SecuriteInfo[.]com[.]Virus[.]Win9x[.]Merinos[.]29455[.]26545[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Virus.Win9x.Merinos.29455.26545.exe
Size

917KB
MD5

1977738edd299a4b2f695deaf47bf4b5
SHA1

5e190c2aae3e620871937a0c5f50e939d4f02dc4
SHA256

efc9826c30aba11a06834d0e31c10f7ddb804fda6c05a02b796f4084d3e2ffab
SHA512

6e04a65b4c16c8f7ff9cf8033291a771f583e44816ce573cf247cb8ce788b251cfba5511b6f591a006d39c57f59601969516a02d4218a9326ecbd3f5850482a5
SSDEEP

24576:6sxwSoPdVoBjCvuF17+2NdJff4pxroa6MvTmAwd:GSoPdVoXf4p+a/y1

Score

1^/10

Malware Config

Signatures

Files

SecuriteInfo.com.Virus.Win9x.Merinos.29455.26545.exe
.dll windows:6 windows x64

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:10:c3:52:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/10/2005, 23:24

Not After

11/01/2007, 23:34

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

aa:82:08:60:83:ef:ad:6b:3c:4c:fa:cc:29:dd:33:b9:23:6e:4c:1c
Signer

Actual PE Digest

aa:82:08:60:83:ef:ad:6b:3c:4c:fa:cc:29:dd:33:b9:23:6e:4c:1c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
memmove
memcpy
??1type_info@@UEAA@XZ
_amsg_exit
_initterm
_XcptFilter
__C_specific_handler
__dllonexit
_wcsupr
_wcslwr
_errno
__CxxFrameHandler
_unlock
iswdigit
iswalpha
_isatty
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_vscwprintf
??3@YAXPEAX@Z
_onexit
_lock
_wcsnicmp
wcsrchr
wcspbrk
wcschr
??2@YAPEAX_K@Z
_CxxThrowException
wcsstr
_wcsicmp
??_U@YAPEAX_K@Z
_vsnwprintf
_resetstkoflw
malloc
free
??_V@YAXPEAX@Z
memset
memcmp

ntdll

RtlNtStatusToDosError
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

kernel32

WaitForMultipleObjects
GetThreadLocale
SetEndOfFile
SetFilePointer
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapSize
GetVersionExA
RaiseException
VirtualProtect
Sleep
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetProcessHeap
GetSystemTimeAsFileTime
DeviceIoControl
GetSystemDirectoryW
LocalReAlloc
LocalAlloc
GetEnvironmentVariableW
RemoveDirectoryW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
CloseHandle
CreateFileW
MoveFileExW
GetSystemWindowsDirectoryW
EnterCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
DeleteCriticalSection
OutputDebugStringA
InitializeCriticalSection
HeapDestroy
LeaveCriticalSection
GetLastError
FindResourceW
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
VerifyVersionInfoW
lstrlenW
SetFileAttributesW
DeleteFileW
SetLastError
LoadLibraryW
GetVersionExW
GetProcAddress
FreeLibrary
GetFileSize
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
WideCharToMultiByte
CompareStringW
LocalFree
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
CopyFileW
GetTempFileNameW
SetEvent

user32

CharLowerW
UnregisterClassA
CharPrevW

setupapi

pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupDiClassNameFromGuidW
SetupDiGetDeviceInstallParamsW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiSetSelectedDevice
SetupDiOpenDeviceInfoW
SetupDiSetClassInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
CM_Get_Device_IDW
SetupDiSetDeviceRegistryPropertyW
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Enumerate_Classes
SetupDiOpenClassRegKey
SetupGetTargetPathW
SetupInstallFromInfSectionW
SetupDiGetClassDevsW
SetupPromptReboot
SetupDiDestroyDeviceInfoList
SetupInstallFilesFromInfSectionW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupCommitFileQueueW
SetupQueueCopyW
SetupTermDefaultQueueCallback
SetupInitDefaultQueueCallbackEx
SetupCopyOEMInfW
SetupInstallServicesFromInfSectionW
SetupOpenInfFileW
SetupCloseInfFile
SetupFindNextLine
SetupFindNextMatchLineW
SetupGetStringFieldW
SetupGetIntField
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenFileQueue
SetupGetLineCountW
SetupCloseFileQueue
SetupOpenAppendInfFileW

advapi32

FreeSid
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
QueryServiceStatus
OpenSCManagerW
OpenServiceW
ControlService
StartServiceW
DeleteService
CloseServiceHandle

ole32

CoInitialize
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize

wintrust

WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

crypt32

CertFreeCertificateContext
CertFreeCTLContext
CertGetCTLContextProperty
CryptQueryObject

Exports

Exports

DIFXAPISetLogCallbackA
DIFXAPISetLogCallbackW
DriverPackageGetPathA
DriverPackageGetPathW
DriverPackageInstallA
DriverPackageInstallW
DriverPackagePreinstallA
DriverPackagePreinstallW
DriverPackageUninstallA
DriverPackageUninstallW
SetDifxLogCallbackA
SetDifxLogCallbackW

Sections

.text
Size: 457KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ceb920209f99ac3a5c67dbf30edbb1c2

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

61:10:c3:52:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

aa:82:08:60:83:ef:ad:6b:3c:4c:fa:cc:29:dd:33:b9:23:6e:4c:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

setupapi

advapi32

ole32

wintrust

crypt32

Exports

Exports

Sections

.text Size: 457KB - Virtual size: 456KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 42KB - Virtual size: 42KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

61:10:c3:52:00:00:00:00:00:03
Certificate

aa:82:08:60:83:ef:ad:6b:3c:4c:fa:cc:29:dd:33:b9:23:6e:4c:1c
Signer

.text
Size: 457KB - Virtual size: 456KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB