79fe41661165fa6a8ab41d0d1a68bb837dc484ee1c564ec11ecc1e3a8faaf038[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

79fe41661165fa6a8ab41d0d1a68bb837dc484ee1c564ec11ecc1e3a8faaf038.exe.zip
Size

1.5MB
MD5

549d5a951d624613352796e93501d007
SHA1

4bc3d6365a531a75b6fba715973bdbf9c99f982d
SHA256

f0418665cc32b5f8ebecd9d2c931d47b6dfe8208752e53d51d545359c16db30c
SHA512

2ac2e68920bc4cbdfacc417d57bd1666fe51a7c88ae2f6a3808faf88219b76437a03487ea99a9549fe686c00858fb2ceac9bb58869099ce8d6a50a92da40c6bf
SSDEEP

49152:eDFCOjMfcnzJ5WoRnINbWVbftHKzmdyWrLL:eDFCQMfcDWoRn7hfJKSyWrLL

Score

1^/10

Malware Config

Signatures

Files

79fe41661165fa6a8ab41d0d1a68bb837dc484ee1c564ec11ecc1e3a8faaf038.exe.zip
.zip

Password: infected
79fe41661165fa6a8ab41d0d1a68bb837dc484ee1c564ec11ecc1e3a8faaf038.exe
.exe windows:5 windows x64

d1ac3d9353e3363e4fe87827ec706ba4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:d3:e3:cf:8c:c5:54:62:95:d1:69:6f:43:ce:f8:ba:42
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

17/09/2012, 12:59

Not After

17/12/2015, 12:59

Subject

CN=SOFTPERFECT PTY. LTD.,O=SOFTPERFECT PTY. LTD.,L=KENSINGTON PARK,ST=SOUTH AUSTRALIA,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:83:59:94:7f:f0:17:ff:3d:f4:39:e1:43:4f:f7:45:ed:b1:14:0a
Signer

Actual PE Digest

14:83:59:94:7f:f0:17:ff:3d:f4:39:e1:43:4f:f7:45:ed:b1:14:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

oleaut32

SysFreeString

advapi32

RegCloseKey

user32

CharNextW

gdi32

Pie

version

VerQueryValueW

mpr

WNetAddConnection2W

ole32

DoDragDrop

comctl32

ImageList_Add

msvcrt

strchr

ws2_32

WSAIoctl

shell32

ShellExecuteW

wininet

InternetOpenA

urlmon

URLOpenBlockingStreamW

comdlg32

ChooseColorW

winspool.drv

OpenPrinterW

shlwapi

PathIsURLW

wsock32

send

iphlpapi

SendARP

oleacc

LresultFromObject

winmm

timeGetTime

netapi32

NetUserEnum

snmpapi

SnmpUtilOidToA

mgmtapi

SnmpMgrOpen

pdh

PdhCloseLog

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.MPRESS1
Size: 1.5MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

d1ac3d9353e3363e4fe87827ec706ba4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:d3:e3:cf:8c:c5:54:62:95:d1:69:6f:43:ce:f8:ba:42Certificate

Extended Key Usages

Key Usages

14:83:59:94:7f:f0:17:ff:3d:f4:39:e1:43:4f:f7:45:ed:b1:14:0aSigner

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

gdi32

version

mpr

ole32

comctl32

msvcrt

ws2_32

shell32

wininet

urlmon

comdlg32

winspool.drv

shlwapi

wsock32

iphlpapi

oleacc

winmm

netapi32

snmpapi

mgmtapi

pdh

Exports

Exports

Sections

.MPRESS1 Size: 1.5MB - Virtual size: 7.2MB

.MPRESS2 Size: 6KB - Virtual size: 5KB

.rsrc Size: 39KB - Virtual size: 39KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:d3:e3:cf:8c:c5:54:62:95:d1:69:6f:43:ce:f8:ba:42
Certificate

14:83:59:94:7f:f0:17:ff:3d:f4:39:e1:43:4f:f7:45:ed:b1:14:0a
Signer

.MPRESS1
Size: 1.5MB - Virtual size: 7.2MB

.MPRESS2
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 39KB - Virtual size: 39KB