jitsi-2[.]10[.]5550-x64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

jitsi-2.10.5550-x64.exe
Size

64.8MB
MD5

546ef502e1e1584a610515c0ac9c9f3a
SHA1

ba59d021517a7cde948510994fb3e9626c1b7376
SHA256

4e5aa2e40cdf2dbba7a53b3aca2bfec7645a5ecef5e38cb6edcd27fb58539552
SHA512

c754c45f7b3a545a65f1e98c3aa0bd1a94c9bc8770c189e3f4cde02d225064b217e569768f255bdcf1fb66d84d1814da6ec2ee9ace2c5b158f48087a98d86220
SSDEEP

1572864:fhr4diBG/dW5zueUx12uFv6AW0RFKQM6MRoVZHWXDuIGHZSkVn:ZX4MueUH2mijIFSzGZuD0Sa

Score

N/A

Malware Config

Signatures

Files

jitsi-2.10.5550-x64.exe
.exe windows x64

Password: infected

fcd33ae57e266f4764c6529ffa631e57

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:58:e8:ee:54:af:5c:27
Certificate

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

13-12-2016 07:00

Not After

13-12-2021 07:00

Subject

CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-12-2016 11:25

Not After

29-12-2017 11:25

Subject

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-10-2015 11:30

Not After

09-06-2027 11:30

Subject

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5
Certificate

Issuer

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

29-12-2016 11:25

Not After

29-12-2017 11:25

Subject

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3c:6e:3d:7d:23:36:25:4d
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

13-12-2016 07:00

Not After

13-12-2021 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c7:73:b4:b5:0e:fe:d7:77:5e:03:20:95:3c:ef:99:5a:0f:fc:d5:26:b7:b8:4c:05:8f:40:a6:f8:16:db:e0:79
Signer

Actual PE Digest

c7:73:b4:b5:0e:fe:d7:77:5e:03:20:95:3c:ef:99:5a:0f:fc:d5:26:b7:b8:4c:05:8f:40:a6:f8:16:db:e0:79

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

05-02-2017 07:40
Valid: true

Chain 1

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

9e:4d:b4:c7:f2:61:f5:f4:7a:88:2a:7a:34:45:2a:21:28:6a:d8:92
Signer

Actual PE Digest

9e:4d:b4:c7:f2:61:f5:f4:7a:88:2a:7a:34:45:2a:21:28:6a:d8:92

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

05-02-2017 07:40
Valid: true

Chain 1

CN=Open Source Developer\, Ingo Bauersachs,O=Open Source Developer,C=CH,1.2.840.113549.1.9.1=#0c0e696e676f406a697473692e6f7267

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegQueryValueExA

kernel32

CloseHandle
CreateFileA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
LockResource
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

_fdopen
_fileno
_setmode
__dllonexit
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_close
_fmode
_initterm
_lock
_lseek
_onexit
_open
_read
_strdup
_strnicmp
_unlock
_wcsnicmp
_write
abort
calloc
exit
fclose
feof
ferror
fflush
fgetc
fopen
fprintf
fputc
fread
free
fseek
fwrite
isspace
iswctype
malloc
memcmp
memcpy
memmove
realloc
signal
strlen
strncmp
strncpy
ungetc
vfprintf
wcslen
wcsncpy
wcsstr

ole32

CoInitializeEx

shell32

CommandLineToArgvW
ShellExecuteExW

user32

CallNextHookEx
GetDlgItem
LoadStringA
MessageBoxA
SendMessageA

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64.6MB - Virtual size: 64.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

fcd33ae57e266f4764c6529ffa631e57

Code Sign

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

32:58:e8:ee:54:af:5c:27Certificate

Extended Key Usages

Key Usages

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5Certificate

Extended Key Usages

Key Usages

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2Certificate

Extended Key Usages

Key Usages

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5Certificate

Extended Key Usages

Key Usages

3c:6e:3d:7d:23:36:25:4dCertificate

Extended Key Usages

Key Usages

c7:73:b4:b5:0e:fe:d7:77:5e:03:20:95:3c:ef:99:5a:0f:fc:d5:26:b7:b8:4c:05:8f:40:a6:f8:16:db:e0:79Signer

Signature Validations

Verification

05-02-2017 07:40 Valid: true

Chain 1

9e:4d:b4:c7:f2:61:f5:f4:7a:88:2a:7a:34:45:2a:21:28:6a:d8:92Signer

Signature Validations

Verification

05-02-2017 07:40 Valid: true

Chain 1

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

shell32

user32

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 4KB - Virtual size: 3KB

.rdata Size: 21KB - Virtual size: 20KB

.bss Size: - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 72B

.rsrc Size: 64.6MB - Virtual size: 64.6MB

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

32:58:e8:ee:54:af:5c:27
Certificate

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5
Certificate

6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Certificate

61:20:e9:4f:59:b2:50:32:9b:0d:88:d9:c8:8e:e1:c5
Certificate

3c:6e:3d:7d:23:36:25:4d
Certificate

c7:73:b4:b5:0e:fe:d7:77:5e:03:20:95:3c:ef:99:5a:0f:fc:d5:26:b7:b8:4c:05:8f:40:a6:f8:16:db:e0:79
Signer

05-02-2017 07:40
Valid: true

9e:4d:b4:c7:f2:61:f5:f4:7a:88:2a:7a:34:45:2a:21:28:6a:d8:92
Signer

05-02-2017 07:40
Valid: true

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 4KB - Virtual size: 3KB

.rdata
Size: 21KB - Virtual size: 20KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 72B

.rsrc
Size: 64.6MB - Virtual size: 64.6MB