Trojan-Ransom[.]Win32[.]Blocker[.]eczp-0775baff8197603e541f09b4f2f7f09a85533edb7cac6c2dae7839b884b6b910

Sharing

Copy URL Twitter E-mail

General

Target

Trojan-Ransom.Win32.Blocker.eczp-0775baff8197603e541f09b4f2f7f09a85533edb7cac6c2dae7839b884b6b910
Size

80KB
MD5

7682c7039a70951040c51f6319108d50
SHA1

06c2d857c6dc34b00fc44d406f36a1b9518ca80a
SHA256

0775baff8197603e541f09b4f2f7f09a85533edb7cac6c2dae7839b884b6b910
SHA512

cbca3370252270c43549b9f36520e1bd1a8f097929db5ef338bdae9b561137e7da664a0b9dca8598f62888b19a882017e147035585f22a9485e6d0280ff13f67
SSDEEP

1536:Pz0b+sq1Ucj76b7ORr1+tBLZgVpsInrxyZeMB+agxCxw:8ryLj76WRrlrjly8MNgT

Score

N/A

Malware Config

Signatures

Files

Trojan-Ransom.Win32.Blocker.eczp-0775baff8197603e541f09b4f2f7f09a85533edb7cac6c2dae7839b884b6b910
.exe windows x86

061464257c59155f4f54fe06fb4941d3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05/11/2009, 00:00

Not After

10/12/2010, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

75:20:56:d8:a6:24:fd:7c:73:e1:ff:93:82:76:bb:ed:79:0d:1c:d9
Signer

Actual PE Digest

75:20:56:d8:a6:24:fd:7c:73:e1:ff:93:82:76:bb:ed:79:0d:1c:d9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

28/07/2010, 07:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

malloc
wcscat
wcscpy
wcslen
_wcsnicmp
_initterm
free
wcschr

kernel32

LocalFree
GetComputerNameExW
LocalAlloc
lstrlenW
FormatMessageW
LoadLibraryExW
LoadLibraryW
GlobalLock
GetCurrentProcess
GetComputerNameW
CreateProcessW
GetWindowsDirectoryW
LoadLibraryExA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
GetProcAddress
FreeLibrary
GetVersionExW
ReleaseMutex
GetModuleFileNameW
CloseHandle
CreateMutexW
QueryPerformanceCounter
WaitForSingleObject
GlobalUnlock
VirtualAllocEx
CreateEventA
Thread32Next
DefineDosDeviceA
Thread32First
SetTimerQueueTimer
GetCalendarInfoA
SetLastConsoleEventActive
SetComputerNameExW
OpenConsoleW
CreateHardLinkW
GetPrivateProfileIntA
WriteProfileStringW
CreateMailslotA
LZRead
_lread
FindNextFileA
CreateJobObjectW
GetCommConfig
IsSystemResumeAutomatic
OpenJobObjectA
ClearCommBreak
ReleaseSemaphore
AssignProcessToJobObject
lstrcmpi
WaitForSingleObjectEx
EnumResourceNamesA
AddLocalAlternateComputerNameW
GetConsoleAliasExesA
CreateThread
ScrollConsoleScreenBufferA
ReadFileEx
GetStdHandle
VerSetConditionMask
VirtualProtectEx
GetDevicePowerState
lstrcatA
ConvertFiberToThread
GetComputerNameExA
DnsHostnameToComputerNameA
RtlCaptureContext
PrivMoveFileIdentityW
SetNamedPipeHandleState
GetProcessShutdownParameters
FatalAppExitA
DeleteTimerQueueTimer
SignalObjectAndWait
CreateSocketHandle
SetTimeZoneInformation
SetEnvironmentVariableW
GetBinaryTypeA
GlobalFlags
SetCommConfig
ExitVDM
GetNumberOfConsoleInputEvents
GetProcessWorkingSetSize
GetConsoleProcessList
SetPriorityClass
lstrcmpW
DebugBreakProcess
CopyFileExW
GetConsoleInputExeNameA
SetThreadAffinityMask
UnregisterConsoleIME
GetThreadContext
GetStringTypeExA
ReadConsoleOutputCharacterW
LocalCompact
CreateTapePartition
FillConsoleOutputAttribute
SetConsoleScreenBufferSize
GetProfileStringA
lstrcpyA
LZSeek
RequestDeviceWakeup
GetConsoleMode
IsBadStringPtrA
DeleteCriticalSection
SetErrorMode
GetSystemTimeAdjustment
GetConsoleCommandHistoryLengthW
CreateActCtxA
SetFileAttributesA
GetSystemWindowsDirectoryA
CreateJobSet
CreateWaitableTimerW
EnumCalendarInfoExW
OpenSemaphoreW
SwitchToFiber
GetPrivateProfileSectionW
CommConfigDialogA
ReplaceFile
GetVolumePathNamesForVolumeNameA
GetNumaNodeProcessorMask
SetEvent
SetSystemTime
SetConsoleOS2OemFormat
PeekNamedPipe
SizeofResource
LocalReAlloc
CreateEventW
WritePrivateProfileStructW
RtlMoveMemory
SetThreadLocale
CreateRemoteThread
FillConsoleOutputCharacterW
TzSpecificLocalTimeToSystemTime
GetFileAttributesW
CloseProfileUserMapping
EnumCalendarInfoA
Heap32ListFirst
GetProcessPriorityBoost
GetCommProperties
DebugBreak
GetNamedPipeInfo
GlobalFindAtomW
GetDiskFreeSpaceW
FreeEnvironmentStringsA
CmdBatNotification
MoveFileA
EnumSystemLanguageGroupsW
EndUpdateResourceW
WaitCommEvent
LZClose
GetDiskFreeSpaceExW
FindNextChangeNotification
GetExitCodeThread
DuplicateConsoleHandle
FindActCtxSectionStringA
FindFirstFileW

