NA_NA_1b1912ec3702f2exeexe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NA_NA_1b1912ec3702f2exeexe_JC.exe
Size

4.0MB
MD5

1b1912ec3702f21cf9714839cbf6008b
SHA1

fac2e7a0f6f7e11be75e2d6b1f13b946b1bc765f
SHA256

364bddd69e8c44712d3e9ddf9c429a317e82f54201e7df77c02b49486e87d2a6
SHA512

d5f9332a40959a4bc6bcebf8c393855c6c29a8fcf2174151e8d2a3cb2570077111e980cb02e23f052c57f5a9adcfeaeeec014dbdbdcbaa1ea29eb93bdede51b5
SSDEEP

98304:tx/ZStBYVNvA5TE0aCMqzX+AewBIcxmkDajacLzN2IHRBfB7jGTLYxu:tTStmA5TE0acBMkDa+cLzDnB2TYu

Score

1^/10

Malware Config

Signatures

Files

NA_NA_1b1912ec3702f2exeexe_JC.exe
.exe windows x86

d3ea433dadbec333533d41f2bccc0d8c

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/05/2009, 00:00

Not After

02/07/2011, 23:59

Subject

CN=W3i\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=W3i\, LLC,L=Sartell,ST=Minnesota,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f5:f0:b4:23:21:a1:19:32:1b:0c:da:39:e4:99:2b:07:0f:dc:a6:f9
Signer

Actual PE Digest

f5:f0:b4:23:21:a1:19:32:1b:0c:da:39:e4:99:2b:07:0f:dc:a6:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCombineUrlA
InternetReadFileExA
InternetErrorDlg
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetSetStatusCallback
InternetOpenA
InternetCloseHandle
InternetSetCookieA
InternetGetCookieA

kernel32

GlobalFlags
GetCPInfo
GetOEMCP
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFileSizeEx
SetErrorMode
ExitProcess
GetCommandLineA
GetStartupInfoA
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
RtlUnwind
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
ExitThread
CreateThread
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
TlsFree
LCMapStringW
GetStdHandle
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
VirtualFree
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedIncrement
GetModuleHandleW
GetThreadLocale
RaiseException
InterlockedDecrement
GetModuleFileNameW
CreateEventA
SuspendThread
SetEvent
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
FreeResource
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenW
MulDiv
ResumeThread
GlobalMemoryStatus
GetLongPathNameA
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
EnumResourceNamesA
GetFullPathNameW
LoadLibraryW
GetFileAttributesW
CreateFileW
GetTempPathW
LockFileEx
DeleteFileW
AreFileApisANSI
GetSystemInfo
GetFileSize
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetTimeZoneInformation
FileTimeToSystemTime
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
Module32Next
Module32First
GetExitCodeProcess
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
CreateProcessA
CloseHandle
GetShortPathNameA
MultiByteToWideChar
GetFullPathNameA
GetModuleFileNameA
GetFileAttributesA
SetFileAttributesA
RemoveDirectoryA
DeleteFileA
GetTempFileNameA
GetSystemTime
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetTempPathA
GetPrivateProfileSectionA
HeapFree
GetPrivateProfileSectionNamesA
GetProcessHeap
HeapAlloc
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
LocalFree
FormatMessageA
lstrlenA
LocalAlloc
WritePrivateProfileStringA
CreateMutexA
ReleaseMutex
GetPrivateProfileStringA
GetPrivateProfileIntA
CopyFileA
SystemTimeToFileTime
GetLocalTime
GetTickCount
Sleep
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
ResetEvent
LCMapStringA

