04eef2872a0b7d486bb58ad7cff1c84a

Sharing

Copy URL Twitter E-mail

General

Target

04eef2872a0b7d486bb58ad7cff1c84a
Size

157KB
MD5

04eef2872a0b7d486bb58ad7cff1c84a
SHA1

a3641ce837dda3a1a0b78e303b16d852cfe0d28d
SHA256

e637bc4d240f18d2ea554f5d196273bae87ca978fd25d85ec875b4cedfd501c3
SHA512

7106bdfdddf6bb2abbb32d971cb3d56255edd430db1a6bfbb69452d7eda19158cf015d96a7f802edb8dab7a975f857d57c3448372f4e2a2f7f8ee117119844e6
SSDEEP

3072:ZqSQ3tTwQT2EZ936EDTOIAJaVUoh8TU0OUkrDkJu:cSQyQ/9nuUFv6u

Score

1^/10

Malware Config

Signatures

Files

04eef2872a0b7d486bb58ad7cff1c84a
.dll windows:4 windows x86 arch:x86

3ae4c30872b8125801e9dcc8a2c7d9a4

Code Sign

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:79:d7:71:2d:db:cb
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

06/04/2010, 17:30

Not After

06/04/2013, 17:30

Subject

CN=eGrabber Inc.,O=eGrabber Inc.,L=San Jose,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

20:03
Certificate

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

06/05/2010, 19:34

Not After

06/05/2015, 19:34

Subject

CN=Starfield Services Timestamp Authority,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9a:00:08:21:fa:ac:2c:12:cf:68:31:07:27:a7:87:e7:b8:f4:e9:e4
Signer

Actual PE Digest

9a:00:08:21:fa:ac:2c:12:cf:68:31:07:27:a7:87:e7:b8:f4:e9:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
WritePrivateProfileStringA
GetProcessVersion
GetCPInfo
GetOEMCP
RtlUnwind
GetCommandLineA
HeapAlloc
SetStdHandle
GetFileType
ExitProcess
TerminateProcess
RaiseException
HeapSize
GetTimeZoneInformation
GetACP
HeapReAlloc
LCMapStringA
HeapFree
GlobalFlags
GlobalAlloc
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileSize
GetFileAttributesA
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
lstrcpyA
FreeLibrary
SetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
SetErrorMode
GetVersion
lstrcatA
TlsSetValue
TlsGetValue
LocalReAlloc
LeaveCriticalSection
EnterCriticalSection
GlobalReAlloc
GlobalUnlock
TlsFree
GlobalHandle
TlsAlloc
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
GetStringTypeW
GlobalLock
LoadLibraryA
GetProcAddress
SetHandleCount
GlobalDeleteAtom
GetModuleFileNameA
lstrcmpA
GetCurrentThread
GetCurrentThreadId
lstrcmpiA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
DuplicateHandle
LocalFree
CreateFileA
CloseHandle
GetLastError
FindFirstFileA
FindClose
lstrcpynA
GetFileTime
GetStdHandle
GetStartupInfoA
LCMapStringW
GetStringTypeA
lstrlenA

user32

RegisterWindowMessageA
SetForegroundWindow
GetForegroundWindow
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
DefWindowProcA
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
DestroyMenu
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
IsIconic
SystemParametersInfoA
GetWindowPlacement
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
UnregisterClassA
UnhookWindowsHookEx
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
GetSystemMetrics
CharUpperA
wsprintfA
LoadStringA
GetMenuCheckMarkDimensions
LoadBitmapA
GetClassNameA

gdi32

DeleteObject
SaveDC
RestoreDC
SelectObject
GetStockObject
SetBkColor
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
TextOutA
GetObjectA
CreateBitmap
DeleteDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA

comctl32

ord17

Exports

Exports

egDeleteTags
egGetAllTags
egGetMappedTags
egGetTags
egProcessFormTag
egSaveAllTags
egSaveTags
egSetTags

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ae4c30872b8125801e9dcc8a2c7d9a4

Code Sign

03:01Certificate

Key Usages

04:79:d7:71:2d:db:cbCertificate

Extended Key Usages

Key Usages

20:03Certificate

Extended Key Usages

Key Usages

9a:00:08:21:fa:ac:2c:12:cf:68:31:07:27:a7:87:e7:b8:f4:e9:e4Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 12KB - Virtual size: 11KB

03:01
Certificate

04:79:d7:71:2d:db:cb
Certificate

20:03
Certificate

9a:00:08:21:fa:ac:2c:12:cf:68:31:07:27:a7:87:e7:b8:f4:e9:e4
Signer

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 12KB - Virtual size: 11KB