DW20[.]EXE | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DW20.EXE
Size

794KB
MD5

c6d0721e9156eb2a40a04bb38be0b2a5
SHA1

d0a3fcb3ad9f227a02d30abb767883b42fecc3a7
SHA256

2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
SHA512

e254db10a7cffc4fe8c2d126dc4eb5029a84b2a931a67ad9ebfd04a8f3417e42a7dfb2e76d8911b2540bcf9eff9cbf92708b158dd8f53dbcbe7be51682ac3ad4
SSDEEP

24576:F3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJE4VDd+:FbutmkO+wAOInO4XrztygxLHkJE4VB

Score

1^/10

Malware Config

Signatures

Files

DW20.EXE
.exe windows:4 windows x86

5eb440625c49d1fc181879d5ddcfbd20

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a8:43:7e:4e:bc:81:e3:0d:bd:bc:0e:7a:af:26:8c:78:7e:05:f5:1e
Signer

Actual PE Digest

a8:43:7e:4e:bc:81:e3:0d:bd:bc:0e:7a:af:26:8c:78:7e:05:f5:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW

secur32

GetUserNameExW

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_vsnprintf_s
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
fopen_s
fwprintf_s
fclose
vsprintf_s
wcscpy_s
vswprintf_s
wcsrchr
_wtoi
_CxxThrowException
_vsnprintf
__CxxFrameHandler3
_CIsqrt
memmove
_wcsnicmp
tolower
strncmp
ceil
strchr
strncpy_s
_strnicmp
wcsncmp
_stricmp
wcstok_s
swprintf_s
_wcsicmp
memset
memcpy
wcschr
_time32

advapi32

GetSecurityDescriptorDacl
RegQueryInfoKeyW
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
GetUserNameA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
SetNamedSecurityInfoW
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCreateKeyExA
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyW
RegEnumValueW
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
OpenThreadToken
IsValidSid
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
GetTokenInformation

comctl32

ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ord17

gdi32

DeleteDC
RestoreDC
DeleteObject
GetTextFaceA
SelectObject
CreateFontA
GetDeviceCaps
SetMapMode
SaveDC
CreateFontIndirectW
GetObjectW
GetTextExtentPoint32W
SetTextAlign
GetTextMetricsA
GetObjectA
ExtTextOutW
SetBkMode
SetTextColor
GetTextFaceW
GetOutlineTextMetricsA
CreateDCA
CreateSolidBrush
TranslateCharsetInfo
CreateFontIndirectA

kernel32

OpenSemaphoreA
CreateEventA
OpenEventA
GetShortPathNameA
LoadLibraryW
OutputDebugStringA
LoadLibraryExW
LocalAlloc
GlobalFree
GetCurrentThreadId
CreateProcessA
GlobalAlloc
DuplicateHandle
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
GetUserDefaultLCID
IsValidLocale
GetStringTypeExW
IsValidCodePage
CompareStringW
GetShortPathNameW
GetLongPathNameW
CreateFileA
GetCurrentThread
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
EnumSystemLocalesW
GetCalendarInfoW
GetUserDefaultUILanguage
VirtualProtect
QueryPerformanceCounter
GetTempFileNameA
GetTempPathA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
lstrcmpiW
GetThreadContext
GetThreadTimes
GetPriorityClass
HeapDestroy
HeapCreate
TerminateThread
GetThreadSelectorEntry
GetLastError
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
MapViewOfFile
ReleaseMutex
WaitForSingleObject
WaitForMultipleObjects
SetProcessWorkingSetSize
GetCurrentProcess
Sleep
TerminateProcess
DeleteFileW
CreateThread
CloseHandle
GetCurrentProcessId
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
GetVersionExW
GetVersionExA
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
GetTickCount
SetLastError
LocalFree
WriteFile
FindNextFileW
FindClose
FindFirstFileW
GetSystemWindowsDirectoryW
MoveFileW
SetFilePointer
GetComputerNameA
SetPriorityClass
UnmapViewOfFile
GetFileSize
CreateFileMappingA
SuspendThread
ExitThread
MulDiv
GetModuleFileNameA
LoadLibraryA
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetUserDefaultLangID
GetACP
GetSystemDefaultLCID
SetEvent
CreateProcessW
ExpandEnvironmentStringsW
WideCharToMultiByte
GetTempPathW
GetFileAttributesW
SetEndOfFile
IsDBCSLeadByte
GetSystemDirectoryA
SetThreadPriority
CreateRemoteThread
OpenProcess
LoadLibraryExA
SetEnvironmentVariableA
CreateDirectoryW
ReadProcessMemory
VirtualQueryEx
GetSystemInfo
HeapFree
HeapSize
HeapValidate
HeapAlloc
HeapReAlloc
VirtualAlloc
RaiseException
TlsSetValue
SetFileAttributesW
CreateSemaphoreA
FlushFileBuffers
ResumeThread
InitializeCriticalSectionAndSpinCount
TlsAlloc
VirtualFree
TlsGetValue
TlsFree
GetModuleHandleW
GetVersion
GetFileType
CreateFileW
GetLocaleInfoW
GetProcessTimes
CreateMutexA
OpenMutexA
GetThreadPriority

