLibraryW
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetLastError
InterlockedExchange

ole32

CoInitialize
OleQueryLinkFromData
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetUserType
CreateOleAdviseHolder
CoRegisterClassObject
CoRevokeClassObject
CoFreeUnusedLibraries
OleQueryCreateFromData
CoUninitialize
CoRegisterMessageFilter
OleCreateFromData
GetHGlobalFromILockBytes
OleIsCurrentClipboard
CoCreateGuid
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleSetMenuDescriptor
ReadClassStm
CoTreatAsClass
OleTranslateAccelerator
SetConvertStg
OleConvertIStorageToOLESTREAM
OleConvertOLESTREAMToIStorage
OleSave
IsAccelerator
OleLoad
OleSetContainedObject
CoGetClassObject
OleSaveToStream
WriteClassStm
CoTaskMemAlloc
CoFileTimeNow
CreateItemMoniker
OleGetIconOfClass
CoIsOle1Class
ReadFmtUserTypeStg
OleCreate
OleCreateFromFile
GetRunningObjectTable
CreateFileMoniker
StgSetTimes
ReadClassStg
CoDisconnectObject
CreateGenericComposite
OleIsRunning
ProgIDFromCLSID
OleRun
CreateBindCtx
OleCreateLink
OleCreateLinkFromData
ReleaseStgMedium
MkParseDisplayName
OleCreateLinkToFile
CoTaskMemFree
CoLockObjectExternal
CreateStreamOnHGlobal
GetHGlobalFromStream
StgIsStorageFile
StgCreateDocfile
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoCreateInstance
GetClassFile
StringFromGUID2
StgOpenStorage
CoCreateInstanceEx
CLSIDFromString
StringFromCLSID
CoGetMalloc
OleSetClipboard
OleFlushClipboard
WriteFmtUserTypeStg
WriteClassStg
OleGetClipboard

user32

CharUpperBuffA
MessageBoxA
CharUpperW
UnpackDDElParam
SendMessageTimeoutW
PackDDElParam
GetDoubleClickTime
GetWindowDC
GetSysColor
SetForegroundWindow
ShowWindow
EndDeferWindowPos
DeferWindowPos
SetWindowPos
ScreenToClient
GetWindowRect
SystemParametersInfoW
RegisterClassW
MonitorFromRect
SendMessageW
FillRect
GetClientRect
SetWindowLongW
SetWindowPlacement
GetWindowPlacement
IsIconic
GetWindow
GetWindowLongW
SetActiveWindow
PtInRect
GetSystemMetrics
UnhookWindowsHookEx
SetKeyboardState
GetKeyboardState
SetWindowsHookExW
ReleaseDC
GetDC
LoadIconW
LoadCursorW
SetMessageQueue
RegisterWindowMessageA
IntersectRect
IsRectEmpty
GetMonitorInfoW
MonitorFromPoint
MonitorFromWindow
SetRect
InvalidateRect
BeginPaint
EndPaint
GetWindowTextW
GetUpdateRgn
InvalidateRgn
ValidateRect
ValidateRgn
SetCapture
ReleaseCapture
GetCapture
SetFocus
EnableWindow
IsWindowEnabled
UpdateWindow
DispatchMessageW
FlashWindow
GetClassLongW
GetFocus
BeginDeferWindowPos
GetTopWindow
GetParent
ClientToScreen
GetUpdateRect
SetClassLongW
UnionRect
AdjustWindowRectEx
ShowCaret
HideCaret
RegisterClassExW
ExcludeUpdateRgn
ScrollDC
IsWindowVisible
GetSystemMenu
GetActiveWindow
PeekMessageW
IsChild
DestroyWindow
IsWindow
InSendMessage
VkKeyScanW
GetClassNameW
GetQueueStatus
GetKeyState
GetAsyncKeyState
GetInputState
SetTimer
KillTimer
PostQuitMessage
GetCursorPos
MapVirtualKeyW
TranslateMessage
WaitMessage
MsgWaitForMultipleObjects
RegisterClipboardFormatW
SetCursor
ShowCursor
MessageBeep
OpenIcon
GetWindowThreadProcessId
FindWindowW
EnumDisplayMonitors
SetRectEmpty
CreateMenu
DestroyMenu
DrawMenuBar
GetMenuItemID
GetMenuItemCount
DeleteMenu
RemoveMenu
GetSubMenu
GetMenuState
EnableMenuItem
SetScrollPos
CallWindowProcW
GetDlgItem
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollInfo
GetWindowWord
SetWindowWord
EnumThreadWindows
CloseClipboard
EmptyClipboard
SetCaretPos
GetKeyboardLayout
SetClipboardData
GetClipboardData
OpenClipboard
GetClipboardOwner
EnumClipboardFormats
IsClipboardFormatAvailable
CreateCaret
DestroyCaret
GetCaretPos
GetMessageExtraInfo
OffsetRect
InflateRect
PostMessageW
CloseDesktop
GetUserObjectInformationW
OpenInputDesktop
GetThreadDesktop
CharUpperBuffW
IsCharUpperW
SetWindowTextA
IsWindowUnicode
PeekMessageA
DispatchMessageA
CreateWindowExW
DrawTextW
DrawTextA
GetMessageW
SetParent
WindowFromPoint
GetMessageTime
GetScrollInfo
SendMessageA
UnregisterClassW
MoveWindow
PostMessageA
GetMessagePos
SetCursorPos
GetClipboardFormatNameW
FreeDDElParam
GetDesktopWindow
EqualRect
ArrangeIconicWindows
RedrawWindow
DrawFocusRect
ToUnicode
ToAscii
GetMenu
IsZoomed
EnumChildWindows
CharLowerBuffW
RegisterWindowMessageW
CharUpperA
CharLowerW
ActivateKeyboardLayout
DrawIconEx
DestroyIcon
DrawIcon
GetCursor
SetMenu
CreateAcceleratorTableW
MapWindowPoints
GetForegroundWindow
DefWindowProcW
SetWindowTextW
DrawFrameControl
LoadCursorFromFileW
GetIconInfo
CallNextHookEx
GetKeyboardLayoutList
MessageBoxW
DestroyAcceleratorTable

msvcrt

exit
memmove
rand
srand
_wtoi
wcslen
atof
_ecvt
_fpreset
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
__CxxFrameHandler
swprintf
_chdir
_controlfp
_except_handler3

Exports

Exports

DllGetLCID
MdCallBack
_LPenHelper

Sections

.text
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ee1447e4a709a93822052ef2a0e18daa

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

91:b5:ec:c5:b2:fb:f7:69:b9:0f:f9:d8:60:ff:4b:75:30:8a:d9:1aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

user32

msvcrt

Exports

Exports

Sections

.text Size: 8.5MB - Virtual size: 8.5MB

.data Size: 78KB - Virtual size: 97KB

.cdata Size: 512B - Virtual size: 4B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

91:b5:ec:c5:b2:fb:f7:69:b9:0f:f9:d8:60:ff:4b:75:30:8a:d9:1a
Signer

.text
Size: 8.5MB - Virtual size: 8.5MB

.data
Size: 78KB - Virtual size: 97KB

.cdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB