u1405[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

u1405.exe
Size

2.0MB
MD5

a93f31991e187662be9ce38c264b1115
SHA1

bfd3d5d02f0cb863657c30439d7d2bb5a0d45596
SHA256

4f8eef61ccbe5b1bd6f1032a48a86c320ec0960ec2c22ffaa6f9b2791de168fb
SHA512

5ef3c128e1f9afb41003935148761003e561e616dd322eee41ff5915d7b291959b0cdd26c541b919d51613371019c34b5af22c7cb16394c1e81ca09774dff90a
SSDEEP

49152:Z7MHR6NrJ0xBbZIc1Mg2AjAsBgL3IYbJRTR/G5BGHweBIG4:Z78RMtsAAjAqgL4YHzqG4

Score

1^/10

Malware Config

Signatures

Files

u1405.exe
.exe windows x86

baa93d47220682c04d92f7797d9224ce

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:c5:19:78:f0:ed:63:6c:a3:c5:b5:c4:d3:3d:02:2c:10
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

05/12/2012, 21:33

Not After

11/01/2016, 15:34

Subject

CN=Ultrareach Internet Corp.,O=Ultrareach Internet Corp.,L=Cheyenne,ST=WY,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8a:b1:5b:4e:ac:1a:e1:2e:4f:97:e3:1c:bb:e5:34:88:c4:8f:21:8f
Signer

Actual PE Digest

8a:b1:5b:4e:ac:1a:e1:2e:4f:97:e3:1c:bb:e5:34:88:c4:8f:21:8f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ultrareach Internet Corp.,O=Ultrareach Internet Corp.,L=Cheyenne,ST=WY,C=US

13/12/2014, 08:56
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Exports

Exports

_EXECryptor_GetHardwareID@0
_EXECryptor_IsAppProtected@0

Sections

Size: 976KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pdkjurbl
Size: 976KB - Virtual size: 976KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hejpxoln
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

11:21:c5:19:78:f0:ed:63:6c:a3:c5:b5:c4:d3:3d:02:2c:10Certificate

Extended Key Usages

Key Usages

8a:b1:5b:4e:ac:1a:e1:2e:4f:97:e3:1c:bb:e5:34:88:c4:8f:21:8fSigner

Signature Validations

Verification

13/12/2014, 08:56 Valid: false

Headers

File Characteristics

Imports

kernel32

comctl32

Exports

Exports

Sections

Size: 976KB - Virtual size: 2.0MB

.rsrc Size: 24KB - Virtual size: 62KB

.idata Size: 4KB - Virtual size: 4KB

Size: 4KB - Virtual size: 1.4MB

pdkjurbl Size: 976KB - Virtual size: 976KB

hejpxoln Size: 4KB - Virtual size: 4KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

11:21:c5:19:78:f0:ed:63:6c:a3:c5:b5:c4:d3:3d:02:2c:10
Certificate

8a:b1:5b:4e:ac:1a:e1:2e:4f:97:e3:1c:bb:e5:34:88:c4:8f:21:8f
Signer

13/12/2014, 08:56
Valid: false

.rsrc
Size: 24KB - Virtual size: 62KB

.idata
Size: 4KB - Virtual size: 4KB

pdkjurbl
Size: 976KB - Virtual size: 976KB

hejpxoln
Size: 4KB - Virtual size: 4KB