user32

SetWindowTextW
IsWindowEnabled
DestroyIcon
LoadImageW
GetSystemMetrics
WinHelpW
GetParent
DialogBoxParamW
GetWindowLongW
EndDialog
SetWindowLongW
GetFocus
RegisterClipboardFormatW
wvsprintfW
wsprintfW
LoadStringW
MessageBoxW
CheckDlgButton
EnableWindow
SetDlgItemTextW
SetRect
CreateWindowExW
SendMessageW
LoadCursorW
SetCursor
SetFocus
IsDlgButtonChecked
LoadIconW
CharUpperA
UnhookWinEvent
AppendMenuW
GetGUIThreadInfo
ReplyMessage
GetScrollPos
DdeInitializeW
DdeConnectList
BuildReasonArray
GetProcessWindowStation
TranslateMessage
RegisterClassExA
ModifyMenuA
SetThreadDesktop
PostMessageW
UserLpkTabbedTextOut
RealGetWindowClassA
DrawIcon
PackDDElParam
GetUserObjectInformationW
QuerySendMessage
IsWindowInDestroy
wsprintfA
MsgWaitForMultipleObjectsEx
ScrollWindow
ScreenToClient
OffsetRect
SetWindowStationUser
SetClassLongA
BroadcastSystemMessage
UnhookWindowsHookEx
LoadMenuA
FindWindowA
EnableMenuItem
SetShellWindowEx
RegisterClipboardFormatA
DdeDisconnectList
OpenIcon
BroadcastSystemMessageA
CopyRect
IsGUIThread
TranslateAccelerator
UnlockWindowStation
GetMenuCheckMarkDimensions
GetWindowTextW
IMPGetIMEA
ToUnicodeEx
SetScrollRange
DlgDirSelectExA
IsZoomed
SendMessageTimeoutW
BroadcastSystemMessageExW
MonitorFromRect
SetParent
DdeConnect
SendDlgItemMessageA
GetPropA
DrawFrameControl
IsWindowUnicode
DrawCaptionTempW
GetWindowInfo
GetMenuStringA
DlgDirSelectExW
PrivateExtractIconExW
ToAsciiEx
MessageBoxExW
GetClassNameA
DrawIconEx
GetTopWindow
SetForegroundWindow
CopyAcceleratorTableW
CharNextExA
GetSystemMenu
LoadBitmapW
GetCursorPos
SetWindowLongA
GetForegroundWindow
DdeGetQualityOfService
CheckMenuItem
GetThreadDesktop
WindowFromDC
InSendMessage
ImpersonateDdeClientWindow
EnumDisplayMonitors
MessageBoxIndirectW
CreateIconIndirect
GetWindowDC
SetWindowsHookW
UnloadKeyboardLayout
TrackPopupMenuEx
GetTaskmanWindow
InflateRect
UnhookWindowsHook
GetMouseMovePointsEx
GetCapture
LoadCursorFromFileA
SwitchDesktop
EnumChildWindows
GetKeyState
GetUpdateRgn
DdeNameService
UnregisterDeviceNotification
UnregisterUserApiHook
GetWinStationInfo

