6df78d00b925f0dce0f0530a68b0d20a

Sharing

Copy URL Twitter E-mail

General

Target

6df78d00b925f0dce0f0530a68b0d20a
Size

1009KB
MD5

6df78d00b925f0dce0f0530a68b0d20a
SHA1

467140a64d2843df5358634eabc1c252899a27ae
SHA256

8aebbc38926b23239d605111b6405483c30dda03ca3ac2b661a3fb4e63d93a2e
SHA512

671e76e3f27aa60ddb9d8ef9c862b30a50f169f95fc516dfb66d4ef3c44887081e2c7ed02eb1ef2ae7f1339c615f2c8c6e2c8fea03d3c90dec620b4919201c52
SSDEEP

24576:l8xpAulzPI+pGELCxPzglC6u6ewB1J3pBYbEwzY1:vuNg4lCZt6uTiSI1

Score

1^/10

Malware Config

Signatures

Files

6df78d00b925f0dce0f0530a68b0d20a
.exe windows:5 windows x86 arch:x86

c8481e3f3bc7541de40f310e626c679c

Code Sign

1a:0d:68:de:3a:ae:74:8e:2d:23:ef:9a:46:c0:07:ef
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

17/03/2011, 23:59

Subject

CN=PlaySushi.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PlaySushi.com,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:e4:04:40:40:73:14:f1:b2:20:4b:8b:7d:cf:4d:c2:a6:fd:43:c2
Signer

Actual PE Digest

88:e4:04:40:40:73:14:f1:b2:20:4b:8b:7d:cf:4d:c2:a6:fd:43:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrA
StrToIntA
StrStrIA
wnsprintfA
StrNCatA

rpcrt4

UuidToStringA
UuidCreate

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

CreateThread
GetLocalTime
GetVersionExA
lstrcpyA
GetTickCount
GetCurrentProcessId
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
MoveFileExA
GetExitCodeProcess
lstrcatA
GetModuleFileNameA
WinExec
GetTempPathA
lstrcmpiA
GetFileAttributesA
FindFirstFileA
FindClose
FindNextFileA
GetModuleHandleA
ExitProcess
GetLastError
CreateMutexA
MultiByteToWideChar
LocalAlloc
LocalFree
OpenProcess
TerminateProcess
GetFullPathNameA
DosDateTimeToFileTime
SetFileTime
GetFileTime
LocalFileTimeToFileTime
RtlUnwind
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
HeapReAlloc
Sleep
DeleteCriticalSection
VirtualFree
HeapCreate
LeaveCriticalSection
EnterCriticalSection
RaiseException
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
HeapSize
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
SetEndOfFile
GetPrivateProfileStringA
ReadFile
GetConsoleCP
GetConsoleMode
SetFilePointer
CreateDirectoryA
lstrlenA
DeleteFileA
LoadLibraryA
GetProcAddress
GetCurrentProcess
FreeLibrary
WriteFile
GetProcessHeap
HeapFree
HeapAlloc
CreateFileA
CloseHandle
CreateToolhelp32Snapshot
Process32Next
Process32First
VirtualAlloc
lstrcpynA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FreeEnvironmentStringsW

user32

GetDlgItem
FillRect
EnableWindow
RedrawWindow
DrawTextA
SetWindowTextA
GetWindowDC
DrawFocusRect
GetDlgCtrlID
SetCursor
SetFocus
EndPaint
GetKeyState
GetFocus
LoadBitmapA
PeekMessageA
IsWindowEnabled
BeginPaint
GetDC
GetWindowTextA
SetWindowLongA
InvalidateRect
ReleaseDC
PostMessageA
UpdateWindow
DestroyWindow
keybd_event
GetMessageA
GetWindowRect
RegisterClassExA
PostQuitMessage
LoadIconA
GetClientRect
SendMessageA
IsDialogMessageA
TranslateMessage
MapVirtualKeyA
MessageBoxA
GetWindowLongA
CreateWindowExA
DefWindowProcA
SetWindowPos
ShowWindow
DispatchMessageA
SystemParametersInfoA
LoadCursorA
MoveWindow
ExitWindowsEx
GetWindowThreadProcessId
EnumWindows
GetClassNameA
GetParent

gdi32

CreateSolidBrush
BitBlt
SetTextColor
DeleteDC
CreateFontA
SetBkMode
DeleteObject
SetBkColor
CreateCompatibleDC
GetTextExtentPointA
GetObjectA
GetStockObject
TextOutA
SelectObject
CreateDIBitmap

advapi32

RegEnumKeyA
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
RegCreateKeyA
RegQueryValueExA
OpenProcessToken
RegSetValueExA
RegDeleteKeyA
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueA
SetFileSecurityA
AdjustTokenPrivileges
CheckTokenMembership

shell32

ShellExecuteExA
ShellExecuteA
SHGetFolderPathA

ole32

CoTaskMemAlloc

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 826KB - Virtual size: 825KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8481e3f3bc7541de40f310e626c679c

Code Sign

1a:0d:68:de:3a:ae:74:8e:2d:23:ef:9a:46:c0:07:efCertificate

Extended Key Usages

Key Usages

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

88:e4:04:40:40:73:14:f1:b2:20:4b:8b:7d:cf:4d:c2:a6:fd:43:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

rpcrt4

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 126KB - Virtual size: 125KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 14KB - Virtual size: 23KB

.cdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 826KB - Virtual size: 825KB

.reloc Size: 14KB - Virtual size: 13KB

1a:0d:68:de:3a:ae:74:8e:2d:23:ef:9a:46:c0:07:ef
Certificate

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

88:e4:04:40:40:73:14:f1:b2:20:4b:8b:7d:cf:4d:c2:a6:fd:43:c2
Signer

.text
Size: 126KB - Virtual size: 125KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 14KB - Virtual size: 23KB

.cdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 826KB - Virtual size: 825KB

.reloc
Size: 14KB - Virtual size: 13KB