GoogleToolbarInstaller_en32_signed[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

GoogleToolbarInstaller_en32_signed.exe
Size

2.1MB
MD5

cc784b636ad887bb622e8c41849c9da1
SHA1

11568edda3aed86a0e72c190143f73b6df01aa3d
SHA256

1f85e871db078e45a653ba98dd30c19500191421a7060c4609dd5fa407d82bc5
SHA512

7b1d87ab7443d384171cab021030e81ff57cb2433b113a0bbe2949ac34d335c19423f4451d685f7af57f499f10b5dfc9736d1982aaf77c0b2d9fe2d6e3369614
SSDEEP

49152:LyoeR3Rn1PfsAhbUip6yY1z7CKwRXJGEo3O7bRu76PBij:1ItsA1UipECfvS3GbY7kB

Score

N/A

Malware Config

Signatures

Files

GoogleToolbarInstaller_en32_signed.exe
.exe windows x86

75f745e42f759b7a66fa24dd3fa96e64

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/11/2011, 00:00

Not After

13/11/2014, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:11:f8:a8:2a:1b:ad:90:57:47:b7:6d:89:ee:12:7e:96:3e:ac:df
Signer

Actual PE Digest

3b:11:f8:a8:2a:1b:ad:90:57:47:b7:6d:89:ee:12:7e:96:3e:ac:df

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

13/08/2013, 18:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

version

GetFileVersionInfoSizeW

user32

GetActiveWindow

advapi32

GetSecurityDescriptorOwner

ole32

CoTaskMemAlloc

shell32

ShellExecuteW

oleaut32

SysAllocString

shlwapi

PathMatchSpecW

gdi32

CreateRectRgn

urlmon

CreateURLMonikerEx

userenv

UnloadUserProfile

psapi

GetProcessImageFileNameW

wtsapi32

WTSQuerySessionInformationW

wintrust

WinVerifyTrust

wininet

InternetOpenW

crypt32

CryptImportPublicKeyInfo

Sections

.text
Size: 2.1MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

75f745e42f759b7a66fa24dd3fa96e64

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70Certificate

Extended Key Usages

Key Usages

3b:11:f8:a8:2a:1b:ad:90:57:47:b7:6d:89:ee:12:7e:96:3e:ac:dfSigner

Signature Validations

Verification

13/08/2013, 18:33 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

version

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

urlmon

userenv

psapi

wtsapi32

wintrust

wininet

crypt32

Sections

.text Size: 2.1MB - Virtual size: 7.8MB

.rsrc Size: 51KB - Virtual size: 52KB

.reloc Size: 512B - Virtual size: 512B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

3b:11:f8:a8:2a:1b:ad:90:57:47:b7:6d:89:ee:12:7e:96:3e:ac:df
Signer

13/08/2013, 18:33
Valid: false

.text
Size: 2.1MB - Virtual size: 7.8MB

.rsrc
Size: 51KB - Virtual size: 52KB

.reloc
Size: 512B - Virtual size: 512B