vs_Professional-2017[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

vs_Professional-2017.exe
Size

1017KB
MD5

9f1d8d7dcda5b44388f94859e9cfb37b
SHA1

dbfe6f8d81752ca3d2f3772507782b45248b41fe
SHA256

d72e6c7fd4c11b015563607756ae9aa3b84b996f69e3b42192750a73eb65b51a
SHA512

6c2d3507946ee7b2b72b81eb340bf145f7b8f0944892f5768fae1890e9a33f3ffa345c7bc14c0f74bd86a4f32a5f21812a3ba8e62c0d384d2438c04e1be87f79
SSDEEP

24576:T6oGY64l1+TwKAN/aYVSLoI62f7PUUWxxS9cV8kEDf:T11OwK6LIBvYx1VBET

Score

1^/10

Malware Config

Signatures

Files

vs_Professional-2017.exe
.exe windows x86

df40a47c584f06ec96831801b2cd71dd

Code Sign

33:00:00:01:28:b1:78:4e:26:3c:e8:e7:43:00:00:00:00:01:28
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/09/2019, 20:39

Not After

04/12/2020, 20:39

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a4:2f:05:a3:d1:06:57:b0:d7:ec:b5:f8:7a:2c:fd:3e:36:23:ed:6a:9e:b2:6a:ed:8d:4a:51:fe:bf:84:b1:bc
Signer

Actual PE Digest

a4:2f:05:a3:d1:06:57:b0:d7:ec:b5:f8:7a:2c:fd:3e:36:23:ed:6a:9e:b2:6a:ed:8d:4a:51:fe:bf:84:b1:bc

Digest Algorithm

sha256

PE Digest Matches

true

da:1f:a0:c5:77:4e:fa:8d:a2:6e:57:16:49:d2:61:4b:44:1f:de:7f
Signer

Actual PE Digest

da:1f:a0:c5:77:4e:fa:8d:a2:6e:57:16:49:d2:61:4b:44:1f:de:7f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptGenRandom
CryptReleaseContext
DecryptFileW
CryptAcquireContextW

kernel32

GetModuleHandleW
GetEnvironmentVariableW
GetTickCount
SetEnvironmentVariableW
GetLastError
ExpandEnvironmentStringsW
Sleep
GetProcessId
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventW
CreateThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
lstrlenW
CompareStringW
LocalFree
CreateDirectoryW
GetTempPathW
QueryDosDeviceW
SetErrorMode
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
FreeLibrary
WaitForMultipleObjects
ResetEvent
ReleaseSemaphore
CreateSemaphoreA
CreateEventA
GetSystemInfo
GlobalMemoryStatus
FileTimeToSystemTime
CompareFileTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
GetVersionExA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
MoveFileExW
ReadFile
GetFileSizeEx
SetFilePointerEx
GlobalFree
GlobalAlloc
GetTempFileNameW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
FatalAppExitA
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapSize
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
LocalAlloc
LoadLibraryA
RaiseException
CreateFileA
GetLocalTime
GetComputerNameW
FormatMessageA
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
lstrcmpW
GetProcessHeap
LoadLibraryExW
EnumResourceLanguagesA
FindResourceExA
LoadResource
SizeofResource
LockResource
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
ExitThread

ole32

CoInitializeEx

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shell32

ShellExecuteExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageW
PostMessageW
DialogBoxParamW
GetDlgItem
SetWindowTextW
CharUpperA
CharLowerW
EndDialog
PostQuitMessage
SetWindowLongW
GetWindowLongW
CharUpperW
LoadStringW
LoadStringA
CharToOemA
CharPrevExA
CharLowerA

oleaut32

SysAllocStringByteLen
VariantCopy
VariantClear
SysAllocString

Exports

Exports

?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boxld01
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df40a47c584f06ec96831801b2cd71dd

Code Sign

33:00:00:01:28:b1:78:4e:26:3c:e8:e7:43:00:00:00:00:01:28Certificate

Extended Key Usages

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52Certificate

Extended Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

a4:2f:05:a3:d1:06:57:b0:d7:ec:b5:f8:7a:2c:fd:3e:36:23:ed:6a:9e:b2:6a:ed:8d:4a:51:fe:bf:84:b1:bcSigner

da:1f:a0:c5:77:4e:fa:8d:a2:6e:57:16:49:d2:61:4b:44:1f:de:7fSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

rpcrt4

shell32

shlwapi

user32

oleaut32

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 313KB

.data Size: 5KB - Virtual size: 14KB

.idata Size: 5KB - Virtual size: 5KB

.boxld01 Size: 512B - Virtual size: 184B

.rsrc Size: 51KB - Virtual size: 51KB

.reloc Size: 11KB - Virtual size: 11KB

33:00:00:01:28:b1:78:4e:26:3c:e8:e7:43:00:00:00:00:01:28
Certificate

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

a4:2f:05:a3:d1:06:57:b0:d7:ec:b5:f8:7a:2c:fd:3e:36:23:ed:6a:9e:b2:6a:ed:8d:4a:51:fe:bf:84:b1:bc
Signer

da:1f:a0:c5:77:4e:fa:8d:a2:6e:57:16:49:d2:61:4b:44:1f:de:7f
Signer

.text
Size: 313KB - Virtual size: 313KB

.data
Size: 5KB - Virtual size: 14KB

.idata
Size: 5KB - Virtual size: 5KB

.boxld01
Size: 512B - Virtual size: 184B

.rsrc
Size: 51KB - Virtual size: 51KB

.reloc
Size: 11KB - Virtual size: 11KB