tvalue5-32-s-web[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

tvalue5-32-s-web.exe
Size

9.4MB
MD5

f71ca9cb7ed32c860511372ad91ade5a
SHA1

67c69a668d6b5e2c2807a49a6eedfacbe9f60226
SHA256

eca828455222d63896c5462e5afb79cf36f616a58f4a1872b9cf4d0884b0999e
SHA512

c9cb59854484b92e2895ef11936d64443d2687e320db1e3998c51129418777b4a7045bdcb15a3453bad0a8f08fff827b02daf3cc9b83c08c753ad473a74e1ac3
SSDEEP

196608:LhT/ujMe6ds8fy1SCadAy/pFPuunO5IKD6CVLowsvyy:LAuv2JA9Duq+Ryyy

Score

1^/10

Malware Config

Signatures

Files

tvalue5-32-s-web.exe
.exe windows x86

a604c6ea79d5ea984febff3382a81f77

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-11-2014 00:00

Not After

22-01-2018 23:59

Subject

CN=TimeValue Software,O=TimeValue Software,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24-11-2014 00:00

Not After

22-01-2018 23:59

Subject

CN=TimeValue Software,O=TimeValue Software,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:2c:5c:9d:0a:04:77:52:ea:a6:d8:3c:15:33:ef:be:7c:25:8d:ab:64:63:4a:fb:9f:6d:d8:6d:33:06:84:39
Signer

Actual PE Digest

4c:2c:5c:9d:0a:04:77:52:ea:a6:d8:3c:15:33:ef:be:7c:25:8d:ab:64:63:4a:fb:9f:6d:d8:6d:33:06:84:39

Digest Algorithm

sha256

PE Digest Matches

true

dd:c7:25:4f:3c:2c:4d:36:04:59:d2:f7:59:1e:d8:e0:cd:3d:d0:ed
Signer

Actual PE Digest

dd:c7:25:4f:3c:2c:4d:36:04:59:d2:f7:59:1e:d8:e0:cd:3d:d0:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCommandLineA
CloseHandle
UnmapViewOfFile
WriteFile
MapViewOfFile
CreateFileMappingA
GetTempFileNameA
GetTempPathA
CreateFileA
GetShortPathNameA
GetModuleFileNameA

user32

wsprintfA

Sections

.text
Size: 1024B - Virtual size: 521B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 597B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9.4MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a604c6ea79d5ea984febff3382a81f77

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

4c:2c:5c:9d:0a:04:77:52:ea:a6:d8:3c:15:33:ef:be:7c:25:8d:ab:64:63:4a:fb:9f:6d:d8:6d:33:06:84:39Signer

dd:c7:25:4f:3c:2c:4d:36:04:59:d2:f7:59:1e:d8:e0:cd:3d:d0:edSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 1024B - Virtual size: 521B

.rdata Size: 1024B - Virtual size: 597B

.rsrc Size: 9.4MB - Virtual size: 9.4MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

27:f6:ae:f9:b7:30:8d:67:a0:5f:b4:b1:d3:0d:23:56
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

4c:2c:5c:9d:0a:04:77:52:ea:a6:d8:3c:15:33:ef:be:7c:25:8d:ab:64:63:4a:fb:9f:6d:d8:6d:33:06:84:39
Signer

dd:c7:25:4f:3c:2c:4d:36:04:59:d2:f7:59:1e:d8:e0:cd:3d:d0:ed
Signer

.text
Size: 1024B - Virtual size: 521B

.rdata
Size: 1024B - Virtual size: 597B

.rsrc
Size: 9.4MB - Virtual size: 9.4MB