MSOutlookServices[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

MSOutlookServices.exe
Size

147KB
MD5

fc860959580c124e7e4781bb08437681
SHA1

b551dd88a1d3d5f277dc174f5d9d11eeea0dafb0
SHA256

eca127142a480fe51e7748159c8d219313a4730d60dc22c4dbbc1bd4d6a67b66
SHA512

abab3d964d5e7b1bdf365a429cbc5b48614f4fb64281d5c0a4b0ce0ab3580fa539ca0f33bc4243dbbe5c6649fa0ce1a2a89de12725a78971001cd768aeb075d2
SSDEEP

3072:OdYA7fiLrQoAurtzKmJCtnsk7IIesI0xv9wsOJ6iiEQd86953:KYK9uJKmJCp8sIc3OJX2v1

Score

1^/10

Malware Config

Signatures

Files

MSOutlookServices.exe
.exe windows:5 windows x86 arch:x86

2869678fcc1755969994fa450400ba7e

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a8:1f:26:5b:2b:56:8e:97:e0:8f:18:f9:10:a8:a6:fb:58:d2:f4:1c
Signer

Actual PE Digest

a8:1f:26:5b:2b:56:8e:97:e0:8f:18:f9:10:a8:a6:fb:58:d2:f4:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_controlfp_s
_invoke_watson
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_setmbcp
_ismbblead
abort
_expand
_msize
_mbschr
_CxxThrowException
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
isdigit
isspace
_strdup
_splitpath_s
_makepath_s
malloc
free
_wcsicmp
_stricmp
strncpy_s
memmove
wcschr
_vsnprintf
memcpy
__CxxFrameHandler3
wcsncpy_s
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memset
_vsnwprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ

shell32

SHGetFolderPathA

ole32

OleLoad
GetClassFile
OleCreateLinkToFile
OleSetContainedObject
StgOpenStorageOnILockBytes
StgIsStorageILockBytes
CoBuildVersion
CoRegisterClassObject
CoRevokeClassObject
OleSave
ReadClassStg

kernel32

LoadLibraryExW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
lstrlenA
GetProcessHeap
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryA
FreeLibrary
GetSystemDefaultLCID
WriteFile
WideCharToMultiByte
GetCurrentProcessId
CloseHandle
MultiByteToWideChar
GetACP
SystemTimeToFileTime
FileTimeToSystemTime
GetTickCount
IsDBCSLeadByte
lstrlenW
RaiseException
GetSystemTime
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
lstrcmpiA
GetFileAttributesA
GetFileTime
DeleteFileA
GetTempPathA
ReadFile
SetCurrentDirectoryA
GetCurrentDirectoryA
CompareFileTime
WaitForSingleObject
IsBadReadPtr
GetProfileStringA
GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceW
GlobalAddAtomA
GetCurrentThread
TlsSetValue
SizeofResource
TlsGetValue
LocalAlloc
LocalFree
FindResourceA
TlsAlloc
lstrcmpA
lstrcmpW
VirtualProtect
QueryPerformanceCounter
GetSystemTimeAsFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

GetMessageTime
CallWindowProcA
DefWindowProcA
IsWindowUnicode
GetWindowLongA
IsDialogMessageA
IsDialogMessageW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetWindowLongW
SetWindowLongW
GetMenu
IsWindowEnabled
GetLastActivePopup
GetForegroundWindow
RegisterClassA
CreateWindowExW
GetDlgCtrlID
GetTopWindow
AdjustWindowRectEx
GetClassInfoA
GetClassInfoW
RemovePropA
GetPropA
SetPropA
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetNextDlgTabItem
GetCursorPos
ValidateRect
GetKeyState
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
TranslateAcceleratorA
GetDesktopWindow
BringWindowToTop
IsWindowVisible
LoadAcceleratorsA
DestroyMenu
LoadMenuA
WinHelpA
SetMenu
EndDialog
TabbedTextOutA
DrawTextA
GrayStringA
DrawTextW
GetMessagePos
ModifyMenuW
TabbedTextOutW
GetClassNameA
UnregisterClassA
UnregisterClassW
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
GetAsyncKeyState
SendDlgItemMessageA
DrawFocusRect
DrawIcon
CharPrevA
DestroyWindow
IsCharAlphaNumericA
CharNextA
MapDialogRect
MessageBoxW
GetSysColor
ShowWindow
LoadMenuW
GetSystemMetrics
PeekMessageA
CreateWindowExA
MessageBeep
IsWindow
SetCursor
SetForegroundWindow
GetFocus
IsIconic
ScreenToClient
SetFocus
EnableWindow
RedrawWindow
GetClientRect
MoveWindow
PostMessageA
SetRectEmpty
LoadIconA
LoadCursorA
RegisterClassW
DefWindowProcW
PostQuitMessage
LoadStringW
LoadStringA
GetDlgItem
GetWindowTextLengthA
GetWindowTextW
GetWindowTextA
SetWindowTextA
SetWindowTextW
DialogBoxIndirectParamW
GetWindow
SendMessageA
GetDC
ReleaseDC
SetWindowLongA
GetWindowThreadProcessId
GetParent
MonitorFromWindow
GetMonitorInfoA
SystemParametersInfoA
GetWindowRect
OffsetRect
SetWindowPos
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CreateDialogIndirectParamW

gdi32

SetTextColor
SetMapMode
GetClipBox
PtVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetBkColor
RestoreDC
SaveDC
DeleteDC
PatBlt
GetTextMetricsA
CreateFontIndirectA
GetObjectA
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
RectVisible
DeleteObject
GetTextExtentPointW
ExtTextOutW
TextOutW

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2869678fcc1755969994fa450400ba7e

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

a8:1f:26:5b:2b:56:8e:97:e0:8f:18:f9:10:a8:a6:fb:58:d2:f4:1cSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

shell32

ole32

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 112KB

.data Size: 18KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 7KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

a8:1f:26:5b:2b:56:8e:97:e0:8f:18:f9:10:a8:a6:fb:58:d2:f4:1c
Signer

.text
Size: 113KB - Virtual size: 112KB

.data
Size: 18KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 7KB