77199bff04d10af411fe43bd50853de204a97f998523094840fb2af733eae6b2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

77199bff04d10af411fe43bd50853de204a97f998523094840fb2af733eae6b2.exe
Size

5.3MB
MD5

8b134a7bd31f9c4da7661999352c37c8
SHA1

522153d88579fa8b94bcbe4a0e5cd792ec0f7af8
SHA256

77199bff04d10af411fe43bd50853de204a97f998523094840fb2af733eae6b2
SHA512

36f599558a6b8d0e11f8ccc8a04869c2f6bcbd3e320ce0a6eaed5e32ee795bb2d19baef9f009027c0c4bdc642b2adbfa806b5f6a00536255fd36431645a7c074
SSDEEP

98304:3Fw/EmFS0PeSXtOe5r4WxKEFq7uf1zoCBOdfj5Kl8Npjdu7xdulfFLgURXrIn2rb:6lFjeqtXr/xfFq7uf1sVKl83jdqIVFLR

Score

1^/10

Malware Config

Signatures

Files

77199bff04d10af411fe43bd50853de204a97f998523094840fb2af733eae6b2.exe
.dll windows:6 windows x64 arch:x64

7f8e5f00ce8f2e6817f745ed4bfb22ba

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/07/2015, 00:00

Not After

26/07/2018, 23:59

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:91:39:8c:09:24:77:d6
Certificate

Issuer

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Not Before

25/03/2008, 17:46

Not After

20/11/2024, 17:46

Subject

SERIALNUMBER=VxnFNSrl,CN=conspiracy.rip,OU=conspiracy,O=conspiracy,C=cn+C=CN,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970,2.5.4.42=#130a636f6e73706972616379,2.5.4.13=#130a636f6e73706972616379,2.5.4.12=#130a636f6e73706972616379,1.2.840.113549.1.9.1=#0c19636f6e7370697261637940636f6e737069726163792e726970

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:d9:24:d9:4b:5d:f4:5f:78:7d:19:6b:67:3b:b7:87:f6:a6:53:8e
Signer

Actual PE Digest

66:d9:24:d9:4b:5d:f4:5f:78:7d:19:6b:67:3b:b7:87:f6:a6:53:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

kernel32

AcquireSRWLockExclusive
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.retplne
Size: - Virtual size: 200B

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nigger0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nigger1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f8e5f00ce8f2e6817f745ed4bfb22ba

Code Sign

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate

Extended Key Usages

Key Usages

16:91:39:8c:09:24:77:d6Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

66:d9:24:d9:4b:5d:f4:5f:78:7d:19:6b:67:3b:b7:87:f6:a6:53:8eSigner

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

wtsapi32

Sections

.text Size: - Virtual size: 266KB

.rdata Size: - Virtual size: 73KB

.data Size: - Virtual size: 2.8MB

.pdata Size: - Virtual size: 6KB

.00cfg Size: - Virtual size: 56B

.fptable Size: - Virtual size: 256B

.retplne Size: - Virtual size: 200B

.tls Size: - Virtual size: 9B

_RDATA Size: - Virtual size: 500B

.nigger0 Size: - Virtual size: 3.4MB

.nigger1 Size: 5.3MB - Virtual size: 5.3MB

.reloc Size: 512B - Virtual size: 196B

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
Certificate

16:91:39:8c:09:24:77:d6
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

66:d9:24:d9:4b:5d:f4:5f:78:7d:19:6b:67:3b:b7:87:f6:a6:53:8e
Signer

.text
Size: - Virtual size: 266KB

.rdata
Size: - Virtual size: 73KB

.data
Size: - Virtual size: 2.8MB

.pdata
Size: - Virtual size: 6KB

.00cfg
Size: - Virtual size: 56B

.fptable
Size: - Virtual size: 256B

.retplne
Size: - Virtual size: 200B

.tls
Size: - Virtual size: 9B

_RDATA
Size: - Virtual size: 500B

.nigger0
Size: - Virtual size: 3.4MB

.nigger1
Size: 5.3MB - Virtual size: 5.3MB

.reloc
Size: 512B - Virtual size: 196B