Kaspersky[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Kaspersky.exe
Size

2.6MB
MD5

0467201ff1aae37c80eb2bf52b541b6b
SHA1

57f5344de3308df34ab8cb7a889ff05a64cc073d
SHA256

8d1910480aff8d306b3e568b72bd0951bffec4cc86f37a9ab3a6ec1291b4d4fa
SHA512

85b54dd6ce4b6bd1043c897d0498c5ad0cef5a7b915a578d383bed393bcaa296dd5d98c5ecaaae00440f09ce5d62261ee06824cfe420c05650f905359d8be1e4
SSDEEP

49152:SX+4sQ/nN9T8JAGqyx4i8aQEWy1kexnGS4dWGeWyA/0:i+zQnNoqyXbWeGS1UyAM

Score

1^/10

Malware Config

Signatures

Files

Kaspersky.exe
.exe windows:4 windows x86

3cf660ed4cdd32c7869fe11a5e560451

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04-02-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-01-2016 00:00

Not After

28-03-2019 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:52:fd:d9:d2:29:2a:43:12:76:cd:e1:63:89:63:9b:d0:c8:60:a0:7a:52:49:83:20:48:15:a3:78:89:26:71
Signer

Actual PE Digest

c0:52:fd:d9:d2:29:2a:43:12:76:cd:e1:63:89:63:9b:d0:c8:60:a0:7a:52:49:83:20:48:15:a3:78:89:26:71

Digest Algorithm

sha256

PE Digest Matches

true

0d:29:08:bd:f5:d6:a2:73:f0:c7:c5:94:c3:75:46:36:e6:98:dd:77
Signer

Actual PE Digest

0d:29:08:bd:f5:d6:a2:73:f0:c7:c5:94:c3:75:46:36:e6:98:dd:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htonl
htons

kernel32

SetLastError
RemoveDirectoryW
CreateProcessW
GetCPInfo
OpenFileMappingW
UnmapViewOfFile
CreatePipe
GetStartupInfoW
GetSystemTimeAsFileTime
MapViewOfFile
ResetEvent
InterlockedCompareExchange
GetACP
GetSystemInfo
CreateDirectoryW
GetSystemDefaultLangID
LoadLibraryA
WaitForMultipleObjects
DuplicateHandle
InitializeCriticalSectionAndSpinCount
HeapAlloc
GetProcessHeap
HeapFree
GetModuleFileNameA
TerminateProcess
IsDebuggerPresent
CreateIoCompletionPort
TlsGetValue
TlsFree
PostQueuedCompletionStatus
TlsAlloc
GetQueuedCompletionStatus
TlsSetValue
CreateEventW
VirtualAlloc
ExitThread
CreateThread
GetVersionExA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
CreateMutexW
GetModuleHandleA
ExitProcess
GetOEMCP
IsValidCodePage
HeapSize
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetVersion
FreeResource
LeaveCriticalSection
GetVersionExW
InterlockedDecrement
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
InterlockedIncrement
InterlockedExchangeAdd
WideCharToMultiByte
lstrlenW
GetTickCount
GetFileAttributesExW
MultiByteToWideChar
SetFilePointer
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetLocalTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SetEndOfFile
lstrlenA
WriteFile
CreateFileW
CloseHandle
InterlockedExchange
MoveFileW
OutputDebugStringW
DeleteFileW
GetCurrentThreadId
FreeLibrary
LoadResource
LockResource
SizeofResource
GetLastError
GetProcAddress
FindResourceW
LoadLibraryW
GetModuleFileNameW
FindResourceExW
GetThreadLocale
IsProcessorFeaturePresent
GetTempFileNameW
GlobalLock
UnhandledExceptionFilter
RaiseException
FlushInstructionCache
GetCommandLineW
lstrcmpiW
GetTempPathW
LoadLibraryExW
SetDllDirectoryW
GetFileAttributesW
GetSystemDirectoryW
GetModuleHandleW
Sleep
GetCurrentProcess
GetCurrentProcessId
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsW
GetFileSize
CopyFileW
ReadFile
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetStringTypeW
SetEvent
SetUnhandledExceptionFilter
HeapReAlloc
OpenEventW

