6692167ed62bec920159aac715f5918a8acaf386a63e9e824fd364581fb7f5e9

Sharing

Copy URL Twitter E-mail

General

Target

6692167ed62bec920159aac715f5918a8acaf386a63e9e824fd364581fb7f5e9
Size

745KB
MD5

40ec21328b397fe0f0e1042e6e743cf0
SHA1

ad4a720bdb4b15cc12023da9985ff6631e65f970
SHA256

6692167ed62bec920159aac715f5918a8acaf386a63e9e824fd364581fb7f5e9
SHA512

5b9318a75e4e6e90b0c54ba758b190dc1ee51ef3c11c360a915bc26ae14d655547c018a7418e71a6b474dcd0739ffc2e8a49ee4be2f2dad7739ef3f1430571a4
SSDEEP

12288:iZqzHmVZUCgmjdvlFSl266H+oZ8EIBMzXixXgo+MymqdmYJWMzudwaj:iZqqnUeVSeIBM8go+nd9JWMz2

Score

N/A

Malware Config

Signatures

Files

6692167ed62bec920159aac715f5918a8acaf386a63e9e824fd364581fb7f5e9
.exe windows x86

018b986e92840f33538950c68c2f9e98

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bb
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/02/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),POSTALCODE=31905,STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f9:61:1b:0a:1e:bf:9c:fc:c4:5a:0f:05:a1:52:7a:d6:7d:aa:4d:ee
Signer

Actual PE Digest

f9:61:1b:0a:1e:bf:9c:fc:c4:5a:0f:05:a1:52:7a:d6:7d:aa:4d:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),POSTALCODE=31905,STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,C=IL

01/09/2015, 13:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameW
FormatMessageA
FormatMessageW
GetVersionExW
GetSystemDirectoryW
GetEnvironmentVariableW
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
MultiByteToWideChar
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
IsWow64Process
InterlockedExchange
GetProcAddress
LoadLibraryW
FreeLibrary
ExitThread
GetLocalTime
Sleep
WaitForSingleObject
CreateThread
ResetEvent
SetEvent
WaitForMultipleObjects
CreateEventW
SetThreadPriority
TerminateThread
GetModuleFileNameW
MoveFileExW
GetTickCount
CreateProcessW
GetSystemInfo
GetModuleHandleW
GetExitCodeProcess
GetFileTime
GetTempPathW
SetErrorMode
DebugBreak
GetPrivateProfileStringW
FindNextFileW
InterlockedCompareExchange
GetTempFileNameW
CopyFileW
GetFullPathNameW
GetFullPathNameA
CreateFileA
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
UnlockFileEx
GetSystemTimeAsFileTime
GetFileAttributesA
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
EnterCriticalSection
GetLastError
CreateToolhelp32Snapshot
Process32NextW
GlobalMemoryStatusEx
Process32FirstW
lstrlenA
SetLastError
lstrlenW
WideCharToMultiByte
CreateDirectoryW
LocalFree
GetCurrentProcess
DuplicateHandle
CreateFileW
CloseHandle
GetFileAttributesW
SetEndOfFile
FindFirstFileW
FindClose
DeleteFileW
GetFileType
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetFileSize
ReadFile
WriteFile
OpenProcess
GetProcessTimes
CompareFileTime
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
LeaveCriticalSection

user32

wsprintfW
wvsprintfW
LoadStringW
GetSystemMetrics
CharLowerW
CharNextW

advapi32

RegSetValueExW
GetUserNameW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyW
RegQueryValueW
RegOpenKeyW
RegDeleteKeyW
RegOpenKeyExW
LookupAccountNameW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW

wininet

HttpEndRequestW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetReadFile
InternetWriteFile
InternetQueryDataAvailable
InternetSetOptionW
InternetConnectW
InternetOpenW
HttpSendRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoW

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

018b986e92840f33538950c68c2f9e98

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bbCertificate

Extended Key Usages

Key Usages

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

f9:61:1b:0a:1e:bf:9c:fc:c4:5a:0f:05:a1:52:7a:d6:7d:aa:4d:eeSigner

Signature Validations

Verification

01/09/2015, 13:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wininet

shlwapi

version

Sections

.text Size: 580KB - Virtual size: 580KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 14KB - Virtual size: 23KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 33KB - Virtual size: 32KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bb
Certificate

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

f9:61:1b:0a:1e:bf:9c:fc:c4:5a:0f:05:a1:52:7a:d6:7d:aa:4d:ee
Signer

01/09/2015, 13:14
Valid: false

.text
Size: 580KB - Virtual size: 580KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 14KB - Virtual size: 23KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 33KB - Virtual size: 32KB