Ghostexp11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Ghostexp11.exe
Size

2.8MB
MD5

f3b71c000240fe7a001803fd75752e93
SHA1

03c304b4596071ace1ba612394d6ee32f171d773
SHA256

f6ff7ce2fbd8b60199fe160491e30a56b9a60de745a944811baff6433fb29db9
SHA512

0e22d7e7aeb73a6b08bd82c0cad2286e1192cfb47cd3364bf9c2585e302987eed23d2b43d854526e0f004ce4af62d73dd355daeb65290d6451bd8c9b6d050f4d
SSDEEP

49152:7LRKODLnvpJMTW6dnSvpe2aLKVQq5qRURFqRkhdm+ssIT4C1:7tKOHmZNSheNKu4vrk

Score

1^/10

Malware Config

Signatures

Files

Ghostexp11.exe
.exe windows x86

9607fffd0767b816d550c66043aac722

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

31/10/2007, 00:00

Not After

24/11/2010, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

53:be:03:21:f8:1c:ac:34:44:f6:ee:e5:5b:84:9b:54:5e:da:3d:78
Signer

Actual PE Digest

53:be:03:21:f8:1c:ac:34:44:f6:ee:e5:5b:84:9b:54:5e:da:3d:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsW
RemoveDirectoryA
GetBinaryTypeA
GetFileInformationByHandle
GetDiskFreeSpaceW
GetFileAttributesW
BackupSeek
BackupRead
FindNextFileA
IsValidCodePage
IsDBCSLeadByteEx
GetConsoleCP
GetConsoleOutputCP
GetACP
GetSystemTimeAsFileTime
GetLogicalDrives
ResetEvent
DefineDosDeviceW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
VirtualProtect
GetCommandLineA
GetStartupInfoA
ExitProcess
ExitThread
GetTimeFormatA
GetDateFormatA
LCMapStringA
LCMapStringW
GetStdHandle
FreeEnvironmentStringsA
GetTempPathA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
GetConsoleMode
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
WriteConsoleA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
VirtualUnlock
GetProcessWorkingSetSize
SetProcessWorkingSetSize
VirtualLock
GetWindowsDirectoryA
GetSystemDirectoryA
GetFileAttributesExA
GetFileAttributesExW
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
GetProfileIntA
InterlockedCompareExchange
CreateDirectoryA
GetTempFileNameA
lstrcpyA
GetDriveTypeA
GetLogicalDriveStringsA
GetExitCodeThread
TerminateThread
IsBadWritePtr
GlobalMemoryStatus
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
GetLocaleInfoW
GetStringTypeA
GetSystemTime
GetLocalTime
VirtualProtectEx
GetVersionExW
FindResourceExA
FindResourceW
VirtualQuery
GetModuleHandleW
GetThreadContext
DeleteFileW
CreateFileW
LoadLibraryW
SetCurrentDirectoryW
CreateEventW
Sleep
CreateThread
VirtualFree
GetSystemInfo
VirtualAlloc
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
DebugBreak
IsDebuggerPresent
GetFileTime
GetFileAttributesA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetErrorMode
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentDirectoryA
GetAtomNameA
GetOEMCP
GetCPInfo
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
ReadProcessMemory
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
DeleteFileA
MoveFileA
GetCurrentProcessId
CreateEventA
GetOverlappedResult
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetVersionExA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
SetLastError
SetProcessAffinityMask
GetModuleHandleA
GetModuleFileNameA
GetFullPathNameA
SetCurrentDirectoryA
GetLongPathNameA
LoadLibraryA
GetProcAddress
GetDiskFreeSpaceA
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiW
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetCurrentThread
GetCurrentProcess
CloseHandle
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentStrings
InterlockedExchange

user32

EnableMenuItem
CheckMenuItem
GetWindowThreadProcessId
SetRectEmpty
IsZoomed
GetDesktopWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMessageA
TranslateMessage
GetActiveWindow
GetCursorPos
PostQuitMessage
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
GetSysColorBrush
GetDlgItem
GetTopWindow
DestroyWindow
ModifyMenuA
GetMessagePos
PeekMessageA
SetWindowTextA
MoveWindow
ShowWindow
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
ScrollWindowEx
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
EnableWindow
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
GetParent
EqualRect
DeferWindowPos
CopyRect
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
LoadCursorA
UnregisterClassA
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
IsDlgButtonChecked
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetCursor
ShowOwnedPopups
GetMessageTime
RegisterClipboardFormatA
EndDeferWindowPos
IsDialogMessageA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
UnhookWindowsHookEx
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
InflateRect
GetMenuItemInfoA
DestroyMenu
DeleteMenu
GetDialogBaseUnits
TranslateAcceleratorA
SetMenu
BringWindowToTop
CreatePopupMenu
InsertMenuItemA
InvalidateRect
LoadAcceleratorsA
ReleaseCapture
LoadMenuA
ReuseDDElParam
UnpackDDElParam
SetRect
SetTimer
KillTimer
WindowFromPoint
DestroyIcon
SetCapture
WaitMessage
PostThreadMessageA
GetKeyNameTextA
MapVirtualKeyA
MessageBeep
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
RegisterDeviceNotificationA
LockWindowUpdate
GetDCEx
UnionRect
SetParent
GetSystemMenu
GetKeyState
IsRectEmpty
SendNotifyMessageA
GetTabbedTextExtentA
CreateMenu
CopyAcceleratorTableA
GetMenuItemCount
GetSubMenu
RemoveMenu
EnumWindows
GetWindowTextA
SendMessageA
CharUpperW
CharUpperA
CharLowerW
CharLowerA
MessageBoxA
UpdateWindow
ReleaseDC
GetDC
GetClientRect
ValidateRect
DialogBoxParamA
LoadStringA
wsprintfA
RedrawWindow
SetCursorPos
DestroyCursor
IsClipboardFormatAvailable
MsgWaitForMultipleObjects
FindWindowA
DrawIcon
SetWindowRgn
InSendMessage
WindowFromDC

gdi32

RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBitmap
CreateCompatibleDC
PtVisible
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
GetDCOrgEx
GetTextMetricsA
CreateFontIndirectA
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateCompatibleBitmap
GetBkColor
GetCharWidthA
CreateFontA
StretchDIBits
GetPixel
StartDocA
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectA
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateDCA
CopyMetaFileA
GetStockObject
GetTextExtentPoint32A
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
GetWindowOrgEx
GetTextFaceA
GetTextAlign
GetTextColor
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetNearestColor
Ellipse
LPtoDP
CreateEllipticRgn
Rectangle
GetViewportOrgEx
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter
GetJobA

advapi32

SetFileSecurityA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
StartServiceA
ControlService
CreateServiceA
SetFileSecurityW
GetFileSecurityW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegSetValueA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetFileSecurityA

shell32

ShellExecuteA
ShellExecuteExA
ExtractIconA
DragQueryFileA
DragFinish
SHGetFileInfoA
SHGetFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
FindExecutableA

shlwapi

PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathRemoveExtensionA
PathFindExtensionA
PathAddBackslashA

ole32

OleRun
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleDuplicateData
CoTaskMemAlloc
CLSIDFromProgID
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleGetClipboard
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
CreateStreamOnHGlobal
OleRegEnumVerbs
OleRegGetMiscStatus
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleSave
WriteClassStm
OleSaveToStream
OleLockRunning
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreate
OleLoad
StgOpenStorageOnILockBytes
GetHGlobalFromILockBytes
OleSetContainedObject
OleCreateFromFile
OleCreateLinkToFile
OleGetIconOfClass
CreateItemMoniker
CreateGenericComposite
OleIsRunning
GetRunningObjectTable
CreateFileMoniker
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateOleAdviseHolder
CreateDataAdviseHolder
OleSetMenuDescriptor
OleQueryCreateFromData
OleQueryLinkFromData
CoUninitialize
CoInitialize
RevokeDragDrop
CoSetProxyBlanket
CoInitializeEx

oleaut32

SysAllocString
VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
LoadTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 476KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mixcrt
Size: 4KB - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9607fffd0767b816d550c66043aac722

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08Certificate

Extended Key Usages

Key Usages

53:be:03:21:f8:1c:ac:34:44:f6:ee:e5:5b:84:9b:54:5e:da:3d:78Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

version

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 476KB - Virtual size: 472KB

.data Size: 64KB - Virtual size: 122KB

.mixcrt Size: 4KB - Virtual size: 1B

.rsrc Size: 232KB - Virtual size: 230KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

53:be:03:21:f8:1c:ac:34:44:f6:ee:e5:5b:84:9b:54:5e:da:3d:78
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 476KB - Virtual size: 472KB

.data
Size: 64KB - Virtual size: 122KB

.mixcrt
Size: 4KB - Virtual size: 1B

.rsrc
Size: 232KB - Virtual size: 230KB