ZumaSetup-1-4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ZumaSetup-1-4.exe
Size

6.9MB
MD5

0f0b41c55228d03ba25853cd8ddc1767
SHA1

a71f13a4f72f70a0ee1ddfdda967b401b4c3650f
SHA256

dcea40cd50753c231f231318789d80100bc987ac5f84510c173bb1b74eadfbc5
SHA512

b77f88628f64690bda245cf0f3fc68457ca9aeaa04b2f5e4776d91603fa719c59ffbc9ad3b872ca12813755fae94bdc0b5ef2ba0ddd6928500cce97df2ca9bda
SSDEEP

98304:tvv33dNQsCWJmcmH7eiZXr/fD2ZQQt55CPL9DOYwvIuT9hCzcG9ZZDzHmr6YUh5:NvYhLmiZXrXD2Ht3Cz9DJtuWzZZnm4h

Score

1^/10

Malware Config

Signatures

Files

ZumaSetup-1-4.exe
.exe windows x86

d090832e989ec9a0cca6ff2b95d19963

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/09/2006, 00:00

Not After

21/09/2009, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LocalFree
DeleteFileA
InterlockedDecrement
CreateDirectoryA
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
CloseHandle
GetDiskFreeSpaceA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
LoadLibraryA
CopyFileA
GetProcAddress
GetLastError
MultiByteToWideChar
MulDiv
GetExitCodeProcess
Sleep
GetWindowsDirectoryA
FreeLibrary
GetSystemDirectoryA
WideCharToMultiByte
SetEndOfFile
LocalFileTimeToFileTime
SetFileAttributesA
SetFileTime
CreateFileA
DosDateTimeToFileTime
RemoveDirectoryA
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetFileAttributesA
GetOEMCP
GetACP
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetHandleCount
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
FindClose
FindFirstFileA
FindNextFileA
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
ExitThread
ResumeThread
CreateThread
ExitProcess
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
HeapReAlloc
GetCPInfo
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetFileType
CreateFileW
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue

user32

DialogBoxParamA
ReleaseDC
EndPaint
SetTimer
SendDlgItemMessageA
FillRect
GetClientRect
GetDlgCtrlID
BeginPaint
GetDC
GetWindowTextA
MessageBoxA
SendMessageA
GetDlgItem
EndDialog
GetDesktopWindow
EnumChildWindows
GetSysColorBrush
IsDlgButtonChecked
SetWindowTextA
LoadImageA

gdi32

SetTextColor
DeleteDC
CreateFontA
GetDeviceCaps
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectA
GetStockObject
CreateSolidBrush
BitBlt

advapi32

RegQueryValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA
SHBrowseForFolderA

ole32

CoCreateInstance
CoInitializeSecurity
StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

Sections

.text
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d090832e989ec9a0cca6ff2b95d19963

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 244KB - Virtual size: 243KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 32KB - Virtual size: 30KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

.text
Size: 244KB - Virtual size: 243KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 32KB - Virtual size: 30KB