ghost32[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ghost32.exe
Size

5.1MB
MD5

aa220708c439ddba9f65495a9481a4c8
SHA1

17c8ff644151c1db393f91a9ccfe32305cbd9cbf
SHA256

5c03d4b9864ebf7db942faaf87c97034eb6c53988659c83ed8480738f25ee2bd
SHA512

634d8067b9d8aca720ef0ee0eb2767cf51ff7c93bf0df3b4d345f883d4a21eeefe16a62d35f53fda1cad5e3d34dbcf2adcb4cc0a9bdcc78a0fb3e34ddb70c4c3
SSDEEP

98304:HKliGJT4TfrVrkb0V/uv5L+4zKnqpUpeyRi2E7EnnY7rNFvluzUkEWo:4iGJTOfrVYb+2vNzKnqpUQyRi2E7EnYv

Score

1^/10

Malware Config

Signatures

Files

ghost32.exe
.exe windows x86

d3a6aed3bf2124ad5638336864f0bd5e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ed:f8:34:0c:df:06:0c:09:9e:1a:64:72:f7:6d:b4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/09/2006, 00:00

Not After

24/11/2007, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:37:07:27:d3:9b:ca:61:63:94:44:0c:d0:c8:1b:cb:73:ad:91:2b
Signer

Actual PE Digest

86:37:07:27:d3:9b:ca:61:63:94:44:0c:d0:c8:1b:cb:73:ad:91:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetProcessHeap
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetTimeZoneInformation
WriteFile
GetStdHandle
GetModuleFileNameA
ExitProcess
CloseHandle
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetTimeFormatA
GetDateFormatA
GetACP
GetCommandLineA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
LoadLibraryA
GetLocaleInfoW
FreeLibrary
SetStdHandle
CreateFileA
ReadFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
SetUnhandledExceptionFilter
CompareStringW
SetEnvironmentVariableA
LocalFree
LocalAlloc
BackupRead
BackupSeek
SetFileAttributesA
SetFileTime
FindFirstFileA
GetBinaryTypeA
MoveFileA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
GetDiskFreeSpaceA
GetVolumeInformationA
ReadProcessMemory
GetLogicalDriveStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapAlloc
SetConsoleCtrlHandler
RaiseException
HeapFree
GetLastError
GetSystemTimeAsFileTime
GetOEMCP
IsDebuggerPresent
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
VirtualQuery
GetSystemInfo
VirtualLock
SetProcessWorkingSetSize
GetProcessWorkingSetSize
CreateFileW
GetFileSize
DeviceIoControl
SetErrorMode
CreateEventA
GetOverlappedResult
WaitForSingleObject
FreeConsole
FormatMessageA
CreateThread
GlobalMemoryStatus
IsBadWritePtr
GetThreadContext
GetLogicalDrives
GetDriveTypeA
DefineDosDeviceW
ResetEvent
QueryPerformanceFrequency
SetEvent
GetCurrentDirectoryA
FindClose
FindNextFileA
FileTimeToLocalFileTime
IsDBCSLeadByteEx
GetEnvironmentVariableW
SystemTimeToFileTime
FileTimeToSystemTime
LocalFileTimeToFileTime
InterlockedCompareExchange
ExitThread
ResumeThread
ReadConsoleInputA
SetConsoleMode
GetFileAttributesA
GetFullPathNameA
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
Sleep
InterlockedDecrement
CompareStringA
InterlockedIncrement

ws2_32

setsockopt
shutdown
recv
WSASetLastError
recvfrom
WSAAddressToStringA
sendto
WSASocketA
getsockopt
getsockname
ntohl
WSASendTo
send
WSARecvFrom
WSARecv
WSAIoctl
WSAWaitForMultipleEvents
ioctlsocket
WSAEnumNetworkEvents
WSASend
inet_ntoa
gethostname
gethostbyname
WSAStartup
WSACleanup
closesocket
WSACloseEvent
htons
htonl
WSACreateEvent
socket
connect
WSAGetLastError
accept
bind
listen
inet_addr
WSAEventSelect

imm32

ImmDisableIME

imagehlp

ImageRemoveCertificate
ImageGetCertificateHeader

user32

SetCapture
GetCapture
ValidateRect
GetUpdateRect
SetWindowPos
GetWindowRect
GetDesktopWindow
GetDC
CreateWindowExA
RegisterClassA
SetWindowTextW
LoadCursorA
GetCursorPos
FindWindowExW
ReleaseDC
DestroyWindow
PeekMessageA
TranslateMessage
DispatchMessageA
CharToOemA
ExitWindowsEx
SetCursor
TrackMouseEvent
ReleaseCapture
GetFocus
SetFocus
AdjustWindowRect
DefWindowProcA
GetKeyboardState
GetKeyState
ToAscii
ScreenToClient

gdi32

GetPixel
StretchDIBits
CreatePalette
SelectPalette
RealizePalette
CreateSolidBrush
DeleteObject
SelectObject

advapi32

LookupPrivilegeValueA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ole32

CoUninitialize
CoInitialize
OleRun
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 736KB - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3a6aed3bf2124ad5638336864f0bd5e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

01:ed:f8:34:0c:df:06:0c:09:9e:1a:64:72:f7:6d:b4Certificate

Extended Key Usages

Key Usages

86:37:07:27:d3:9b:ca:61:63:94:44:0c:d0:c8:1b:cb:73:ad:91:2bSigner

Headers

File Characteristics

Imports

kernel32

ws2_32

imm32

imagehlp

user32

gdi32

advapi32

rpcrt4

version

ole32

oleaut32

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 736KB - Virtual size: 732KB

.data Size: 240KB - Virtual size: 652KB

.rsrc Size: 12KB - Virtual size: 11KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

01:ed:f8:34:0c:df:06:0c:09:9e:1a:64:72:f7:6d:b4
Certificate

86:37:07:27:d3:9b:ca:61:63:94:44:0c:d0:c8:1b:cb:73:ad:91:2b
Signer

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 736KB - Virtual size: 732KB

.data
Size: 240KB - Virtual size: 652KB

.rsrc
Size: 12KB - Virtual size: 11KB