8e232b18bd26cc413b6be9437c284b4a

Sharing

Copy URL Twitter E-mail

General

Target

8e232b18bd26cc413b6be9437c284b4a
Size

2.3MB
MD5

8e232b18bd26cc413b6be9437c284b4a
SHA1

69b64f95b521ff085aade13cc4bf560e0c2a9617
SHA256

e85d7ee7efed3ae90f67c94b854f83a64085cbca24db554e9845c8f86338b407
SHA512

bfa145ec55fce7db4f53f561ebbe1dc98d1eaaf02e50d1a2a17d50f41627133a9833db010004536f57815301c6183af825123bd7618d40b7e77adb9a8c53fa2b
SSDEEP

49152:MZcr/354qLMAwt8bfKTVCnig/3OT4IWmL810:IcdXlwtE/Op8q

Score

1^/10

Malware Config

Signatures

Files

8e232b18bd26cc413b6be9437c284b4a
.exe windows:4 windows x86 arch:x86

4e1d8fb7632986327fd8e81fe6cfe256

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c6:b8:30:ac:46:2b:69:3d:73:14:3b:18:dc:6f:ba:42:ca:77:e0:05
Signer

Actual PE Digest

c6:b8:30:ac:46:2b:69:3d:73:14:3b:18:dc:6f:ba:42:ca:77:e0:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer\TeamViewer\qs_release\TeamViewer.pdb

Imports

comctl32

ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Create
InitCommonControlsEx
ImageList_LoadImageW

crypt32

CryptVerifyMessageSignature
CertGetNameStringA
CertFreeCertificateContext
CertGetNameStringW

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

iphlpapi

DeleteIPAddress
GetAdapterIndex
GetAdaptersInfo

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

kernel32

SetEvent
CreateEventA
CreateThread
ResumeThread
SetThreadPriority
GetCurrentThread
CreateEventW
GetOverlappedResult
lstrcmpW
VirtualFree
VirtualAlloc
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
CreateSemaphoreA
ReleaseSemaphore
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetStdHandle
ExitProcess
RtlUnwind
LCMapStringA
GetStringTypeA
GetTimeFormatA
GetDateFormatA
ExitThread
HeapCreate
GetConsoleCP
GetConsoleMode
GetOEMCP
SetHandleCount
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
QueryPerformanceCounter
GetUserDefaultLCID
DeviceIoControl
WritePrivateProfileStringW
GlobalFree
OpenProcess
FileTimeToLocalFileTime
FindNextFileA
CreateFileA
FindFirstFileA
SetUnhandledExceptionFilter
DeleteFileA
InterlockedExchange
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetLocalTime
CompareFileTime
SetFileTime
GetFileTime
GetFileType
SetEndOfFile
SetFilePointer
FindClose
SetErrorMode
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ResetEvent
WaitForSingleObject
InterlockedCompareExchange
InterlockedIncrement
ReadFile
GetFileSize
FlushFileBuffers
WriteFile
GetCurrentProcessId
GetModuleFileNameA
ReleaseMutex
LocalFree
InterlockedDecrement
GetCommandLineW
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
FreeLibrary
UnmapViewOfFile
Sleep
CloseHandle
MulDiv
SetProcessShutdownParameters
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetCurrentThreadId
GetTickCount
RaiseException
FlushInstructionCache
GetCurrentProcess
GetLastError
LoadResource
GetSystemTime
LockResource
SizeofResource
IsProcessorFeaturePresent
EnumSystemLocalesA
HeapAlloc
GetProcessHeap
HeapFree
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableA
TlsFree

user32

FrameRect
ClientToScreen
GetSystemMenu
GetSysColor
EndDeferWindowPos
BeginDeferWindowPos
GetCapture
GetWindowPlacement
GetMessagePos
SetWindowPlacement
GetNextDlgTabItem
DrawEdge
DestroyAcceleratorTable
SetRectEmpty
FlashWindow
GetDialogBaseUnits
DeferWindowPos
MapDialogRect
SetCapture
ReleaseCapture
GetShellWindow
GetMenu
PostQuitMessage
MessageBoxA
UnhookWindowsHookEx
CallNextHookEx
GetFocus
ToUnicode
GetKeyboardState
ToAscii
GetAsyncKeyState
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetDlgItemTextA
CreateWindowExA
ScreenToClient
GetGUIThreadInfo
DrawFocusRect
CreatePopupMenu
CreateMenu
IsMenu
PtInRect
ChangeClipboardChain
SetClipboardViewer
SendInput
BlockInput
EndDialog
EqualRect
SetThreadDesktop
OpenInputDesktop
GetWindowDC
IntersectRect
GetIconInfo
GetCursorInfo
UnionRect
EnumWindows
CloseDesktop
GetUserObjectInformationW
GetForegroundWindow
GetThreadDesktop
SetRect
GetSystemMetrics
CopyRect
FillRect
ShowScrollBar
AdjustWindowRect
GetDlgCtrlID
DestroyCursor
CharLowerW
SetWindowRgn
DestroyMenu
CheckMenuRadioItem
RemoveMenu
GetSubMenu
EnableMenuItem
CheckMenuItem
TrackPopupMenuEx
KillTimer
SetTimer
InflateRect
CharUpperW
OpenDesktopW
GetMenuStringW
GetMenuItemInfoW
GetWindowThreadProcessId
RegisterWindowMessageW
GetDlgItem
DestroyWindow
SetCursorPos
SetForegroundWindow
GetCursorPos
SetCursor
CreateIconIndirect
GetActiveWindow
BringWindowToTop
GetDesktopWindow
IsWindowVisible
GetClientRect
OffsetRect
GetDC
IsWindow
InvalidateRect
SetParent
SetScrollPos
SetScrollInfo
GetScrollInfo
EndPaint
DestroyIcon
BeginPaint
InvalidateRgn
UpdateWindow
MoveWindow
ScrollWindowEx
ShowWindow
SetFocus
TranslateMessage
RedrawWindow
ReleaseDC
MessageBeep
SetWindowPos
MapWindowPoints
GetParent
GetWindowRect
GetWindow
WindowFromPoint
GetKeyState
UnregisterClassA

gdi32

Ellipse
MoveToEx
ExtEscape
DPtoLP
RoundRect
SetBkMode
StrokeAndFillPath
EndPath
BeginPath
CreateBitmap
GetPixel
GetSystemPaletteEntries
GetDIBits
CreatePen
CreateSolidBrush
Rectangle
CreateRoundRectRgn
GetStockObject
SetDIBitsToDevice
SetStretchBltMode
GetDeviceCaps
SetTextColor
SetBkColor
DeleteDC
DeleteObject
SelectObject
SetPixel
SetViewportOrgEx
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
RealizePalette
SelectPalette
CombineRgn
SetBrushOrgEx
CreateRectRgn
GetObjectType
CreatePalette
CreatePatternBrush
PatBlt
StretchBlt
MaskBlt
LineTo
BitBlt

advapi32

SetSecurityDescriptorDacl
RegCloseKey
CryptDestroyHash
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
OpenProcessToken
GetUserNameA
CryptGetUserKey
CryptVerifySignatureW
CryptSignHashW
CryptReleaseContext
CryptAcquireContextA
CryptGenKey
CryptGetKeyParam
RegQueryValueExA
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptImportKey
CryptExportKey
CreateProcessAsUserW
SetEntriesInAclW
SetNamedSecurityInfoW
RegOpenKeyW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
CryptDestroyKey
CryptDecrypt
CryptEncrypt
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
RegDeleteValueA
InitializeSecurityDescriptor

shell32

CommandLineToArgvW
ord680
SHGetSpecialFolderLocation

ole32

CoTaskMemFree
CoTaskMemAlloc
OleInitialize
RegisterDragDrop
CoCreateInstance
RevokeDragDrop
ReleaseStgMedium
CoInitialize
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathCompactPathW
StrToIntW

wsock32

bind
listen
accept
connect
getsockname
getpeername
send
WSAGetLastError
__WSAFDIsSet
recvfrom
select
inet_ntoa
recv
sendto
socket
ntohs
htons
ioctlsocket
htonl
shutdown
WSAStartup
closesocket
WSACleanup
gethostname
inet_addr
gethostbyname
setsockopt

wininet

InternetConnectW
HttpSendRequestA
InternetGoOnlineA
InternetErrorDlg
InternetReadFile
HttpQueryInfoA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetOpenW
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e1d8fb7632986327fd8e81fe6cfe256

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

c6:b8:30:ac:46:2b:69:3d:73:14:3b:18:dc:6f:ba:42:ca:77:e0:05Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

crypt32

imagehlp

iphlpapi

mpr

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wsock32

wininet

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 316KB - Virtual size: 315KB

.data Size: 148KB - Virtual size: 476KB

.rsrc Size: 320KB - Virtual size: 320KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

c6:b8:30:ac:46:2b:69:3d:73:14:3b:18:dc:6f:ba:42:ca:77:e0:05
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 316KB - Virtual size: 315KB

.data
Size: 148KB - Virtual size: 476KB

.rsrc
Size: 320KB - Virtual size: 320KB