1199c202e6b9adc399a5da6e1254fe33878f2fe96a302c308813998a8a03b561[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

1199c202e6b9adc399a5da6e1254fe33878f2fe96a302c308813998a8a03b561.zip
Size

1.2MB
MD5

c6759f9e4d543bc389e1728abc5196f0
SHA1

976fbb3577acb14878897ea11b422ec3c96b2870
SHA256

b930c31dcfd5a924503343afb16b7597030dd421c03264bd4318f699247de2f4
SHA512

777e2bb4d19dfd3d7875eb13a9b89398a08388fc5b5083ef1e5854b5d35b62961db39141368ab6c6c2f20ea0fc2640f60351be497bf8a634856c14905815707d
SSDEEP

24576:9CqRT5g545QUTATKxIgjSwKTozco2SKvROZcZ0:LiXRKmWKTozco2jR4C0

Score

1^/10

Malware Config

Signatures

Files

1199c202e6b9adc399a5da6e1254fe33878f2fe96a302c308813998a8a03b561.zip
.zip

Password: infected
component_71.decrpt
.exe windows x86

Password: infected

fea180fb01698edfa9f23a2be96bd90d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:7b:96:f9:4d:20:c1
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

13/07/2011, 13:38

Not After

25/06/2012, 18:20

Subject

CN=Performersoft LLC,O=Performersoft LLC,L=Beaverton,ST=OR,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

58:a1:1e:27:f6:a1:8f:c1:e8:f7:0e:a8:36:a8:5b:d7:89:98:b6:c7
Signer

Actual PE Digest

58:a1:1e:27:f6:a1:8f:c1:e8:f7:0e:a8:36:a8:5b:d7:89:98:b6:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
CreateEventW
LocalFree
GetCommandLineW
CreateDirectoryW
FreeLibrary
MapViewOfFile
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFullPathNameW
GetFullPathNameA
FormatMessageW
GetModuleFileNameW
UnmapViewOfFile
CopyFileW
CreateFileW
WriteFile
SetEvent
CreateEventA
MoveFileExW
DeleteFileW
OpenProcess
WaitForSingleObject
Sleep
lstrlenW
GetModuleHandleW
GetProcAddress
CloseHandle
FindResourceExW
FindResourceW
GetSystemTime
LoadLibraryW
GetFileAttributesExW
GetFileAttributesW
DeleteFileA
GetFileAttributesA
UnlockFileEx
LockFileEx
LockFile
UnlockFile
SetEndOfFile
AreFileApisANSI
LoadResource
LockResource
GetTempPathA
SizeofResource
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
MultiByteToWideChar
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExW
WideCharToMultiByte
GetCurrentProcess
lstrlenA
InterlockedDecrement
GetNativeSystemInfo
ReadFile
GetFileSize
ReleaseMutex
CreateMutexW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
TerminateProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetTempPathW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FormatMessageA
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStdHandle
GetModuleFileNameA
HeapCreate
VirtualFree
GetModuleHandleA
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
SetEnvironmentVariableA
CreateFileMappingW

user32

GetSystemMetrics
MessageBoxW

shell32

CommandLineToArgvW
ord680
SHGetSpecialFolderPathW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VarCmp
VariantInit
VarBstrFromDate
SysAllocString
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysFreeString

advapi32

RegEnumKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateServiceW
ChangeServiceConfig2W
StartServiceW
OpenSCManagerW
OpenServiceW
ControlService
DeleteService
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW

shlwapi

PathFileExistsW
PathStripPathW
SHGetValueW
PathAddExtensionW
StrCmpW
PathAppendW

winhttp

WinHttpConnect
WinHttpSetOption
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpSendRequest
WinHttpOpen
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpQueryDataAvailable

Sections

.text
Size: 488KB - Virtual size: 488KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

fea180fb01698edfa9f23a2be96bd90d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

03:01Certificate

Key Usages

27:7b:96:f9:4d:20:c1Certificate

Extended Key Usages

Key Usages

58:a1:1e:27:f6:a1:8f:c1:e8:f7:0e:a8:36:a8:5b:d7:89:98:b6:c7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

advapi32

shlwapi

winhttp

Sections

.text Size: 488KB - Virtual size: 488KB

.rdata Size: 95KB - Virtual size: 95KB

.data Size: 14KB - Virtual size: 24KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 33KB - Virtual size: 33KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:01
Certificate

27:7b:96:f9:4d:20:c1
Certificate

58:a1:1e:27:f6:a1:8f:c1:e8:f7:0e:a8:36:a8:5b:d7:89:98:b6:c7
Signer

.text
Size: 488KB - Virtual size: 488KB

.rdata
Size: 95KB - Virtual size: 95KB

.data
Size: 14KB - Virtual size: 24KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 33KB - Virtual size: 33KB