SecuriteInfo[.]com[.]Trojan[.]ALToolbar[.]15506[.]30617[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.ALToolbar.15506.30617.exe
Size

1.7MB
MD5

eb2b01d9e0c2d3b47161a6bb972de79b
SHA1

073c200138b63eeaf28f14f3250d94fa9be4a20b
SHA256

3c16b388b43a56a85026806cc346a20ded144b448ffb512e165746b5143dfb2d
SHA512

e732e5bc791efd262a85187aba19b9473b330f81086efc2f8b3ad97d6ab6c60af236ffbd928bd1bfe8c5c373f9606ff5bc30f4b9a5ffe39ab2009aac13653bb3
SSDEEP

49152:0Vgk+c5iSEKRsHLtdkMw0XFErPHwOVadVrE2CFg96xICQ:Ggzc5i5KRsHLXNb42YgE9Q

Score

1^/10

Malware Config

Signatures

Files

SecuriteInfo.com.Trojan.ALToolbar.15506.30617.exe
.exe windows x86

3643c3ef73d6a41aad5528939e41b2d4

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/02/2022, 00:00

Not After

16/04/2024, 23:59

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/02/2022, 00:00

Not After

16/04/2024, 23:59

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:b6:0d:f7:0a:17:68:00:88:c2:8e:e7:ae:7f:63:12:2b:f1:63:bf:fe:7f:a1:f6:74:de:53:28:24:44:5e:c0
Signer

Actual PE Digest

15:b6:0d:f7:0a:17:68:00:88:c2:8e:e7:ae:7f:63:12:2b:f1:63:bf:fe:7f:a1:f6:74:de:53:28:24:44:5e:c0

Digest Algorithm

sha256

PE Digest Matches

true

fb:1b:de:54:1e:c6:12:f7:2a:43:8b:33:3a:82:18:ee:2c:7f:fd:37
Signer

Actual PE Digest

fb:1b:de:54:1e:c6:12:f7:2a:43:8b:33:3a:82:18:ee:2c:7f:fd:37

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

ioctlsocket

kernel32

GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFullPathNameA
GetFullPathNameW
LockFile
LockFileEx
SetEndOfFile
UnlockFile
QueryPerformanceCounter
InitializeCriticalSection
GetSystemTime
GetSystemTimeAsFileTime
FormatMessageA
LoadLibraryA
GetTempPathA
AreFileApisANSI
GlobalAlloc
GlobalLock
GlobalUnlock
TryEnterCriticalSection
ReleaseSemaphore
ReleaseMutex
CreateMutexW
CreateSemaphoreW
SetThreadPriority
TerminateThread
ResumeThread
GetOEMCP
LoadLibraryExW
lstrcmpiW
lstrlenW
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetCommandLineW
SetLastError
CompareStringW
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
FlushFileBuffers
InterlockedFlushSList
RtlUnwind
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FormatMessageW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
FindFirstFileExA
FindFirstFileExW
DeleteFileA
CreateFileA
GetCurrentThreadId
FindNextFileA
IsValidCodePage
GetCommandLineA
GetEnvironmentStringsW
GetCurrentProcessId
Sleep
GetTickCount
CopyFileW
CreateProcessA
TerminateProcess
WaitForSingleObject
CreatePipe
lstrcmpW
LocalFree
LocalAlloc
VerifyVersionInfoW
GetModuleHandleW
GetVersionExW
GetSystemInfo
GetCurrentProcess
VerSetConditionMask
MulDiv
WriteFile
ReadFile
RaiseException
DecodePointer
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetModuleFileNameW
SetEnvironmentVariableW
SetConsoleCtrlHandler
OutputDebugStringA
SetStdHandle
WriteConsoleW
CloseHandle
GetTempPathW
SetFilePointer
SetFileAttributesW
RemoveDirectoryW
GetFileSize
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
WideCharToMultiByte
GetSystemDirectoryW
GetVolumeInformationW
MultiByteToWideChar
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetLocalTime
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
DeleteFileW
LoadLibraryW
GetProcAddress
FreeLibrary
GetFileAttributesExW
GetTimeZoneInformation