ole32

StringFromIID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance

oleacc

CreateStdAccessibleObject
LresultFromObject

oleaut32

SysFreeString
SystemTimeToVariantTime
VariantTimeToDosDateTime
SysAllocString
SysStringLen

rpcrt4

UuidCreate

shell32

ExtractIconExA
SHGetSpecialFolderPathW
ShellExecuteExA

shlwapi

AssocQueryStringW
UrlGetPartA
wnsprintfA

urlmon

CreateURLMoniker

user32

GetDlgCtrlID
IsWindow
CreateDialogIndirectParamA
DrawTextA
DrawTextW
MapDialogRect
CallWindowProcA
MoveWindow
GetKeyboardLayout
GetMenuCheckMarkDimensions
LoadBitmapA
GetMonitorInfoA
CallWindowProcW
SetRectEmpty
IsWindowVisible
PostMessageA
SendMessageA
DefWindowProcA
SetTimer
KillTimer
PostQuitMessage
DispatchMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
CreateWindowExA
RegisterClassExA
DialogBoxParamA
SystemParametersInfoA
DestroyIcon
LoadStringW
DestroyWindow
SetWindowPos
GetWindowRect
GetWindowLongA
SetForegroundWindow
GetSystemMetrics
LoadIconA
SetWindowLongA
ReleaseDC
FillRect
GetSysColorBrush
MapWindowPoints
GetDC
SetWindowTextA
CreateDialogParamW
DialogBoxParamW
EnumDisplayMonitors
GetDlgItem
DrawIconEx
ShowWindow
LoadCursorA
GetClientRect
SetCursor
DrawFocusRect
SetWindowTextW
GetWindow
InvalidateRect
EnableWindow
GetSysColor
SendDlgItemMessageA
EndDialog
CheckDlgButton
SetFocus
LoadStringA
IsDlgButtonChecked
SetDlgItemTextA
GetScrollInfo
SetScrollInfo
GetFocus
FlashWindowEx
GetForegroundWindow
GetWindowPlacement
IsIconic
GetWindowThreadProcessId
EnumWindows
SendMessageTimeoutA
GetParent
UpdateWindow
IsWindowUnicode
GetClassNameA
SendMessageW
GetWindowLongW

wininet

InternetGetConnectedState
InternetCloseHandle
HttpQueryInfoA
InternetReadFileExA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetCanonicalizeUrlA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetSetStatusCallback
InternetCrackUrlA

Sections

.text
Size: 551KB - Virtual size: 551KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5eb440625c49d1fc181879d5ddcfbd20

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

a8:43:7e:4e:bc:81:e3:0d:bd:bc:0e:7a:af:26:8c:78:7e:05:f5:1eSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

secur32

msvcr80

advapi32

comctl32

gdi32

kernel32

ole32

oleacc

oleaut32

rpcrt4

shell32

shlwapi

urlmon

user32

wininet

Sections

.text Size: 551KB - Virtual size: 551KB

.data Size: 199KB - Virtual size: 271KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 21KB - Virtual size: 21KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

a8:43:7e:4e:bc:81:e3:0d:bd:bc:0e:7a:af:26:8c:78:7e:05:f5:1e
Signer

.text
Size: 551KB - Virtual size: 551KB

.data
Size: 199KB - Virtual size: 271KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 21KB - Virtual size: 21KB