vnc-4_1_2-x86_win32_viewer[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

vnc-4_1_2-x86_win32_viewer.exe
Size

264KB
MD5

2f045bfd51c2886be43cc676708a17c7
SHA1

30820823654f3127480e4e6d9f51caf072d59ec2
SHA256

4d64259878755b49a25552030ac062a14c1e79820eabbd84041bed06e74f4bbd
SHA512

09fa50de4513e0a5e79ea6709bb969c274712332e3fd4e9b015cc14e4464380325e62d0730be7cfa32428090dcf99fbd10c4602136868857a424ec772e056bc0
SSDEEP

6144:O2OXhPyA2htCy2Zw7cWN4fw/80kLJyBdgkPn:ObhJ26wN4fwU0EJyBdnn

Score

1^/10

Malware Config

Signatures

Files

vnc-4_1_2-x86_win32_viewer.exe
.exe windows x86

2481f304730138d08040e9b3ae65d04c

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:a5:d7
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

15/08/2005, 22:26

Not After

17/09/2007, 10:11

Subject

CN=RealVNC Ltd,OU=Software,O=RealVNC Ltd,L=Cambridge,ST=Cambridgeshire,C=UK

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3d:0e:eb:a1:a2:7e:f1:d2:57:ce:e4:fc:77:7c:fd:e9:4b:e8:dc:03
Signer

Actual PE Digest

3d:0e:eb:a1:a2:7e:f1:d2:57:ce:e4:fc:77:7c:fd:e9:4b:e8:dc:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
select
getsockname
getpeername
ntohs
inet_addr
WSAStartup
inet_ntoa
shutdown
closesocket
listen
WSAGetLastError
htonl
htons
socket
accept
connect
gethostbyname
send
WSAAsyncSelect
WSAEventSelect
setsockopt
bind

comctl32

PropertySheetA
_TrackMouseEvent
CreatePropertySheetPageA

kernel32

GetStringTypeW
GetStringTypeA
SetFilePointer
VirtualQuery
InterlockedExchange
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
FlushFileBuffers
LCMapStringW
MultiByteToWideChar
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetCPInfo
GetOEMCP
GetACP
HeapSize
SetUnhandledExceptionFilter
TlsFree
HeapAlloc
HeapReAlloc
HeapFree
DeleteFileA
GetLocaleInfoA
SetStdHandle
ReadFile
VirtualProtect
GetSystemInfo
GetTimeZoneInformation
MoveFileA
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
TerminateProcess
ExitProcess
RaiseException
RtlUnwind
GetTickCount
GetCurrentProcessId
SetEndOfFile
FreeConsole
AllocConsole
GetCurrentDirectoryA
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
Sleep
ResetEvent
GetLastError
GetModuleHandleA
CloseHandle
CompareStringA
CompareStringW
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
ExpandEnvironmentStringsA
TlsSetValue
CreateThread
ResumeThread
GetCurrentThread
GetCurrentThreadId
TlsGetValue
WaitForSingleObject
TlsAlloc
SetEnvironmentVariableA
GlobalLock
GlobalFree
GlobalAlloc
GetModuleFileNameA
CreateFileA
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForMultipleObjects
SetLastError
GlobalUnlock

user32

SetDlgItemTextA
EnableWindow
ToAscii
GetKeyboardState
PostMessageA
CallNextHookEx
GetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExA
SystemParametersInfoA
GetDesktopWindow
GetDC
ReleaseDC
SetClipboardViewer
ChangeClipboardChain
CloseClipboard
GetClipboardData
OpenClipboard
GetClipboardOwner
SetClipboardData
EmptyClipboard
IsWindowVisible
DefWindowProcA
PostThreadMessageA
GetDlgItemTextA
EndDialog
MessageBeep
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
ShowWindow
AppendMenuA
GetSystemMenu
GetWindowLongA
GetUpdateRect
UpdateWindow
RemoveMenu
InsertMenuA
ModifyMenuA
CheckMenuItem
EnableMenuItem
MessageBoxA
SetWindowLongA
DestroyWindow
CreateDialogParamA
SendMessageA
GetDlgItem
UnregisterClassA
ShowCursor
SetScrollInfo
DialogBoxParamA
SetWindowPos
GetSystemMetrics
AdjustWindowRect
GetMessageA
TranslateMessage
LoadMenuA
GetSubMenu
SetMenuDefaultItem
SetForegroundWindow
PostQuitMessage
GetWindowTextA
CreateWindowExA
LoadImageA
RegisterClassA
BeginPaint
FillRect
EndPaint
GetClientRect
SetCursor
GetAsyncKeyState
GetCursorPos
TrackPopupMenu
GetWindowRect
InvalidateRect
ScrollWindowEx
KillTimer
SetTimer
SetWindowTextA
SetRect

gdi32

CreateCompatibleDC
GetObjectA
SelectObject
SetDIBColorTable
DeleteDC
CreateDIBSection
CreateCompatibleBitmap
GetStockObject
BitBlt
SelectPalette
RealizePalette
ResizePalette
UnrealizeObject
SetPaletteEntries
DeleteObject
CreatePalette
GetDIBits

comdlg32

GetSaveFileNameA
CommDlgExtendedError

shell32

Shell_NotifyIconA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegSetValueExA
RegNotifyChangeKeyValue
RegCreateKeyA

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2481f304730138d08040e9b3ae65d04c

Code Sign

0aCertificate

Extended Key Usages

Key Usages

21:a5:d7Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

3d:0e:eb:a1:a2:7e:f1:d2:57:ce:e4:fc:77:7c:fd:e9:4b:e8:dc:03Signer

Headers

File Characteristics

Imports

ws2_32

comctl32

kernel32

user32

gdi32

comdlg32

shell32

version

advapi32

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 12KB - Virtual size: 21KB

.rsrc Size: 16KB - Virtual size: 15KB

0a
Certificate

21:a5:d7
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

3d:0e:eb:a1:a2:7e:f1:d2:57:ce:e4:fc:77:7c:fd:e9:4b:e8:dc:03
Signer

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 16KB - Virtual size: 15KB