user32

EqualRect
OffsetRect
InflateRect
SetRect
DrawFocusRect
GetSysColor
ScreenToClient
ClientToScreen
LoadImageW
LoadMenuW
DestroyMenu
EnableMenuItem
GetSubMenu
TrackPopupMenu
ScrollWindowEx
SetScrollPos
SetScrollInfo
GetScrollInfo
MonitorFromPoint
SetWindowTextW
RedrawWindow
SetForegroundWindow
UpdateWindow
DrawStateW
GetSystemMetrics
IsWindowEnabled
SetTimer
GetFocus
SetFocus
GetDlgCtrlID
GetDlgItem
CreateDialogParamW
MoveWindow
ShowWindow
GetClassInfoExW
RegisterClassExW
GetClassInfoW
RegisterClassW
PostQuitMessage
DrawEdge
CopyRect
DrawIconEx
DestroyIcon
LoadIconW
LoadBitmapW
CharNextW
GetMessageW
MonitorFromWindow
MapWindowPoints
EndDialog
SystemParametersInfoW
GetWindow
GetWindowThreadProcessId
GetClassNameW
FindWindowExW
FindWindowW
EnumChildWindows
GetDesktopWindow
DestroyWindow
CreateWindowExW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetRectEmpty
CharLowerBuffW
CharUpperBuffW
IsWindow
SendMessageTimeoutW
RegisterWindowMessageW
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromRect
UnionRect
IntersectRect
ReleaseDC
GetDC
MessageBoxW
LoadCursorW
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
FillRect
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
EndPaint
BeginPaint
DrawTextW
GetMenu
ReleaseCapture
SetCapture
GetCapture
IsWindowVisible
SetWindowPos
CallWindowProcW
DefWindowProcW
SendMessageW
UnregisterClassW
KillTimer

gdi32

CreateFontIndirectW
CreatePatternBrush
GetStockObject
LineTo
MoveToEx
SetViewportOrgEx
TextOutW
CreateSolidBrush
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectW
ExtTextOutW
Rectangle
SetBkMode
SetBkColor
SelectObject
DeleteObject
OffsetWindowOrgEx
DeleteDC
CreateCompatibleBitmap
GetDeviceCaps
CreateFontW
CreateCompatibleDC
BitBlt
CreatePen

advapi32

GetFileSecurityW
FreeSid
CopySid
AdjustTokenPrivileges
OpenProcessToken
SetEntriesInAclW
SetSecurityDescriptorDacl
SetFileSecurityW
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
SetSecurityInfo
SetNamedSecurityInfoW
ConvertStringSidToSidW
GetLengthSid
GetSecurityDescriptorDacl
GetTokenInformation
InitializeAcl
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegGetKeySecurity
RegOpenKeyExW
RegQueryInfoKeyW
RegSetKeySecurity
RegSetValueExW

shell32

FindExecutableW
ord165
CommandLineToArgvW
SHGetFileInfoW
ShellExecuteExW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
StringFromCLSID
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysAllocString
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantClear
VarBstrCat
VarBstrCmp
VarUI4FromStr
CreateErrorInfo
GetErrorInfo
VariantInit
SetErrorInfo
VariantChangeType

shlwapi

SHDeleteKeyW

comctl32

ImageList_LoadImageW
ImageList_Draw
ImageList_Destroy
InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize

msimg32

AlphaBlend
TransparentBlt

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

authz

AuthzInitializeResourceManager
AuthzInitializeContextFromToken

wininet

HttpOpenRequestW
InternetSetOptionW
InternetQueryDataAvailable
HttpSendRequestW
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpQueryInfoW
InternetSetCookieW
InternetReadFile

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3643c3ef73d6a41aad5528939e41b2d4

Code Sign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3fCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3fCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

15:b6:0d:f7:0a:17:68:00:88:c2:8e:e7:ae:7f:63:12:2b:f1:63:bf:fe:7f:a1:f6:74:de:53:28:24:44:5e:c0Signer

fb:1b:de:54:1e:c6:12:f7:2a:43:8b:33:3a:82:18:ee:2c:7f:fd:37Signer

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

authz

wininet

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 257KB - Virtual size: 257KB

.data Size: 46KB - Virtual size: 54KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 145KB - Virtual size: 145KB

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:f5:03:34:76:03:fb:03:4b:12:c6:db:62:fe:6c:3f
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

15:b6:0d:f7:0a:17:68:00:88:c2:8e:e7:ae:7f:63:12:2b:f1:63:bf:fe:7f:a1:f6:74:de:53:28:24:44:5e:c0
Signer

fb:1b:de:54:1e:c6:12:f7:2a:43:8b:33:3a:82:18:ee:2c:7f:fd:37
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 257KB - Virtual size: 257KB

.data
Size: 46KB - Virtual size: 54KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 145KB - Virtual size: 145KB