d2e558d69b42749c8b3c00d4b19aa475169b7837cf8768d7b2713d0595b146e4

Sharing

Copy URL

Twitter E-mail

General

Target

d2e558d69b42749c8b3c00d4b19aa475169b7837cf8768d7b2713d0595b146e4
Size

5.4MB
MD5

998757fe9754714eff6180db4fa0f86f
SHA1

b853d74c2a1a26316fa657a0714090be4870196d
SHA256

d2e558d69b42749c8b3c00d4b19aa475169b7837cf8768d7b2713d0595b146e4
SHA512

b150fe85e15c74f68b7db1bf5dea86bebe8f2f19433dbb7de1e273382462df9ae5a11c661372ecd3a396891dd91a2d4c6fb810912dfb6bccfbea733cdb2f487c
SSDEEP

49152:VL9RteOQSUBod38RaHqVw5X3aaaZeqjqTQ02xVwin6a0KB:VLVSodscqw5avZVKs8u

Score

1^/10

Malware Config

Signatures

Files

d2e558d69b42749c8b3c00d4b19aa475169b7837cf8768d7b2713d0595b146e4
.exe windows:4 windows x86 arch:x86

9d61da652ab90dbb13fb52731d56d519

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17-05-2005 00:00

Not After

16-05-2010 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:79:38:e4:00:ab:b6:99:95:c4:9b:1a:13:2e:1a:ed
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-04-2006 00:00

Not After

09-04-2007 23:59

Subject

CN=SmartFTP,O=SmartFTP,POSTALCODE=6300,STREET=Baarerstrasse 12,L=Zug,ST=ZG,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

34:22:f0:93:e3:af:d0:7e:bd:0c:e1:2c:f5:ae:0d:fb:52:bc:ab:12
Signer

Actual PE Digest

34:22:f0:93:e3:af:d0:7e:bd:0c:e1:2c:f5:ae:0d:fb:52:bc:ab:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\My Projects\SmartFTP 2\Win32\Release\SmartFTP.pdb

Imports

kernel32

InterlockedExchange
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFileEx
ReadFileEx
SetFilePointer
GetCurrentProcess
GlobalFree
GetTimeZoneInformation
SystemTimeToFileTime
WriteFile
FileTimeToDosDateTime
GetSystemTimeAsFileTime
CompareFileTime
FindClose
WaitForMultipleObjectsEx
GetExitCodeThread
Sleep
ReadFile
ResumeThread
LocalFileTimeToFileTime
SetFileTime
WaitForSingleObject
ResetEvent
MapViewOfFile
UnmapViewOfFile
SetEvent
CloseHandle
GlobalAlloc
GetPrivateProfileSectionNamesA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetSystemTime
GetLocalTime
GlobalSize
GlobalMemoryStatus
GetCurrentThreadId
GetFileInformationByHandle
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
GetCommandLineW
TerminateThread
LocalAlloc
SetLastError
InterlockedDecrement
InterlockedIncrement
GetTickCount
QueryPerformanceFrequency
WinExec
CreateFileA
SetEnvironmentVariableA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
GetConsoleMode
GetConsoleCP
GetStringTypeA
LCMapStringA
GetDateFormatA
GetTimeFormatA
GetOEMCP
IsDebuggerPresent
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
LoadLibraryA
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
LoadResource
LockResource
SizeofResource
GetLastError
GetStdHandle
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MulDiv
DuplicateHandle
GetFileTime
lstrcmpA
lstrlenA
FreeResource
SetThreadPriority
SuspendThread
GlobalDeleteAtom
EnumResourceLanguagesW
GetVersion
ConvertDefaultLocale
GetCurrentThread
GetCurrentProcessId
ReleaseMutex
VirtualProtect
GlobalFlags
GlobalReAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
HeapReAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
ExitProcess

user32

GetDialogBaseUnits
InvalidateRgn
GetNextDlgGroupItem
GetSystemMenu
SetParent
GetDCEx
SetClipboardData
CopyIcon
DestroyCursor
GetMenuDefaultItem
HideCaret
ShowCaret
RegisterWindowMessageA
DrawFocusRect
CreateIconFromResourceEx
DrawIconEx
InvertRect
DrawFrameControl
DestroyAcceleratorTable
ToUnicodeEx
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
SetCursorPos
GetCursor
mouse_event
GetDoubleClickTime
IsZoomed
UnpackDDElParam
ReuseDDElParam
CallNextHookEx
TranslateMessage
IsWindowVisible
ValidateRect
GetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
UnregisterClassA
SetMenu
DrawIcon
EndPaint
BeginPaint
SetWindowContextHelpId
SendDlgItemMessageA
IsChild
GetForegroundWindow
GetTopWindow
GetMessageTime
SetRectEmpty
GetWindowRect
GetClientRect
GetMessagePos
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
InvalidateRect
EndDeferWindowPos
DeferWindowPos
MapWindowPoints
GetDlgItem
CreateIconIndirect
ExitWindowsEx
GetScrollPos
WindowFromPoint
InflateRect
PtInRect
SetWindowPos
GetClipboardOwner
DestroyWindow
EnumChildWindows
SetClipboardViewer
ChangeClipboardChain
SetCapture
GetCapture
LockWindowUpdate
SetWindowRgn
RemoveMenu
SetRect
CopyImage
GetDC
MsgWaitForMultipleObjects
SetCursor
IsWindow
OffsetRect
ReleaseCapture
GetWindow
KillTimer
SetTimer
ReleaseDC
GetWindowDC
CheckMenuItem
DrawEdge
UnionRect
MessageBeep
ShowWindow
GetIconInfo
GetKeyState
FrameRect
CopyRect
GetDesktopWindow
IsRectEmpty
IsMenu
CreatePopupMenu
GetMenuItemCount
DeleteMenu
EmptyClipboard
GetSystemMetrics
GetAsyncKeyState
GetCursorPos
GetParent
ChildWindowFromPoint
SetActiveWindow
ScreenToClient
ClientToScreen
GetSubMenu
GetSysColorBrush
GetSysColor
BeginDeferWindowPos
SetForegroundWindow
AttachThreadInput
FillRect
ShowScrollBar
EqualRect
GetScrollInfo
SetScrollInfo
SetWindowPlacement
IntersectRect
SystemParametersInfoA
GetWindowPlacement
MoveWindow
GetDlgCtrlID
IsDlgButtonChecked
SetDlgItemInt
GetDlgItemInt
CheckDlgButton
MapDialogRect
GetWindowThreadProcessId
GetLastActivePopup
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
PostQuitMessage
AdjustWindowRectEx
CloseClipboard
OpenClipboard
RedrawWindow
DestroyIcon
GetFocus
SetFocus
IsIconic
DestroyMenu
UpdateWindow
TranslateMDISysAccel
BringWindowToTop
DrawMenuBar
GetMenu
UnhookWindowsHookEx
ShowOwnedPopups

gdi32

SetTextJustification
SetTextAlign
MoveToEx
LineTo
SelectClipRgn
ExtSelectClipRgn
IntersectClipRect
GetCurrentPositionEx
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetPixelV
RoundRect
ExtFloodFill
OffsetViewportOrgEx
GetBitmapBits
ExtCreateRegion
GetTextAlign
GetTextCharsetInfo
Polygon
StretchBlt
Rectangle
GdiFlush
SetPixel
Polyline
FillRgn
CreatePolygonRgn
CreateDIBSection
GetDIBits
SetDIBits
StretchDIBits
GetRgnBox
GetTextColor
CombineRgn
SetRectRgn
PatBlt
CreateRectRgnIndirect
Ellipse
CreateEllipticRgn
CreatePatternBrush
DeleteDC
GetStockObject
SetWindowOrgEx
OffsetWindowOrgEx
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
GetBkColor
GetMapMode
GetViewportExtEx
GetWindowExtEx
DPtoLP
LPtoDP
BitBlt
PtVisible
RectVisible
Escape
DeleteObject
CreatePen
CreateBitmap
SetViewportOrgEx
SelectObject
GetPixel
CreateRectRgn
GetViewportOrgEx

advapi32

CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegCloseKey
CryptEncrypt
CryptDeriveKey
CryptGetHashParam
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CryptDecrypt
FreeSid
EqualSid
GetTokenInformation
AllocateAndInitializeSid
CryptGetProvParam
QueryServiceStatus
OpenServiceW
CloseServiceHandle
CryptAcquireContextA
CryptGenKey
CryptGenRandom

ole32

CoUninitialize
StgCreateDocfile
StgOpenStorage
CoInitializeEx
StringFromGUID2
CoCreateInstance
OleRun
CLSIDFromString
CoTaskMemFree
CoRegisterClassObject
CoLockObjectExternal
RevokeDragDrop
DoDragDrop
CoCreateGuid
OleGetClipboard
OleSetClipboard
OleIsCurrentClipboard
ReleaseStgMedium
OleFlushClipboard
CoGetClassObject
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
OleDuplicateData
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CoDisconnectObject
CreateStreamOnHGlobal
RegisterDragDrop
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

VariantChangeType
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VarDateFromStr
CreateErrorInfo
SetErrorInfo
GetErrorInfo
SafeArrayDestroy
VarBstrFromDate
OleCreateFontIndirect
VarUdateFromDate
VariantChangeTypeEx
OleLoadPicturePath
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
DispCallFunc
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantCopy
VarUI4FromStr
LoadRegTypeLi
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocStringByteLen
SysAllocStringLen
SysStringByteLen
RegisterActiveObject
RevokeActiveObject

shell32

ord155
ord98
SHGetSpecialFolderLocation
ord17
ord18
SHGetDesktopFolder
SHGetMalloc
ord68
ord147
DragFinish
ord16

comctl32

ImageList_GetIconSize
ImageList_GetImageCount
PropertySheetW
ImageList_Create
ImageList_AddMasked
ImageList_Add
_TrackMouseEvent
ImageList_Destroy
ImageList_GetIcon
ImageList_DrawEx
ImageList_Draw
CreatePropertySheetPageW

shlwapi

PathFindNextComponentW
PathSkipRootW
PathIsDirectoryW
PathAddBackslashW
PathIsRootW
SHAutoComplete
StrCpyNW
PathIsDirectoryEmptyW
SHStrDupW
PathUnExpandEnvStringsW
PathMatchSpecW
PathStripToRootW
PathIsUNCW
StrFormatKBSizeW
SHGetValueW
StrCmpIW
SHOpenRegStream2W
SHCopyKeyW
PathFileExistsW
PathCompactPathExW
PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrFormatByteSizeW
PathRemoveBackslashW
PathAddExtensionW
PathRemoveExtensionW
StrCmpNW

wininet

InternetReadFile
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetAttemptConnect

ws2_32

closesocket
htonl
htons
inet_addr
accept
socket
select
bind
connect
sendto
recvfrom
WSAAsyncSelect
send
recv
WSACleanup
WSAStartup
WSAStringToAddressA
WSASetLastError
WSAGetLastError
listen

crypt32

CertFreeCertificateContext
CertAddCertificateContextToStore
CertOpenSystemStoreW
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptEncodeObject
CertCloseStore
CertGetNameStringW
CryptExportPublicKeyInfo
CryptImportPublicKeyInfoEx
CertStrToNameW
CertSetCertificateContextProperty
CertAddEncodedCertificateToStore
CertOpenStore
CryptSignAndEncodeCertificate

cryptui

CryptUIDlgCertMgr

oledlg

OleUIAddVerbMenuW
OleUIBusyW

winspool.drv

ClosePrinter

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA
UuidToStringW
RpcStringFreeW

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 840KB - Virtual size: 836KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d61da652ab90dbb13fb52731d56d519

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

7a:79:38:e4:00:ab:b6:99:95:c4:9b:1a:13:2e:1a:edCertificate

Extended Key Usages

Key Usages

34:22:f0:93:e3:af:d0:7e:bd:0c:e1:2c:f5:ae:0d:fb:52:bc:ab:12Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shell32

comctl32

shlwapi

wininet

ws2_32

crypt32

cryptui

oledlg

winspool.drv

rpcrt4

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 840KB - Virtual size: 836KB

.data Size: 128KB - Virtual size: 151KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

7a:79:38:e4:00:ab:b6:99:95:c4:9b:1a:13:2e:1a:ed
Certificate

34:22:f0:93:e3:af:d0:7e:bd:0c:e1:2c:f5:ae:0d:fb:52:bc:ab:12
Signer

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 840KB - Virtual size: 836KB

.data
Size: 128KB - Virtual size: 151KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB