3efd63c7da190e67a29e1882cfa9f427d5e25d3ba834a8af3fe48162add39835

Sharing

Copy URL

Twitter E-mail

General

Target

3efd63c7da190e67a29e1882cfa9f427d5e25d3ba834a8af3fe48162add39835
Size

744KB
MD5

628e568af6a527df8dcd8f5a9da181e0
SHA1

7c524756c233469b31a0425263d693c6a627666f
SHA256

3efd63c7da190e67a29e1882cfa9f427d5e25d3ba834a8af3fe48162add39835
SHA512

ee491882439ea4b45dba2e758f56513804d1fd92f32242e661e62d72aef8039e4c16864dd501f86c4f897c4b93ece29386d26f229744009851fcb0d3f6adc173
SSDEEP

12288:Yt75UAetXLp8gY+EbGaAOwSpUX9ZnVWrJlV2jY9s1Z9wBQudwBpmeR8aB:YtGht1SbsX9ZylV2Z1TwBQdXB

Score

N/A

Malware Config

Signatures

Files

3efd63c7da190e67a29e1882cfa9f427d5e25d3ba834a8af3fe48162add39835
.exe windows x86

018b986e92840f33538950c68c2f9e98

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bb
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/02/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),POSTALCODE=31905,STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:97:ad:a1:92:97:60:43:5d:d0:cc:58:05:73:27:a8:c3:c3:8e:c0
Signer

Actual PE Digest

19:97:ad:a1:92:97:60:43:5d:d0:cc:58:05:73:27:a8:c3:c3:8e:c0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shopper-Pro (GOOBZO LTD),O=Shopper-Pro (GOOBZO LTD),POSTALCODE=31905,STREET=Bldg #15 Matam,L=Haifa,ST=Haifa,C=IL

02/08/2015, 21:17
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameW
FormatMessageA
FormatMessageW
GetVersionExW
GetSystemDirectoryW
GetEnvironmentVariableW
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
MultiByteToWideChar
OutputDebugStringW
InterlockedIncrement
InterlockedDecrement
IsWow64Process
InterlockedExchange
GetProcAddress
LoadLibraryW
FreeLibrary
ExitThread
GetLocalTime
Sleep
WaitForSingleObject
CreateThread
ResetEvent
SetEvent
WaitForMultipleObjects
CreateEventW
SetThreadPriority
TerminateThread
GetModuleFileNameW
MoveFileExW
GetTickCount
CreateProcessW
GetSystemInfo
GetModuleHandleW
GetExitCodeProcess
GetFileTime
GetTempPathW
SetErrorMode
DebugBreak
GetPrivateProfileStringW
FindNextFileW
InterlockedCompareExchange
GetTempFileNameW
CopyFileW
GetFullPathNameW
GetFullPathNameA
CreateFileA
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
UnlockFileEx
GetSystemTimeAsFileTime
GetFileAttributesA
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
EnterCriticalSection
GetLastError
CreateToolhelp32Snapshot
Process32NextW
GlobalMemoryStatusEx
Process32FirstW
lstrlenA
SetLastError
lstrlenW
WideCharToMultiByte
CreateDirectoryW
LocalFree
GetCurrentProcess
DuplicateHandle
CreateFileW
CloseHandle
GetFileAttributesW
SetEndOfFile
FindFirstFileW
FindClose
DeleteFileW
GetFileType
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetFileSize
ReadFile
WriteFile
OpenProcess
GetProcessTimes
CompareFileTime
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
ExitProcess
LeaveCriticalSection

user32

wsprintfW
wvsprintfW
LoadStringW
GetSystemMetrics
CharLowerW
CharNextW

advapi32

RegSetValueExW
GetUserNameW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyW
RegQueryValueW
RegOpenKeyW
RegDeleteKeyW
RegOpenKeyExW
LookupAccountNameW
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW

wininet

HttpEndRequestW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetReadFile
InternetWriteFile
InternetQueryDataAvailable
InternetSetOptionW
InternetConnectW
InternetOpenW
HttpSendRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoW

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

018b986e92840f33538950c68c2f9e98

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bbCertificate

Extended Key Usages

Key Usages

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

19:97:ad:a1:92:97:60:43:5d:d0:cc:58:05:73:27:a8:c3:c3:8e:c0Signer

Signature Validations

Verification

02/08/2015, 21:17 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wininet

shlwapi

version

Sections

.text Size: 580KB - Virtual size: 580KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 14KB - Virtual size: 23KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 33KB - Virtual size: 32KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

e6:16:c6:cd:70:10:c1:97:e7:22:8f:66:f5:b2:86:bb
Certificate

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

19:97:ad:a1:92:97:60:43:5d:d0:cc:58:05:73:27:a8:c3:c3:8e:c0
Signer

02/08/2015, 21:17
Valid: false

.text
Size: 580KB - Virtual size: 580KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 14KB - Virtual size: 23KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 33KB - Virtual size: 32KB