unins001[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

unins001.exe.zip
Size

410KB
MD5

378935a90d53796b8dad55466370da3c
SHA1

cc67c5427a49da3cbcfe5e3e4d54eb865fd766ac
SHA256

461c600e46dec8b218c15399fa82c6fad317ee9d4fa779b8ec3dbbb560530c7a
SHA512

5c93a978ffa054aa62d4096e0d7adeeefae4e307064014db41dbbdf107e3cbd324e451884aece27466236d05028675843da3fca92e77146e625f1ea26602c52d
SSDEEP

6144:+paucXTJn2CoFQZkXZsOQh1HfIot6M6S831oOT/ug7jQESsHzynoV3FeM:+pauZuY+L/fYSYoOCgPhSsHzlVVeM

Score

1^/10

Malware Config

Signatures

Files

unins001.exe.zip
.zip

Password: infected
unins001.exe
.exe windows:1 windows x86

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/08/2016, 00:00

Not After

18/08/2020, 23:59

Subject

CN=DeskShare\, Inc.,O=DeskShare\, Inc.,POSTALCODE=11803,STREET=PO Box 769,L=Plainview,ST=NY,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/08/2016, 00:00

Not After

18/08/2020, 23:59

Subject

CN=DeskShare\, Inc.,O=DeskShare\, Inc.,POSTALCODE=11803,STREET=PO Box 769,L=Plainview,ST=NY,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b2:e9:be:28:f2:ce:c0:52:3b:2c:50:08:84:c2:9e:60:72:5d:d6:5e:d6:32:01:8f:3c:bb:46:f0:28:02:38:98
Signer

Actual PE Digest

b2:e9:be:28:f2:ce:c0:52:3b:2c:50:08:84:c2:9e:60:72:5d:d6:5e:d6:32:01:8f:3c:bb:46:f0:28:02:38:98

Digest Algorithm

sha256

PE Digest Matches

true

fe:6d:07:45:e6:2d:7a:02:e5:21:b2:78:ef:82:c2:2f:f6:4c:6a:56
Signer

Actual PE Digest

fe:6d:07:45:e6:2d:7a:02:e5:21:b2:78:ef:82:c2:2f:f6:4c:6a:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 611KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

b2:e9:be:28:f2:ce:c0:52:3b:2c:50:08:84:c2:9e:60:72:5d:d6:5e:d6:32:01:8f:3c:bb:46:f0:28:02:38:98Signer

fe:6d:07:45:e6:2d:7a:02:e5:21:b2:78:ef:82:c2:2f:f6:4c:6a:56Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 611KB - Virtual size: 611KB

DATA Size: 4KB - Virtual size: 4KB

BSS Size: - Virtual size: 5KB

.idata Size: 10KB - Virtual size: 9KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 34KB

.rsrc Size: 152KB - Virtual size: 152KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:f7:78:13:be:9b:ff:e8:0f:26:36:d5:07:40:d2:79
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

b2:e9:be:28:f2:ce:c0:52:3b:2c:50:08:84:c2:9e:60:72:5d:d6:5e:d6:32:01:8f:3c:bb:46:f0:28:02:38:98
Signer

fe:6d:07:45:e6:2d:7a:02:e5:21:b2:78:ef:82:c2:2f:f6:4c:6a:56
Signer

CODE
Size: 611KB - Virtual size: 611KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 5KB

.idata
Size: 10KB - Virtual size: 9KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 34KB

.rsrc
Size: 152KB - Virtual size: 152KB