558cb49d199e5c7e1e59f88ff4401800_exe32[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

558cb49d199e5c7e1e59f88ff4401800_exe32.exe
Size

295KB
MD5

558cb49d199e5c7e1e59f88ff4401800
SHA1

6463dad0a3fed48655744f2ac980676bae383131
SHA256

44573b3b36cecb457bdbbd67d8a6d5d7d4b2d83d4a8fd268648337228dd0ad84
SHA512

18f975b743b6be144ccf59378115a10a4f680ef7603121c32f4bcf40935ce36295e9fffd29b4a7588f2f8387933e1a4248bf8c7dbffb8390d5f2a17cd3c28371
SSDEEP

6144:5Q6bpky+QWK+ZAfSLyQfhUR252DuQaXDln6VQkM5qQw2q1n4OVWIiiUeh:5Q6b2yxqySLyQfhE42OaQk0pq51

Score

1^/10

Malware Config

Signatures

Files

558cb49d199e5c7e1e59f88ff4401800_exe32.exe
.exe windows:4 windows x86

a18c63888b499645f58e31586304d7d1

Code Sign

68:f3:8b:49:01:4f:e4:5d:fc:bf:07:82:2d:21:c4:bc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/11/2010, 00:00

Not After

31/10/2013, 23:59

Subject

CN=Smart Move Software Systems Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Smart Move Software Systems Limited,L=Road Town,ST=Road Town,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:75:d0:9a:6f:28:6b:cc:cf:7f:b3:20:ef:84:b5:84:69:e2:b2:bc
Signer

Actual PE Digest

61:75:d0:9a:6f:28:6b:cc:cf:7f:b3:20:ef:84:b5:84:69:e2:b2:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

send
select
connect
__WSAFDIsSet
shutdown
closesocket
recv
WSAStartup
socket
gethostbyname
WSAGetLastError
htons

wininet

InternetOpenUrlA
InternetQueryDataAvailable
InternetCloseHandle
InternetSetFilePointer
InternetOpenA
InternetReadFile
HttpQueryInfoA

kernel32

FormatMessageA
GetProcAddress
LoadLibraryA
WritePrivateProfileStringA
GetSystemTime
LockResource
LoadResource
SizeofResource
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
HeapCreate
GetVersionExA
GetEnvironmentVariableA
IsBadWritePtr
VirtualAlloc
VirtualFree
GetOEMCP
GetACP
GetCPInfo
SetLastError
LocalFree
TlsAlloc
HeapSize
TerminateProcess
GetSystemTimeAsFileTime
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
RaiseException
ExitThread
TlsGetValue
TlsSetValue
CreateThread
GetLocalTime
GetTimeZoneInformation
HeapFree
HeapAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
GetVolumeInformationA
ExpandEnvironmentStringsA
GetPrivateProfileStringA
GetModuleFileNameA
MultiByteToWideChar
MulDiv
CreateDirectoryA
GetLastError
DeleteFileA
CreateFileA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileSize
CloseHandle
SetFilePointer
WriteFile
SetEndOfFile
MoveFileA
WaitForMultipleObjects
Sleep
lstrcpyA
lstrcpynA
FindResourceA
FreeEnvironmentStringsA
GetCurrentProcess
FlushInstructionCache
OutputDebugStringA
DebugBreak
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
lstrcmpiA
GetTempPathA
lstrlenA
SetHandleCount
GetStdHandle
GetFileType
ReadFile
FlushFileBuffers
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA

user32

SendDlgItemMessageA
MessageBeep
SetFocus
wsprintfA
GetDC
ReleaseDC
RedrawWindow
DrawTextA
GetWindowTextLengthA
GetWindowTextA
CopyRect
OffsetRect
ScreenToClient
ChildWindowFromPointEx
FlashWindow
IsIconic
IsWindowVisible
SetActiveWindow
PostQuitMessage
MapWindowPoints
LoadMenuA
LoadImageA
SetWindowTextA
GetDlgItem
GetSysColor
GetSysColorBrush
GetMenu
AdjustWindowRectEx
CreateWindowExA
GetWindowLongA
GetDesktopWindow
SetDlgItemTextA
GetDlgItemTextA
EnableWindow
SetWindowLongA
KillTimer
ClientToScreen
GetWindowRect
PtInRect
GetDlgCtrlID
GetParent
ReleaseCapture
SetCapture
GetCapture
SystemParametersInfoA
SetTimer
IsWindowEnabled
DrawEdge
GetSystemMetrics
InflateRect
DrawFocusRect
EndPaint
GetClientRect
FillRect
BeginPaint
IsWindow
CallWindowProcA
CreateDialogParamA
InvalidateRect
UpdateWindow
LoadStringA
CharNextA
wvsprintfA
DestroyWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
DefWindowProcA
SetWindowPos
IsMenu
GetSubMenu
GetMenuItemCount
SetMenuDefaultItem
SendMessageA
EnableMenuItem
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageA
ShowWindow
IsDialogMessageA
RegisterWindowMessageA
DestroyIcon
DestroyMenu
GetWindow

gdi32

EndPath
BeginPath
RestoreDC
TextOutA
GetBkColor
SaveDC
GetTextMetricsA
CreateDIBitmap
CreateDIBSection
StrokeAndFillPath
MoveToEx
LineTo
ExtTextOutA
GetDeviceCaps
DeleteObject
GetStockObject
SetTextColor
SetBkMode
SetBkColor
CreateSolidBrush
DeleteDC
BitBlt
GetObjectA
SelectObject
CreateFontIndirectA
CreateCompatibleDC

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegCreateKeyExA
RegQueryValueExA

shell32

SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
Shell_NotifyIconA
SHGetSpecialFolderLocation

ole32

CoInitialize
CoCreateInstance
CoUninitialize

comctl32

InitCommonControlsEx
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
_TrackMouseEvent
ImageList_Create
ImageList_Destroy
ImageList_Add

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a18c63888b499645f58e31586304d7d1

Code Sign

68:f3:8b:49:01:4f:e4:5d:fc:bf:07:82:2d:21:c4:bcCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

61:75:d0:9a:6f:28:6b:cc:cf:7f:b3:20:ef:84:b5:84:69:e2:b2:bcSigner

Headers

File Characteristics

Imports

ws2_32

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

Sections

.text Size: 148KB - Virtual size: 147KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 32KB - Virtual size: 41KB

.rsrc Size: 88KB - Virtual size: 84KB

68:f3:8b:49:01:4f:e4:5d:fc:bf:07:82:2d:21:c4:bc
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

61:75:d0:9a:6f:28:6b:cc:cf:7f:b3:20:ef:84:b5:84:69:e2:b2:bc
Signer

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 32KB - Virtual size: 41KB

.rsrc
Size: 88KB - Virtual size: 84KB