dwtrig20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dwtrig20.exe
Size

507KB
MD5

c87e561258f2f8650cef999bf643a731
SHA1

2c64b901284908e8ed59cf9c912f17d45b05e0af
SHA256

a1dfa6639bef3cb4e41175c43730d46a51393942ead826337ca9541ac210c67b
SHA512

dea4833aa712c5823f800f5f5a2adcf241c1b2b6747872f540f5ff9da6795c4ddb73db0912593337083c7c67b91e9eaf1b3d39a34b99980fd5904ba3d7d62f6c
SSDEEP

12288:qMwXwNSO5X3IA1iBihI7XHgZQKhJgeCmvz0/:dew0O1IA1UiuLHgZpJEGg/

Score

1^/10

Malware Config

Signatures

Files

dwtrig20.exe
.exe windows x86

fc9b6c7d9cc2ba69110ad83024eeffb4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

50:2e:9f:50:97:d0:08:12:ab:c0:71:2f:e0:3a:13:99:62:e2:7e:10
Signer

Actual PE Digest

50:2e:9f:50:97:d0:08:12:ab:c0:71:2f:e0:3a:13:99:62:e2:7e:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

secur32

GetUserNameExW

advapi32

GetTokenInformation
OpenThreadToken
UnregisterTraceGuids
ConvertSidToStringSidA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
TraceEvent
RegQueryInfoKeyW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
IsValidSid

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateDCA
CreateSolidBrush

kernel32

GetSystemWindowsDirectoryW
lstrcmpiW
WriteConsoleW
SetEvent
lstrlenW
CreateEventW
GetModuleFileNameW
WaitForSingleObject
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
GetModuleHandleA
VirtualAlloc
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
TlsSetValue
SetLastError
GetLastError
VirtualFree
TlsGetValue
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetSystemDefaultLCID
TlsFree
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
IsValidLocale
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
ReleaseMutex
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
WriteFile
SetFileAttributesW
DeleteFileW
CreateFileW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
GlobalFree
LoadLibraryW
OutputDebugStringA
CreateMutexA
OpenMutexA
CreateSemaphoreA
GetShortPathNameA
GetModuleFileNameA
GlobalAlloc
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
IsWow64Process
GetUserDefaultLCID
FreeLibrary
GetSystemInfo
GetVersionExW
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
CreateProcessW
LoadLibraryA
GetConsoleOutputCP
LocalFree
LocalAlloc
Sleep
GetTempPathW
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
GetFileType
CreateFileA
InitializeCriticalSection
LoadLibraryExW
IsDBCSLeadByte
GetStringTypeExW
GetACP
WideCharToMultiByte
IsValidCodePage
CompareStringW
MultiByteToWideChar
GetCurrentThread
FlushFileBuffers
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
RtlUnwind
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
SetStdHandle
GetStringTypeA
GetStringTypeW
WriteConsoleA

ole32

CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
StringFromIID

oleaut32

LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi

rpcrt4

UuidCreate

shell32

SHGetSpecialFolderPathW

user32

GetSysColor
EnumDisplayMonitors
GetMonitorInfoA
GetKeyboardLayoutList
GetKeyboardLayout
GetMenuCheckMarkDimensions
ReleaseDC
GetDC
SystemParametersInfoA
GetSystemMetrics

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc9b6c7d9cc2ba69110ad83024eeffb4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

50:2e:9f:50:97:d0:08:12:ab:c0:71:2f:e0:3a:13:99:62:e2:7e:10Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

secur32

advapi32

gdi32

kernel32

ole32

oleaut32

rpcrt4

shell32

user32

Exports

Exports

Sections

.text Size: 288KB - Virtual size: 287KB

.data Size: 200KB - Virtual size: 229KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

50:2e:9f:50:97:d0:08:12:ab:c0:71:2f:e0:3a:13:99:62:e2:7e:10
Signer

.text
Size: 288KB - Virtual size: 287KB

.data
Size: 200KB - Virtual size: 229KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB