ssvagent[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ssvagent.exe
Size

74KB
MD5

a6e21dd372f5b565de1b99e6937006b1
SHA1

e1ae16899425fbed19cf13e7d64e0e776d0265aa
SHA256

c6ed1f9da5cc1835af02cc982106b6e244800df91cc39e2c1e2abd097602b3b1
SHA512

6a48128881c08b7c7615c34727f3702b3b1e9ceab6b95c363cff212fe97eb5ee4a2d875f0de53e56cbfec12e719a047e91734f0bae48f7f7219c3aeec5fd0b26
SSDEEP

1536:wgF4BOFfNKKv9pkvVrGyW4s410h/SfBZC0M/TOAB0/+4wf3h2jR:wgF4BYDArGyFy6Bt4TOe6+4wQF

Score

1^/10

Malware Config

Signatures

Files

ssvagent.exe
.exe windows x64

0948a640f92ae207cff3f990172fc850

Code Sign

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/04/2015, 00:00

Not After

13/04/2018, 23:59

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

48:06:01:c2:0a:0e:ef:dc:11:07:a2:28:8f:57:b8:a7:9c:8e:47:76
Signer

Actual PE Digest

48:06:01:c2:0a:0e:ef:dc:11:07:a2:28:8f:57:b8:a7:9c:8e:47:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VerSetConditionMask
GetEnvironmentVariableA
CreateFileA
GetLongPathNameA
DecodePointer
CloseHandle
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetCurrentProcess
CreateProcessA
OpenProcess
GlobalMemoryStatusEx
GetLocalTime
GetSystemDirectoryA
GetWindowsDirectoryA
GetNativeSystemInfo
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
GetShortPathNameA
FormatMessageA
lstrlenA
LoadLibraryA
GetTempPathA
VerifyVersionInfoA
OutputDebugStringA
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
LoadResource
SizeofResource
lstrcmpiA
FindResourceA
MultiByteToWideChar
WideCharToMultiByte
IsDBCSLeadByte
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
EncodePointer
OutputDebugStringW
IsDebuggerPresent

user32

wsprintfA
GetWindowThreadProcessId
GetShellWindow
CloseDesktop
OpenInputDesktop
CharNextA

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID

oleaut32

VarUI4FromStr
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
VariantClear

msvcr120

__crtSetUnhandledExceptionFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_commode
_fmode
_acmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
atoi
_dupenv_s
free
_putenv
_splitpath_s
??_V@YAXPEAX@Z
memcpy_s
strcpy_s
strcat_s
_stricmp
strncpy_s
fclose
fopen_s
fprintf_s
sprintf_s
_wstat64i32
_stat64i32
__CxxFrameHandler3
memset
strcmp
_snprintf_s
_vsnprintf_s
strftime
_localtime64_s
_ftime64_s
memcpy
malloc
_recalloc
_resetstkoflw
_mbsnbcpy_s
_mbsstr
_CxxThrowException
__argc
__argv
?terminate@@YAXXZ
__C_specific_handler
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0948a640f92ae207cff3f990172fc850

Code Sign

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

48:06:01:c2:0a:0e:ef:dc:11:07:a2:28:8f:57:b8:a7:9c:8e:47:76Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

msvcr120

Sections

.text Size: 41KB - Virtual size: 41KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 216B

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

48:06:01:c2:0a:0e:ef:dc:11:07:a2:28:8f:57:b8:a7:9c:8e:47:76
Signer

.text
Size: 41KB - Virtual size: 41KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 216B