RA3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RA3.exe
Size

1.0MB
MD5

41eedb6c4100abe3f362e77573d20771
SHA1

9335e74cd846837a0dd0c4d2ef5e8bed4df4a93b
SHA256

d8d51e725c57039b2a3ac8c5b83c49eaebeccb3e13337274686437be5b0e3018
SHA512

378764aed5de9ef1ef3187c33807f4a3cf94333ed222e6bdf3c24ac43e84a5a7944af37191182e932036f0ccbb93a16129eba15fdcf476e036838df48fe42861
SSDEEP

24576:esXJxEVHRILh8Az3ikDgAQLrJq+zR8MR2rttV:ZQ8SugY+zRZR2rttV

Score

1^/10

Malware Config

Signatures

Files

RA3.exe
.exe windows:4 windows x86 arch:x86

f6d95532b6a28654265c10139b826825

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:9b:46:a4:fd:c1:78:28:c3:e7:ea:71:c2:be:85:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

05/09/2008, 00:00

Not After

04/10/2011, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=Ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

85:48:b1:fa:20:50:28:28:e1:7c:eb:47:04:1d:d6:bc:99:ff:46:90
Signer

Actual PE Digest

85:48:b1:fa:20:50:28:28:e1:7c:eb:47:04:1d:d6:bc:99:ff:46:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projects\pf-cnc3\ra3\production\Code\SageLauncher\0.0-dev\source\release\CNC3.pdb

Imports

comctl32

ImageList_LoadImageW
_TrackMouseEvent
ImageList_Draw
ImageList_Destroy
ord17
ImageList_GetIconSize

winmm

PlaySoundW

kernel32

GlobalGetAtomNameA
GetAtomNameA
lstrcmpA
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
GlobalFlags
SetErrorMode
GetVersionExA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
FreeResource
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateFileW
GetDriveTypeA
GetTimeZoneInformation
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FindNextFileA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
SetHandleCount
SetCurrentDirectoryA
GetFullPathNameW
GetDateFormatA
GetTimeFormatA
IsValidCodePage
GetStdHandle
HeapCreate
FatalAppExitA
CreateThread
ExitThread
GetFileType
SetStdHandle
GetStartupInfoA
GetCommandLineA
DeleteFileW
CreateDirectoryA
ExitProcess
GetDriveTypeW
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetACP
GetFileTime
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateFileA
GetShortPathNameA
GetFullPathNameA
FindFirstFileA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
DeleteFileA
MoveFileA
GetModuleHandleA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetCurrentProcessId
GetModuleFileNameA
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalSize
FormatMessageA
LocalFree
MulDiv
OpenMutexA
Sleep
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
GetVersionExW
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
SetCurrentDirectoryW
MoveFileExA
GetFileAttributesA
SetFileAttributesA
CopyFileA
GetCurrentDirectoryW
LoadLibraryA
GetTempPathW
GetTickCount
FindResourceA
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetVersion
FindFirstFileW
FindNextFileW
FindClose
lstrcmpiW
lstrcmpW
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FindFirstVolumeW
GetVolumeInformationW
FindNextVolumeW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
CreateDirectoryW
GetFileAttributesW
MapViewOfFileEx
GetVolumeInformationA
UnmapViewOfFile
CreateEventA
WaitForMultipleObjects
CreateMutexA
GetLastError
GetFileAttributesExW
CreateFileMappingW
CreateProcessW
OpenProcess
CloseHandle
WaitForSingleObject
GetExitCodeProcess
SetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
InterlockedExchange
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetNumberFormatW
GetConsoleOutputCP
WriteConsoleW
FreeEnvironmentStringsA
SetEnvironmentVariableA

user32

SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetScrollPos
SetScrollPos
GetClassNameA
SetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetMessageA
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
GetWindowTextLengthA
GetWindowTextA
LoadCursorA
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetWindowLongA
GetLastActivePopup
MessageBoxA
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
SetWindowLongW
SendMessageW
DefWindowProcW
GetWindowLongW
CallWindowProcW
GetActiveWindow
SetWindowPos
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
PostMessageW
RegisterWindowMessageW
FindWindowW
ExitWindowsEx
GetMessageW
CharNextW
DefDlgProcW
RegisterClassW
PeekMessageW
DispatchMessageW
TranslateMessage
CharUpperW
CharUpperA
CharLowerW
CharLowerA
LoadImageW
CallWindowProcA
MessageBoxW
GetDesktopWindow
FillRect
SetDlgItemTextA
SetRect
EnableWindow
ScreenToClient
IsDlgButtonChecked
IsDialogMessageA
SetWindowLongA
ScrollWindowEx
CheckMenuItem
CopyRect
GetSysColorBrush
GetSysColor
GetClientRect
DrawTextW
GetWindowTextW
GetDC
ReleaseDC
GetMenu
AdjustWindowRectEx
GetClassInfoExW
LoadCursorW
IsWindow
RegisterClassExW
CreateWindowExW
DestroyWindow
GetWindowRect
ClientToScreen
UpdateWindow
InvalidateRect
DefWindowProcA
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
PostMessageA
ShowScrollBar
CreateDialogIndirectParamA
GetScrollRange
SetScrollRange
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
GetMessagePos
GetMessageTime
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
GetForegroundWindow
RemovePropA
GetPropA
SetPropA
GetClassLongA
IsChild
WinHelpA
LoadIconA
RegisterWindowMessageA
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
GetMenuItemInfoA
DestroyMenu
ShowOwnedPopups
DeleteMenu
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowPlacement
IsIconic
SystemParametersInfoA
OffsetRect
IntersectRect
SetTimer
KillTimer
IsWindowEnabled
SetCapture
SetFocus
GetParent
GetDlgCtrlID
SystemParametersInfoW
GetCapture
DrawFocusRect
DrawEdge
ReleaseCapture
PtInRect
InflateRect
GetSystemMetrics
BeginPaint
EndPaint
GetFocus
PostThreadMessageW
GetDlgItem
PostQuitMessage
SetDlgItemTextW
SetWindowTextW
LoadIconW
SetForegroundWindow
ShowWindow
CreateDialogParamW
MapWindowPoints
GetWindow
EndDialog
DialogBoxParamW
MoveWindow
DestroyIcon
GetNextDlgTabItem
SetCursor
GetDialogBaseUnits

gdi32

SetPolyFillMode
SetROP2
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
MoveToEx
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
RestoreDC
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
ExtCreatePen
CreateHatchBrush
CreateFontIndirectA
GetTextExtentPoint32A
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
GetTextMetricsA
SaveDC
GetObjectA
SetBkColor
GetClipBox
GetDCOrgEx
CreateBitmap
CreateDCA
CopyMetaFileA
GetDeviceCaps
Polygon
CreatePen
CreateSolidBrush
SetStretchBltMode
CreateCompatibleBitmap
BitBlt
CreateDIBitmap
StretchBlt
PatBlt
SetBkMode
CreateDIBSection
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC
GetObjectW
DeleteObject
CreateFontIndirectW
ExtTextOutA
SetTextColor

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

ChooseFontW
GetFileTitleA

advapi32

CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyA
RegSetValueA
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExA
FreeSid

shell32

ShellExecuteW
SHGetFileInfoA
ExtractIconA
SHGetSpecialFolderPathW

ole32

ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
ReadClassStg
StringFromCLSID
CoTreatAsClass
CreateBindCtx
OleDuplicateData
CoDisconnectObject
StringFromGUID2
CLSIDFromString
ReleaseStgMedium

oleaut32

VariantInit
VarBstrFromDate
VarCyFromStr
VarBstrFromDec
VarBstrFromCy
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
VariantChangeType
SafeArrayRedim
VariantClear
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VarUI4FromStr
VarDecCmp
VarDecFromStr
VarR8FromStr
VarI4FromStr
VarDateFromStr
SysFreeString
SafeArrayGetUBound

shlwapi

PathStripToRootA
PathRemoveFileSpecW
PathCombineW
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathCanonicalizeW
UrlUnescapeA
PathRemoveExtensionA

gdiplus

GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCreateBitmapFromStreamICM
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdiplusStartup
GdipDrawImageI
GdipCloneImage
GdipGetImageWidth
GdiplusShutdown

wininet

HttpQueryInfoA
InternetFindNextFileA
InternetCloseHandle
GopherFindFirstFileA
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestA
HttpEndRequestA
HttpSendRequestExA
GopherGetAttributeA
FtpOpenFileA
FtpCommandA
GopherCreateLocatorA
FtpFindFirstFileA
InternetConnectA
GopherOpenFileA
InternetOpenUrlA
HttpOpenRequestA
InternetErrorDlg
FtpGetFileA
FtpPutFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetQueryDataAvailable
InternetGetCookieA
InternetSetCookieA
InternetSetOptionExA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpAddRequestHeadersA

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

Exports

Exports

?PatchCallBack@@YGPAXIPAX@Z

Sections

.text
Size: 564KB - Virtual size: 563KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f6d95532b6a28654265c10139b826825

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

6e:9b:46:a4:fd:c1:78:28:c3:e7:ea:71:c2:be:85:fbCertificate

Extended Key Usages

Key Usages

85:48:b1:fa:20:50:28:28:e1:7c:eb:47:04:1d:d6:bc:99:ff:46:90Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

winmm

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

wininet

oleacc

Exports

Exports

Sections

.text Size: 564KB - Virtual size: 563KB

.rdata Size: 108KB - Virtual size: 104KB

.data Size: 16KB - Virtual size: 113KB

.rsrc Size: 364KB - Virtual size: 360KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

6e:9b:46:a4:fd:c1:78:28:c3:e7:ea:71:c2:be:85:fb
Certificate

85:48:b1:fa:20:50:28:28:e1:7c:eb:47:04:1d:d6:bc:99:ff:46:90
Signer

.text
Size: 564KB - Virtual size: 563KB

.rdata
Size: 108KB - Virtual size: 104KB

.data
Size: 16KB - Virtual size: 113KB

.rsrc
Size: 364KB - Virtual size: 360KB