Tcpview[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Tcpview.exe
Size

145KB
MD5

ca779a054031e5ca5cac406b5443532d
SHA1

064795b947b85a98c50a1f618b7d4ec13d1c520f
SHA256

f9bd754c9836fb924538a7f841860611d58e2a61127b3f6e778b4b6c3130f19e
SHA512

83cd3d77ac6dd3e07104077950b018f0ac31a8b530185354c0b85048610042b64da199797857e156764f8efeb2b78e8e1122db5b9f53eb1f9193725e668a4020
SSDEEP

3072:PRAhrYwMjMNX2E4NOSBh53VY09lX8Cy/:ZerYRjMNX2xZBlXg

Score

1^/10

Malware Config

Signatures

Files

Tcpview.exe
.exe windows x86

664ad68120361779226e0c390ff4562b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cb
Signer

Actual PE Digest

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ws2_32

connect
send
recv
closesocket
WSAStartup
socket
gethostbyaddr
htonl
htons
getservbyport
ntohs
ntohl
WSAGetLastError
gethostbyname
gethostname

iphlpapi

SetTcpEntry
GetTcpTable
GetUdpTable

comctl32

ord17
ord6
ImageList_Create
ImageList_ReplaceIcon
CreateToolbarEx

kernel32

OpenProcess
CreateEventA
DeviceIoControl
GetCurrentProcessId
DuplicateHandle
GetModuleFileNameA
DeleteFileA
GetSystemDirectoryA
GetVersion
FormatMessageA
GetTickCount
SetEvent
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcatA
HeapFree
lstrlenA
lstrcpyA
HeapAlloc
GetProcessHeap
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
InitializeCriticalSection
ExpandEnvironmentStringsA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
Sleep
GetFileType
SetHandleCount
GetStdHandle
ExitProcess
ReadProcessMemory
HeapDestroy
VirtualAlloc
VirtualFree
DeleteCriticalSection
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RtlUnwind
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
IsDebuggerPresent
WriteConsoleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetVersionExA
GetCommandLineA
HeapReAlloc
CreateThread
ResumeThread
ExitThread
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetLastError
CloseHandle
LocalAlloc
LoadLibraryA
HeapCreate
LocalFree
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
ReadFile
GetEnvironmentStringsW

user32

TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
LoadMenuA
InsertMenuA
GetMessageA
PostQuitMessage
LoadStringA
DialogBoxParamA
GetSubMenu
EnableMenuItem
TrackPopupMenu
UpdateWindow
LoadAcceleratorsA
CreateMenu
DestroyIcon
SetDlgItemTextA
GetParent
ChildWindowFromPoint
InvalidateRect
SetCapture
ReleaseCapture
SetWindowLongA
GetWindowLongA
GetClientRect
CreateWindowExA
SetFocus
CallWindowProcA
GetSysColor
LoadIconA
DrawIconEx
InvalidateRgn
SetWindowPos
GetMenu
CheckMenuItem
SetTimer
KillTimer
GetWindowRect
IsIconic
IsZoomed
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
GetDC
DrawTextA
ReleaseDC
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
DefWindowProcA
MessageBoxA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA
GetCursorPos

gdi32

CreateSolidBrush
EndDoc
EndPage
StartPage
StartDocA
SetMapMode
GetDeviceCaps
SetBkMode
SetTextColor
SelectObject
CreateFontIndirectA
GetObjectA
GetStockObject
GetTextExtentPoint32A
ExtTextOutA
SetBkColor
DeleteObject
GetTextMetricsA
CreateCompatibleDC

comdlg32

ChooseFontA
PrintDlgA
GetSaveFileNameA

advapi32

RegOpenKeyExA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

ShellExecuteA
SHGetFileInfoA

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

664ad68120361779226e0c390ff4562b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cbSigner

Headers

File Characteristics

Imports

version

ws2_32

iphlpapi

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 24KB - Virtual size: 21KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

bf:af:37:d0:67:a7:41:20:5c:42:d7:ec:64:f8:e2:34:4c:fd:c4:cb
Signer

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 24KB - Virtual size: 21KB