ole32

StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree

advapi32

AllocateAndInitializeSid
GetTokenInformation
RegQueryValueExW
AccessCheck
EqualSid
CheckTokenMembership
FreeSid
LookupAccountSidW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
OpenProcessToken
RegOpenKeyExW
RegDeleteKeyW
CopySid
GetLengthSid
IsValidSid
DuplicateToken

comctl32

CreatePropertySheetPageW
ImageList_Create
ImageList_ReplaceIcon
DestroyPropertySheetPage

shell32

ShellExecuteW

netapi32

NetApiBufferFree
NetLocalGroupGetMembers
NetLocalGroupDelMembers
NetLocalGroupAddMembers

wininet

UpdateUrlCacheContentPath
FtpDeleteFileW
InternetWriteFileExA
InternetSetOptionA
GopherGetLocatorTypeW
GopherGetAttributeW
InternetShowSecurityInfoByURL
FtpDeleteFileA
InternetCheckConnectionW
InternetConfirmZoneCrossing
InternetGetConnectedStateEx
FtpRemoveDirectoryW
ParseX509EncodedCertificateForListBoxEntry
InternetShowSecurityInfoByURLA
InternetGetCookieW
InternetCloseHandle
InternetSetCookieW
InternetGoOnlineA
UnlockUrlCacheEntryFileA
FtpGetCurrentDirectoryW
CreateUrlCacheEntryW
InternetTimeToSystemTimeA
DetectAutoProxyUrl
CreateUrlCacheGroup
FindNextUrlCacheEntryW
ShowX509EncodedCertificate
InternetCombineUrlW
InternetAlgIdToStringW
FtpRenameFileW
InternetAttemptConnect
InternetSetStatusCallbackA
IsUrlCacheEntryExpiredW
CreateUrlCacheContainerW
InternetSetDialState
InternetAutodialCallback
SetUrlCacheGroupAttributeW
DeleteIE3Cache
GopherGetAttributeA
FindNextUrlCacheContainerW

Sections

X�t� ��
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.fdata
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

061464257c59155f4f54fe06fb4941d3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1Certificate

Extended Key Usages

Key Usages

75:20:56:d8:a6:24:fd:7c:73:e1:ff:93:82:76:bb:ed:79:0d:1c:d9Signer

Signature Validations

Verification

28/07/2010, 07:30 Valid: false

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

ole32

advapi32

comctl32

shell32

netapi32

wininet

Sections

X�t� �� Size: 15KB - Virtual size: 14KB

.fdata Size: 3KB - Virtual size: 7KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 18KB - Virtual size: 132KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

75:20:56:d8:a6:24:fd:7c:73:e1:ff:93:82:76:bb:ed:79:0d:1c:d9
Signer

28/07/2010, 07:30
Valid: false

X�t� ��
Size: 15KB - Virtual size: 14KB

.fdata
Size: 3KB - Virtual size: 7KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 18KB - Virtual size: 132KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 2KB - Virtual size: 4KB