562087c4d198b2b87f46abf2600093d2

Sharing

Copy URL Twitter E-mail

General

Target

562087c4d198b2b87f46abf2600093d2
Size

602KB
MD5

562087c4d198b2b87f46abf2600093d2
SHA1

30ed0406298f904dfce02861b5ae9ff4028b949e
SHA256

5dbed9cac03b27c7f1f5851ec872ad2924840509a070f5c9abc169bb76f2d7cc
SHA512

ec7bc44796e7b06af7eba74cb026d8baf511cac954a21ac0b4edaf6a871ae8bcbef574b58bc33a57f9a156c25dfd3a32916de6ddb16e626cd7e9eedba7cdacf0
SSDEEP

12288:1oJru/bPsxxzmst476G/v/hl9SNOlxe7C3w6pa3S+ZE9ml1+9:8u/bPsxxzni6w/xSYL5wsCSgEUQ9

Score

1^/10

Malware Config

Signatures

Files

562087c4d198b2b87f46abf2600093d2
.dll regsvr32 windows:5 windows x86 arch:x86

2eb912bb8809e2f66fd4b18b8393d562

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:88:1c:50:cc:47:29:f7:08:bd:7e:ed:b7:17:8f:37:38:8e:31:ae
Signer

Actual PE Digest

25:88:1c:50:cc:47:29:f7:08:bd:7e:ed:b7:17:8f:37:38:8e:31:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleacc

AccessibleObjectFromWindow

urlmon

CoInternetGetSession
URLDownloadToCacheFileA

wininet

InternetSetOptionA
InternetOpenA
InternetReadFile
InternetGetCookieA
InternetSetCookieA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
HttpOpenRequestA

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

kernel32

FreeLibrary
LoadLibraryA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
Sleep
TerminateProcess
WaitForSingleObject
CreateThread
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
SetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
UnmapViewOfFile
SetEvent
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
CreateEventA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrlenW
ReleaseMutex
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetCurrentProcessId
CreateMutexA
FindClose
FindNextFileA
lstrlenA
GetVersion
ExpandEnvironmentStringsA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapDestroy
HeapCreate
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
GetStringTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapReAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
GetCurrentThreadId
OutputDebugStringA
DebugBreak
InterlockedIncrement
OpenMutexA
InterlockedDecrement
GetModuleHandleA
GetProcAddress
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
LCMapStringA
SetEndOfFile
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
CompareStringW
SetEnvironmentVariableA
GetStringTypeExA
FindFirstFileA

user32

CharNextA
PostMessageA
GetWindowThreadProcessId
EnumWindows
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
DestroyWindow
GetDesktopWindow
DestroyIcon
SendMessageA
GetWindowRect
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
SetTimer
KillTimer
CharNextW
MessageBoxA
CharLowerA
GetWindowTextA
IsWindowVisible
wvsprintfA
UnregisterClassA

advapi32

RegQueryInfoKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteKeyA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA

shell32

ShellExecuteExA
ShellExecuteA
SHGetFolderPathA

ole32

CoTaskMemFree
CoGetClassObject
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateGuid
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
DispCallFunc
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
VariantChangeType
VariantCopy

gdiplus

GdiplusShutdown

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2eb912bb8809e2f66fd4b18b8393d562

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:baCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

25:88:1c:50:cc:47:29:f7:08:bd:7e:ed:b7:17:8f:37:38:8e:31:aeSigner

Headers

DLL Characteristics

File Characteristics

Imports

oleacc

urlmon

wininet

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 421KB - Virtual size: 420KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 15KB - Virtual size: 24KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 41KB - Virtual size: 40KB

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

25:88:1c:50:cc:47:29:f7:08:bd:7e:ed:b7:17:8f:37:38:8e:31:ae
Signer

.text
Size: 421KB - Virtual size: 420KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 15KB - Virtual size: 24KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 41KB - Virtual size: 40KB