CSPSetup-4[.]0[.]9708[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CSPSetup-4.0.9708.exe
Size

4.6MB
MD5

681389ceccab183fa1e11f8da103d064
SHA1

77e2462d08f506f44cd57f72f392a7fea9bf9e3d
SHA256

e4ea780c2fbc800f4eca290839210d20c4e1f7d88b9605564d484e9ae0f796ae
SHA512

c6f81981356cce90bc772da10e986a345ce702ee08a174be6e7670f701de5423bb893cdb4fd69745669392007997e1e6740e41b6f3eb37ed402416f8b9fd7dcf
SSDEEP

98304:sbYD/IvbNCYvqIvYbrM4eLm3gr8FtgcyeYOqeREA4HS:kYDAbNCwqIvYbYrAhJqeV

Score

1^/10

Malware Config

Signatures

Files

CSPSetup-4.0.9708.exe
.exe windows x86

602d1ff47988e5fb34f1eb9da2728f35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:7d:ac:2b:1f:af:0f:fa:72:c1:30:a7:87:76:8b:ed
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/02/2016, 00:00

Not After

11/03/2019, 23:59

Subject

CN=CRYPTO-PRO,O=CRYPTO-PRO,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:56:ce:ca:0f:63:77:f8:73:92:17:d4:52:6b:fe:b3
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/01/2016, 00:00

Not After

30/01/2017, 12:00

Subject

CN=LLC Crypto-Pro,O=LLC Crypto-Pro,L=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bd:8e:79:6c:33:82:82:da:a5:05:9a:a6:56:fe:9a:b4:1c:dd:fc:52:9e:c0:9f:3b:85:e3:44:49:7b:45:78:55
Signer

Actual PE Digest

bd:8e:79:6c:33:82:82:da:a5:05:9a:a6:56:fe:9a:b4:1c:dd:fc:52:9e:c0:9f:3b:85:e3:44:49:7b:45:78:55

Digest Algorithm

sha256

PE Digest Matches

true

b0:8c:ef:9a:b6:f8:8e:d5:53:41:a3:02:28:a4:ea:9e:57:e8:27:c3
Signer

Actual PE Digest

b0:8c:ef:9a:b6:f8:8e:d5:53:41:a3:02:28:a4:ea:9e:57:e8:27:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
SystemTimeToFileTime
GetLastError
CreateThread
WaitForSingleObject
GetExitCodeThread
Sleep
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
FindFirstFileW
FindClose
CompareFileTime
CreateDirectoryW
ExpandEnvironmentStringsW
lstrlenA
lstrcmpW
GetSystemTimeAsFileTime
DeleteFileW
FindNextFileW
RemoveDirectoryW
GlobalMemoryStatusEx
VirtualFree
GetModuleHandleA
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
lstrcmpiA
LoadLibraryA
SetThreadLocale
GetEnvironmentVariableW
FindResourceExA
SizeofResource
LoadResource
LockResource
MulDiv
GlobalAlloc
GlobalFree
GetUserDefaultUILanguage
lstrcmpiW
GetLocaleInfoW
GetTempPathW
SetEnvironmentVariableW
CloseHandle
GetCommandLineW
GetStartupInfoW
SetLastError
CreateJobObjectW
AssignProcessToJobObject
CreateIoCompletionPort
SetInformationJobObject
ResumeThread
GetQueuedCompletionStatus
GetExitCodeProcess
GetVersionExW
SetProcessWorkingSetSize
GetCurrentProcess
SetCurrentDirectoryW
GetDriveTypeW
CreateFileW
WriteFile
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
GetCurrentThreadId
GetSystemDirectoryW
SuspendThread
TerminateThread
IsBadReadPtr
FormatMessageW
lstrcpyW
LocalFree
DeleteCriticalSection
GetFileSize
SetFilePointer
ReadFile
SetFileTime
SetEndOfFile
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFileAttributesW
GetDiskFreeSpaceExW
GetVersion
GetModuleHandleW
GetProcAddress
VirtualAlloc
CreateProcessW
RtlUnwind

user32

GetDC
DrawTextW
ClientToScreen
DialogBoxIndirectParamW
MessageBeep
DefWindowProcW
CallWindowProcW
DrawIconEx
GetSystemMenu
EnableMenuItem
IsWindow
EnableWindow
wvsprintfW
CharUpperW
ShowWindow
SetWindowsHookExW
wsprintfA
SetWindowPos
CopyImage
ReleaseDC
GetWindowDC
wsprintfW
GetSysColor
GetMenu
GetWindowLongW
GetClassNameA
SetWindowTextW
ScreenToClient
GetWindowRect
GetParent
GetWindowTextW
GetWindow
LoadImageW
LoadIconW
SystemParametersInfoW
SetFocus
UnhookWindowsHookEx
SetWindowLongW
GetWindowTextLengthW
DestroyWindow
KillTimer
DispatchMessageW
CallNextHookEx
PtInRect
GetSystemMetrics
GetClientRect
GetDlgItem
MessageBoxA
GetMessageW
SetTimer
CreateWindowExW
SendMessageW
EndDialog
GetKeyState

gdi32

SetStretchBltMode
StretchBlt
GetCurrentObject
CreateCompatibleBitmap
CreateFontIndirectW
DeleteObject
SelectObject
CreateCompatibleDC
DeleteDC
GetDeviceCaps
GetObjectW

advapi32

CheckTokenMembership
AllocateAndInitializeSid
FreeSid

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetMalloc

ole32

CoCreateInstance
CoInitialize
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
OleLoadPicture

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
free
memmove
strncmp
wcsncmp
_wtol
malloc
_wcsnicmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_beginthreadex
_ismbblead
memset
memcpy
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UAE@XZ
__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
__CxxFrameHandler
_CxxThrowException
_except_handler3

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

602d1ff47988e5fb34f1eb9da2728f35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

42:7d:ac:2b:1f:af:0f:fa:72:c1:30:a7:87:76:8b:edCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0d:56:ce:ca:0f:63:77:f8:73:92:17:d4:52:6b:fe:b3Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

bd:8e:79:6c:33:82:82:da:a5:05:9a:a6:56:fe:9a:b4:1c:dd:fc:52:9e:c0:9f:3b:85:e3:44:49:7b:45:78:55Signer

b0:8c:ef:9a:b6:f8:8e:d5:53:41:a3:02:28:a4:ea:9e:57:e8:27:c3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

Sections

.text Size: 110KB - Virtual size: 110KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 2KB - Virtual size: 11KB

.rsrc Size: 30KB - Virtual size: 30KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

42:7d:ac:2b:1f:af:0f:fa:72:c1:30:a7:87:76:8b:ed
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0d:56:ce:ca:0f:63:77:f8:73:92:17:d4:52:6b:fe:b3
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

bd:8e:79:6c:33:82:82:da:a5:05:9a:a6:56:fe:9a:b4:1c:dd:fc:52:9e:c0:9f:3b:85:e3:44:49:7b:45:78:55
Signer

b0:8c:ef:9a:b6:f8:8e:d5:53:41:a3:02:28:a4:ea:9e:57:e8:27:c3
Signer

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 2KB - Virtual size: 11KB

.rsrc
Size: 30KB - Virtual size: 30KB