ghost32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ghost32.exe
Size

3.8MB
MD5

9e87b32ff2fd014a04d1676b69c8df18
SHA1

e3111c6eb2517a6579f3213440fb142a2d709371
SHA256

4816b5afba62edd267bac3f9936b09de9e8eccf3cbf49cad88800af2bf9a3905
SHA512

c26cece3706a69c199d76f984ef0db1f8740bf27600d4021def3d2a483ef1973182e5160e5e8f0430b2d02992f4be5730a99fe934eea2644c10c134a094a51a8
SSDEEP

49152:5yXCP7X3uQ3YlZfbM3DacNHHO0DZyL8x+2wmyrS5uDOzQaz07kfHWRHiaHSiBeh4:wcKNZf8mGHVD5x+2wTRf4fHgCm

Score

1^/10

Malware Config

Signatures

Files

ghost32.exe
.exe windows x86

b82f622dcc69314b5e2125af74e90858

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

31/10/2007, 00:00

Not After

24/11/2010, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

eb:b3:f6:ab:fe:3d:b7:ea:73:60:71:a0:a6:cc:68:49:7b:7b:66:ff
Signer

Actual PE Digest

eb:b3:f6:ab:fe:3d:b7:ea:73:60:71:a0:a6:cc:68:49:7b:7b:66:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recvfrom
WSASetLastError
gethostname
gethostbyname
inet_ntoa
WSACloseEvent
WSACleanup
WSAStartup
WSACreateEvent
WSASend
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
htonl
listen
htons
inet_addr
closesocket
WSAEventSelect
WSAGetLastError
ioctlsocket
shutdown
setsockopt
recv
accept
WSAAddressToStringA
WSASocketA
getsockopt
getsockname
send
ntohl
WSASendTo
WSARecvFrom
WSARecv
WSAIoctl
socket
connect
bind
sendto

imm32

ImmDisableIME

imagehlp

ImageGetCertificateHeader
ImageRemoveCertificate

kernel32

CreateFileA
CloseHandle
GetLocaleInfoA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
GetVersionExA
IsValidCodePage
IsDBCSLeadByteEx
MultiByteToWideChar
WideCharToMultiByte
GetOEMCP
GetConsoleCP
GetConsoleOutputCP
GetACP
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
DebugBreak
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
OutputDebugStringA
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetStdHandle
VirtualFree
VirtualAlloc
GetSystemInfo
GetThreadContext
VirtualQuery
GetModuleHandleW
FindResourceW
LoadResource
LoadLibraryW
Sleep
SizeofResource
CreateFileW
LockResource
GetCurrentThreadId
DeleteFileW
ResumeThread
CreateThread
WaitForSingleObject
SetEvent
CreateEventW
FindNextFileA
GetFileAttributesW
GetFileAttributesExA
GetCurrentProcess
GetVersionExW
VirtualProtectEx
GetLocalTime
GetSystemTime
GetStringTypeA
GetLocaleInfoW
GetFileAttributesA
GetDiskFreeSpaceA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
GetBinaryTypeA
GetFileInformationByHandle
GetVolumeInformationA
GetTickCount
GetFullPathNameA
GetCurrentDirectoryA
GetDiskFreeSpaceW
FindFirstFileA
SetFileTime
SetFileAttributesA
LocalFree
LocalAlloc
BackupSeek
BackupRead
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventA
ResetEvent
InitializeCriticalSection
DefineDosDeviceW
GetCurrentThread
IsBadWritePtr
FormatMessageA
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
GlobalMemoryStatus
FreeConsole
DeviceIoControl
HeapFree
HeapAlloc
GetProcessHeap
FindClose
VirtualLock
SetProcessWorkingSetSize
GetProcessWorkingSetSize
VirtualUnlock
SetErrorMode
GetLogicalDriveStringsA
SetLastError
GetFileSize
GetOverlappedResult
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetTimeFormatA
GetDateFormatA
SetConsoleCtrlHandler
GetCommandLineA
ExitThread
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetTimeZoneInformation
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLogicalDrives
GetDriveTypeA
SetConsoleMode
ReadConsoleInputA
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetEnvironmentVariableW
ReadProcessMemory
GetDriveTypeW

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

user32

UnregisterClassA
RegisterDeviceNotificationA
KillTimer
SetTimer
ExitWindowsEx
GetFocus
SetFocus
LoadCursorA
FindWindowExW
GetKeyboardState
ToAscii
PeekMessageA
TranslateMessage
DispatchMessageA
ShowWindow
GetKeyState
ReleaseDC
DestroyWindow
GetCursorPos
ScreenToClient
SetWindowTextW
RegisterClassA
CreateWindowExA
GetDC
GetDesktopWindow
GetWindowRect
SetWindowPos
AdjustWindowRect
GetUpdateRect
ValidateRect
DefWindowProcA
SetCursor

gdi32

SelectObject
CreateSolidBrush
GetPixel
StretchDIBits
CreatePalette
SelectPalette
RealizePalette
DeleteObject

advapi32

RegUnLoadKeyW
RegEnumValueW
RegLoadKeyA
RegUnLoadKeyA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegLoadKeyW
StartServiceW
CreateServiceA
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
LookupPrivilegeValueW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
SetFileSecurityW
GetFileSecurityW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
RegDeleteKeyW
RegSetValueExA
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegGetKeySecurity
RegSetKeySecurity
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA

ole32

CoSetProxyBlanket
CoCreateInstance
OleRun
CoInitializeEx
CoUninitialize
CoInitialize
CoInitializeSecurity
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SafeArrayDestroy
SafeArrayAccessData

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 828KB - Virtual size: 824KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 256KB - Virtual size: 672KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mixcrt
Size: 4KB - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b82f622dcc69314b5e2125af74e90858

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08Certificate

Extended Key Usages

Key Usages

eb:b3:f6:ab:fe:3d:b7:ea:73:60:71:a0:a6:cc:68:49:7b:7b:66:ffSigner

Headers

File Characteristics

Imports

ws2_32

imm32

imagehlp

kernel32

rpcrt4

version

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 828KB - Virtual size: 824KB

.data Size: 256KB - Virtual size: 672KB

.mixcrt Size: 4KB - Virtual size: 1B

.rsrc Size: 12KB - Virtual size: 11KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

eb:b3:f6:ab:fe:3d:b7:ea:73:60:71:a0:a6:cc:68:49:7b:7b:66:ff
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 828KB - Virtual size: 824KB

.data
Size: 256KB - Virtual size: 672KB

.mixcrt
Size: 4KB - Virtual size: 1B

.rsrc
Size: 12KB - Virtual size: 11KB