eb8da1e36b7cedc6a796add0258f45feae257817ced055314c93c0af7d6aa779[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

eb8da1e36b7cedc6a796add0258f45feae257817ced055314c93c0af7d6aa779.exe.zip
Size

12.7MB
MD5

9a041aa4da74fe03d1ff56ed89ab81be
SHA1

111e7bd604242fd2aa8cfa035fda585fe7ad7fbd
SHA256

1ad59c42f2175cf9ab22f39a94b548da47005c463f52abb852412429467985e6
SHA512

ca3b89e558318157a521963f470b9ab73041124b37b9339dba9db051d041df27b640a7cb4264fc5deadcf33e14b9a87b2264910f8ccdf8f26f16ce84903c016a
SSDEEP

196608:/wziywHF6bPIw6NIVTV6NlBNujbROodfPkrKgR8FY4hmdymJdqvI8CEi4hYId2:snwHw2Nipqbo9Pk+gkhAl38I14hjd2

Score

1^/10

Malware Config

Signatures

Files

eb8da1e36b7cedc6a796add0258f45feae257817ced055314c93c0af7d6aa779.exe.zip
.zip

Password: infected
eb8da1e36b7cedc6a796add0258f45feae257817ced055314c93c0af7d6aa779.exe
.exe windows:4 windows x86 arch:x86

4a6bacb7a1df2c05395bc34b1c229b82

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

03/12/2001, 00:00

Not After

02/12/2011, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:33:b5:ee:7a:df:cd:64:4e:1e:88:e9:26:fc:ef:80
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/06/2003, 00:00

Not After

01/07/2004, 23:59

Subject

CN=Sun Microsystems\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Sun Microsystems,O=Sun Microsystems\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

shell32

SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA

comctl32

ord17

kernel32

QueryPerformanceFrequency
CreateEventA
Sleep
lstrcatA
CompareStringA
CompareStringW
GetVersionExA
SetFilePointer
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
GetModuleFileNameA
lstrcmpA
GetSystemDefaultLCID
GlobalHandle
VerLanguageNameA
SetLastError
SetCurrentDirectoryA
GetPrivateProfileSectionA
WaitForSingleObject
GetSystemInfo
IsValidCodePage
FlushFileBuffers
LocalFree
FormatMessageA
GetDiskFreeSpaceA
_lclose
OpenFile
GetDriveTypeA
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
GetExitCodeProcess
GetCurrentProcess
GetCurrentThread
GetLocaleInfoA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
lstrlenA
GetOEMCP
GetACP
GetCPInfo
SetUnhandledExceptionFilter
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
ExitProcess
RaiseException
HeapAlloc
HeapFree
RtlUnwind
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
lstrcpynA
SearchPathA
FindFirstFileA
GetStringTypeA
VirtualProtect
VirtualQuery
FindClose
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
SetStdHandle
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
InterlockedIncrement
WriteFile
lstrlenW
DeleteFileA
GetLastError
WideCharToMultiByte
CopyFileA
MultiByteToWideChar
CreateThread
GetExitCodeThread
GetTickCount
lstrcmpiA
ExpandEnvironmentStringsA
GetPrivateProfileIntA
GetTempPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
WritePrivateProfileStringA
lstrcpyA
GetPrivateProfileStringA
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
UnhandledExceptionFilter

user32

GetWindowTextLengthA
GetWindowTextA
MoveWindow
GetWindowPlacement
DrawIcon
DestroyIcon
GetDlgCtrlID
SetWindowTextA
FillRect
GetParent
EnableWindow
GetDlgItemTextA
SetCursor
UpdateWindow
GetClassInfoA
wvsprintfA
LoadStringA
GetSysColor
GetSysColorBrush
IsDialogMessageA
GetWindowRect
GetSystemMetrics
SetRect
FindWindowA
IntersectRect
SubtractRect
CharPrevA
DestroyWindow
CreateDialogParamA
CharNextA
MessageBoxA
WaitForInputIdle
GetWindowLongA
BeginPaint
EndPaint
SetWindowLongA
GetClientRect
ClientToScreen
SetWindowPos
GetWindowDC
EndDialog
GetDlgItem
ShowWindow
DialogBoxParamA
GetDesktopWindow
wsprintfA
MsgWaitForMultipleObjects
PeekMessageA
DefWindowProcA
PostMessageA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
ExitWindowsEx
SendDlgItemMessageA
IsWindow
CharLowerBuffA
SendMessageA

gdi32

GetTextExtentPointA
SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
SelectObject
TranslateCharsetInfo
DeleteDC
DeleteObject
GetStockObject
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
CreateDIBitmap
BitBlt

advapi32

RegQueryValueA
RegOpenKeyA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegDeleteKeyA

ole32

StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoCreateInstance
GetRunningObjectTable
StgIsStorageFile
StgOpenStorage
CoUninitialize
CoInitialize
CreateItemMoniker

oleaut32

VariantChangeType
SysAllocString
SysAllocStringLen
SysStringLen
SysReAllocStringLen
SysFreeString
VariantClear

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

4a6bacb7a1df2c05395bc34b1c229b82

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

48:33:b5:ee:7a:df:cd:64:4e:1e:88:e9:26:fc:ef:80Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

version

shell32

comctl32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 20KB - Virtual size: 34KB

.rsrc Size: 48KB - Virtual size: 46KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

48:33:b5:ee:7a:df:cd:64:4e:1e:88:e9:26:fc:ef:80
Certificate

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 20KB - Virtual size: 34KB

.rsrc
Size: 48KB - Virtual size: 46KB