euw2[.]14[.]20a-updater[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

euw2.14.20a-updater.exe
Size

95.4MB
MD5

e0a0aea595c939088af2cfe92a5f72cc
SHA1

f39289830ae1a3ef9c08ce972a2d5886da9a84c7
SHA256

c792434dbb5d0840b1d76529fc420465136c0467a8eaddfb5156f73580900d28
SHA512

8873da9dc927721409038c3f20516e78d6ef0250c6660fea14444491e502560e6de21974c6d44b03e53a99b9fcc988b07e69923f32b50365105e19aa6d89ecd7
SSDEEP

1572864:2JCIIKvdWsa+pN12zWOIIK/YqAxSZxx9fgD8zER6137rh4HsYVzXTXXgWHef51MM:2xIKvdWsl8W7YHxG5C8X1Ph+sYVTLXHq

Score

1^/10

Malware Config

Signatures

Files

euw2.14.20a-updater.exe
.exe windows:4 windows x86

f9cb3e5398c191fa1d92b0ce18e7e642

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a3:76:3b:ac:7a:99:5d:c1:80:d3:cf:1d:b8:78:39
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/06/2015, 00:00

Not After

21/07/2016, 23:59

Subject

CN=Canon Inc.,OU=ICP Network Strategy Planning,O=Canon Inc.,L=Ohta-ku,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a3:de:18:87:ac:18:28:70:6d:37:ea:b7:71:58:a5:38:47:8b:4c:31
Signer

Actual PE Digest

a3:de:18:87:ac:18:28:70:6d:37:ea:b7:71:58:a5:38:47:8b:4c:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

kernel32

InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
GetThreadLocale
FileTimeToSystemTime
WritePrivateProfileStringW
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetFullPathNameW
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetFileType
GetConsoleCP
GlobalHandle
RaiseException
RtlUnwind
HeapReAlloc
ExitProcess
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
Sleep
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEnvironmentVariableA
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetModuleHandleA
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
CompareStringA
InterlockedExchange
FormatMessageW
LocalFree
GlobalAlloc
MulDiv
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalFree
SetLastError
ReleaseMutex
CreateMutexW
MultiByteToWideChar
GetLastError
InterlockedDecrement
FreeResource
WriteFile
ReadFile
GetFileSize
lstrlenA
GetFileTime
IsDBCSLeadByte
CreateDirectoryW
CreateFileW
lstrlenW
WideCharToMultiByte
FileTimeToLocalFileTime
CreateFileA
FreeLibrary
LoadLibraryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetVolumeInformationW
GetDriveTypeW
GetLogicalDrives
SetErrorMode
GetVersionExW
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
GetTempPathW
CloseHandle
WaitForSingleObject
OpenThread
GlobalUnlock
GlobalLock
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
FindResourceW
LoadResource
LockResource
SizeofResource
GetConsoleMode

user32

PostThreadMessageW
LoadCursorW
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetWindowThreadProcessId
SetCursor
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetDC
ReleaseDC
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
RegisterClipboardFormatW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
DestroyMenu
GetMessagePos
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
UnregisterClassW
CharUpperW
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
SystemParametersInfoA
GetWindowPlacement
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
GetCapture
GetWindowRect
GetWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
CharPrevW
GetDesktopWindow
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
LoadIconW
PeekMessageW
PostMessageW
SendMessageW
EnableWindow
UnhookWindowsHookEx
MessageBoxW
SetWindowsHookExW
CallNextHookEx
SetDlgItemTextW
RegisterWindowMessageW
GetMessageTime
UnregisterClassA

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
ScaleViewportExtEx
GetWindowExtEx
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
GetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
SetMapMode
RestoreDC
SaveDC
CreateRectRgnIndirect
GetStockObject
GetDeviceCaps
SelectObject
DeleteObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHFileOperationW
ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleFlushClipboard
CoFreeUnusedLibraries
CoTaskMemFree
OleRun
CoUninitialize
CoInitialize
CoCreateInstance
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
CoTaskMemAlloc
CoRegisterMessageFilter

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysStringLen
VariantChangeType
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95.0MB - Virtual size: 95.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9cb3e5398c191fa1d92b0ce18e7e642

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0f:a3:76:3b:ac:7a:99:5d:c1:80:d3:cf:1d:b8:78:39Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

a3:de:18:87:ac:18:28:70:6d:37:ea:b7:71:58:a5:38:47:8b:4c:31Signer

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 288KB - Virtual size: 287KB

.rdata Size: 72KB - Virtual size: 70KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 95.0MB - Virtual size: 95.0MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0f:a3:76:3b:ac:7a:99:5d:c1:80:d3:cf:1d:b8:78:39
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a3:de:18:87:ac:18:28:70:6d:37:ea:b7:71:58:a5:38:47:8b:4c:31
Signer

.text
Size: 288KB - Virtual size: 287KB

.rdata
Size: 72KB - Virtual size: 70KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 95.0MB - Virtual size: 95.0MB