user32

DestroyMenu
GetMenuItemInfoA
WindowFromPoint
SetWindowRgn
IsRectEmpty
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
CharUpperA
SetScrollPos
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
IntersectRect
GetWindowPlacement
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
UnpackDDElParam
GetWindowTextA
GetFocus
SetWindowPos
SetFocus
ShowWindow
MoveWindow
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CharNextA
SetWindowContextHelpId
RegisterClipboardFormatA
PostThreadMessageA
MessageBeep
GetKeyboardState
UnregisterClassA
CopyAcceleratorTableA
SetRect
InvalidateRgn
TranslateAcceleratorA
BringWindowToTop
SetRectEmpty
CreatePopupMenu
InsertMenuItemA
LoadAcceleratorsA
LoadMenuA
GetScrollRange
ReuseDDElParam
DrawIcon
IsIconic
InflateRect
ShowScrollBar
DrawEdge
ChildWindowFromPoint
GetCursorPos
CopyRect
PtInRect
GetWindow
SetCursor
LoadImageA
MapDialogRect
ClientToScreen
LoadCursorA
GetDlgItem
SetWindowTextA
SetWindowLongA
EndDialog
GetSysColorBrush
GetSysColor
GetDlgCtrlID
GetWindowLongA
DialogBoxParamA
WaitForInputIdle
SetCapture
ReleaseCapture
GetCapture
SetClassLongA
OffsetRect
GetParent
EnumDisplaySettingsA
GetSystemMetrics
InvalidateRect
ScreenToClient
GetWindowRect
SystemParametersInfoA
EnumChildWindows
GetClassNameA
GetWindowThreadProcessId
IsWindowEnabled
EnumWindows
wsprintfA
SetForegroundWindow
PostMessageA
LoadIconA
GetClientRect
IsWindowVisible
MessageBoxA
RedrawWindow
KillTimer
UpdateWindow
SetTimer
EnableWindow
SendMessageA
IsWindow
GetNextDlgGroupItem
GetWindowTextLengthA
GetScrollPos

gdi32

GetMapMode
CreateEllipticRgn
GetTextExtentPoint32A
GetRgnBox
GetBkColor
GetTextColor
Ellipse
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
CreateSolidBrush
CreateFontIndirectA
GetObjectA
RectVisible
DeleteObject
GetStockObject
LPtoDP
SetBkColor
GetPixel
GetWindowExtEx
GetViewportExtEx
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
CreateRectRgnIndirect
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
PtVisible

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegDeleteValueA
RegQueryValueA
GetLengthSid
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegEnumKeyExA
DuplicateTokenEx
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
CreateProcessAsUserA
SetTokenInformation

shell32

DragQueryFileA
DragFinish
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathA
ShellExecuteExA
Shell_NotifyIconA

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathRemoveFileSpecW
PathFindFileNameA
SHDeleteEmptyKeyA
UrlEscapeA
PathCombineA
PathFindExtensionA
PathRenameExtensionA
PathStripPathA
PathRemoveFileSpecA
PathIsUNCA

oledlg

ord8

ole32

CoRegisterMessageFilter
OleFlushClipboard
CoUninitialize
CoInitializeEx
StringFromGUID2
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
OleUninitialize
CoInitializeSecurity
OleInitialize
OleIsCurrentClipboard
CoCreateGuid
CLSIDFromProgID
CoFreeUnusedLibraries
CoRevokeClassObject

oleaut32

SafeArrayCreate
OleCreateFontIndirect
SafeArrayCreateVector
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysFreeString
VariantClear
SysAllocStringLen
VariantInit
SysStringLen
VariantChangeType
SysAllocStringByteLen
SysAllocString
VariantCopy
DispCallFunc
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim

urlmon

IsValidURL
URLDownloadToFileA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3ea433dadbec333533d41f2bccc0d8c

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56Certificate

Extended Key Usages

Key Usages

f5:f0:b4:23:21:a1:19:32:1b:0c:da:39:e4:99:2b:07:0f:dc:a6:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 391KB - Virtual size: 390KB

.data Size: 24KB - Virtual size: 45KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

73:93:ad:65:df:71:bf:83:c8:88:24:20:f2:fe:0a:56
Certificate

f5:f0:b4:23:21:a1:19:32:1b:0c:da:39:e4:99:2b:07:0f:dc:a6:f9
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 391KB - Virtual size: 390KB

.data
Size: 24KB - Virtual size: 45KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB