e7468363047771e99cf89bdf31e1a1a0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

e7468363047771e99cf89bdf31e1a1a0.bin
Size

5.1MB
MD5

ec76408fe35857d95afca0c6a74a1ce7
SHA1

08404d952a3865167e83a370bab287f1477f0d6d
SHA256

2405c6982bcd9fcd2625ebfce535344457775a707bb7e3f7c325ba1a2b1d4bc5
SHA512

dffb2a7925eebe49f2021bf354b46b885fa8e8ad7de8d51298c5257ebf746e834406bcece37c26b81d02e4e9dae631245bb04b9bc8208be7e97d1d1933a7e167
SSDEEP

98304:j8NL2kI6BbWaJQSfmj6PJedV0QhPfpfYcD8jEcfv8ILAlCq+qMMg+bYtX+ESSdkS:j8/bWaJQSfmj6odV0oxHDUZUIQCq+qMD

Score

1^/10

Malware Config

Signatures

Files

e7468363047771e99cf89bdf31e1a1a0.bin
.zip

Password: infected
973867150fd46e2de4b3d375d9c2d59eeda808a9dd1d137bd020b2f15c155ede.exe
.exe windows:6 windows x86

Password: infected

70c1f94033ff845050d4c215ee60d865

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:db
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/09/2015, 00:00

Not After

01/10/2018, 23:59

Subject

CN=Environmental Systems Research Institute Inc.,O=Environmental Systems Research Institute Inc.,L=Redlands,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:db
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/09/2015, 00:00

Not After

01/10/2018, 23:59

Subject

CN=Environmental Systems Research Institute Inc.,O=Environmental Systems Research Institute Inc.,L=Redlands,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:6d:02:f8:ba:a0:c0:db:85:c0:52:d7:de:92:99:9a:68:d5:d4:4b:78:ec:2d:1e:d1:b2:eb:92:9d:04:9e:48
Signer

Actual PE Digest

4c:6d:02:f8:ba:a0:c0:db:85:c0:52:d7:de:92:99:9a:68:d5:d4:4b:78:ec:2d:1e:d1:b2:eb:92:9d:04:9e:48

Digest Algorithm

sha256

PE Digest Matches

false

35:3e:53:4f:aa:73:f4:cc:3b:c1:3b:26:f4:8e:a6:f7:78:b8:c7:e3
Signer

Actual PE Digest

35:3e:53:4f:aa:73:f4:cc:3b:c1:3b:26:f4:8e:a6:f7:78:b8:c7:e3

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetWindowRect
CharUpperBuffW

gdi32

CreateCompatibleBitmap

advapi32

SystemFunction036

shell32

SHGetFolderPathA

ole32

CoUninitialize

ws2_32

WSACleanup

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdipSaveImageToFile

setupapi

SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString

Sections

.text
Size: - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp_0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp_1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp_2
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

70c1f94033ff845050d4c215ee60d865

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:dbCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:dbCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

4c:6d:02:f8:ba:a0:c0:db:85:c0:52:d7:de:92:99:9a:68:d5:d4:4b:78:ec:2d:1e:d1:b2:eb:92:9d:04:9e:48Signer

35:3e:53:4f:aa:73:f4:cc:3b:c1:3b:26:f4:8e:a6:f7:78:b8:c7:e3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

crypt32

shlwapi

gdiplus

setupapi

ntdll

Sections

.text Size: - Virtual size: 1005KB

.rdata Size: - Virtual size: 200KB

.data Size: - Virtual size: 13KB

.vmp_0 Size: - Virtual size: 2.8MB

.vmp_1 Size: 2KB - Virtual size: 1KB

.vmp_2 Size: 5.2MB - Virtual size: 5.2MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 148KB - Virtual size: 147KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:db
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2b:a7:21:42:24:82:95:02:08:d9:a1:7e:99:e1:98:db
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

4c:6d:02:f8:ba:a0:c0:db:85:c0:52:d7:de:92:99:9a:68:d5:d4:4b:78:ec:2d:1e:d1:b2:eb:92:9d:04:9e:48
Signer

35:3e:53:4f:aa:73:f4:cc:3b:c1:3b:26:f4:8e:a6:f7:78:b8:c7:e3
Signer

.text
Size: - Virtual size: 1005KB

.rdata
Size: - Virtual size: 200KB

.data
Size: - Virtual size: 13KB

.vmp_0
Size: - Virtual size: 2.8MB

.vmp_1
Size: 2KB - Virtual size: 1KB

.vmp_2
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 148KB - Virtual size: 147KB