user32

PostThreadMessageW
DrawFrameControl
DrawTextW
PtInRect
TrackPopupMenu
LoadImageW
GetDlgCtrlID
EqualRect
GetSysColor
GetWindowTextLengthW
SetTimer
SetCursor
ReleaseCapture
IsWindowVisible
DrawIconEx
SetCapture
EndPaint
LoadIconW
BeginPaint
GetSystemMenu
SetWindowTextW
DestroyIcon
TranslateMessage
GetWindowLongW
CreateWindowExW
SystemParametersInfoW
GetMessageW
MapWindowPoints
RegisterClassExW
GetWindowTextW
IsWindowEnabled
OffsetRect
LoadCursorW
GetFocus
SendMessageTimeoutW
GetSystemMetrics
FindWindowA
MsgWaitForMultipleObjectsEx
PostQuitMessage
InflateRect
GetClassInfoExW
GetDesktopWindow
SetRect
SendMessageW
FillRect
GetWindow
GetDlgItem
CopyRect
ClientToScreen
SetWindowRgn
InvalidateRect
GetClientRect
GetWindowRect
SetWindowPos
ShowWindow
EnableWindow
DestroyWindow
GetKeyState
FrameRect
PostMessageW
IsWindow
CallWindowProcW
SetWindowLongW
DefWindowProcW
CharNextW
SetActiveWindow
SetForegroundWindow
GetWindowDC
FindWindowW
GetMonitorInfoW
ReleaseDC
MonitorFromWindow
GetActiveWindow
GetQueueStatus
WaitMessage
UnregisterClassW
MoveWindow
GetDC
ExitWindowsEx
GetParent
MessageBoxW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
UnregisterClassA
CopyImage
LoadStringW
KillTimer

gdi32

MoveToEx
SetBkMode
RectInRegion
GetTextExtentPoint32W
TextOutW
RoundRect
SelectClipRgn
GetClipRgn
RestoreDC
SaveDC
Rectangle
GetTextMetricsW
OffsetRgn
SetRectRgn
ExtSelectClipRgn
CreateRectRgnIndirect
DeleteObject
LineTo
CreateBitmap
CreateCompatibleDC
CombineRgn
CreateDIBSection
CreateRectRgn
StretchBlt
CreatePen
DeleteDC
ExtTextOutW
CreateSolidBrush
SetBkColor
SelectObject
CreateFontIndirectW
CreateCompatibleBitmap
BitBlt
GetObjectW
GetStockObject
SetTextColor
GetCurrentObject

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CloseServiceHandle
CreateServiceW
RegQueryInfoKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyW
RegDeleteKeyW
OpenProcessToken
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
OpenSCManagerW

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW
PathRemoveFileSpecW
StrToIntA
PathAppendW
PathAddBackslashW

comctl32

_TrackMouseEvent

gdiplus

GdipCreateFromHDC
GdipGetImageHeight
GdiplusShutdown
GdipGetImageWidth
GdipDeleteGraphics
GdipFree
GdipDisposeImage
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateHBITMAPFromBitmap
GdipAlloc
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipDrawImageI
GdipCloneImage
GdipCreateBitmapFromStream
GdipLoadImageFromStream
GdiplusStartup

wininet

InternetGetConnectedState
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
HttpQueryInfoW
InternetReadFile

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cf660ed4cdd32c7869fe11a5e560451

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

c0:52:fd:d9:d2:29:2a:43:12:76:cd:e1:63:89:63:9b:d0:c8:60:a0:7a:52:49:83:20:48:15:a3:78:89:26:71Signer

0d:29:08:bd:f5:d6:a2:73:f0:c7:c5:94:c3:75:46:36:e6:98:dd:77Signer

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

Sections

.text Size: 388KB - Virtual size: 387KB

.rdata Size: 124KB - Virtual size: 124KB

.data Size: 20KB - Virtual size: 28KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

c0:52:fd:d9:d2:29:2a:43:12:76:cd:e1:63:89:63:9b:d0:c8:60:a0:7a:52:49:83:20:48:15:a3:78:89:26:71
Signer

0d:29:08:bd:f5:d6:a2:73:f0:c7:c5:94:c3:75:46:36:e6:98:dd:77
Signer

.text
Size: 388KB - Virtual size: 387KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 20KB - Virtual size: 28KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB