9ecc953dc6c829263a5ea68c72dbe2baf077b6be97cde47d922d00dd4a051fd8

Sharing

Copy URL Twitter E-mail

General

Target

9ecc953dc6c829263a5ea68c72dbe2baf077b6be97cde47d922d00dd4a051fd8
Size

7.9MB
MD5

d85962fedafeac626d4afe49901feae5
SHA1

756de0507c53d8b89bf5592021c62fe6b33a7e26
SHA256

9ecc953dc6c829263a5ea68c72dbe2baf077b6be97cde47d922d00dd4a051fd8
SHA512

371ee4760bf734b83cbbbe8c7ff7e4fe91713d57c33c826979a8d2b91efaf4ee3b85a36fcd682b96ed28480d30ff475118be57fbe888cc29762242bceac4c0ef
SSDEEP

98304:xfmE8TGowXqNIqlzYRo4cNFuxLtkBSNQdw2A17nfJxe4qPJTtk72z4iqh5hR7aRt:xmT7Fli6krgRUcH3Qx2U9AyDy/

Score

1^/10

Malware Config

Signatures

Files

9ecc953dc6c829263a5ea68c72dbe2baf077b6be97cde47d922d00dd4a051fd8
.exe windows:6 windows x86 arch:x86

2e1b47e1a00d7c7fc892d5c52922379f

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:d3:03:a2:28:93:ae:f4:8f:01:41:92:1c:9a:9e:6e:76:90:6c:89
Signer

Actual PE Digest

4f:d3:03:a2:28:93:ae:f4:8f:01:41:92:1c:9a:9e:6e:76:90:6c:89

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\Target\x86\ship\groove\x-none\groove.pdb

Imports

msvcr100

wcsncat_s
malloc
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_ultow_s
wcscpy_s
wcscat_s
memcmp
wprintf_s
memset
memmove_s
calloc
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_resetstkoflw
_write
_read
_lseek
_close
_wremove
_errno
_wcsrev
memcpy
isprint
_wsplitpath_s
_wfullpath
div
towlower
_ftime64_s
_endthreadex
_beginthreadex
_beginthread
_localtime64_s
swscanf_s
vswprintf_s
wprintf
_snprintf_s
_wtoi
_wtof
qsort
_set_invalid_parameter_handler
strncpy_s
_HUGE
localeconv
_vsnwprintf_s
_wcstoui64
_ui64tow_s
wcstoul
wcstol
wcstod
_ltow_s
_get_errno
_set_errno
_wcsnicmp
_wcsicmp
wcstok_s
wcsstr
wcsrchr
wcspbrk
wcsncmp
wcschr
realloc
memmove
_wsopen_s
wcsncpy_s
free
_recalloc
memcpy_s
sprintf_s
swprintf_s
_CxxThrowException
__CxxFrameHandler3
_invalid_parameter_noinfo_noreturn

msvcp100

?_Xfunc@tr1@std@@YAXXZ

atl100

ord68
ord56
ord31
ord32
ord10
ord11
ord58
ord43
ord44
ord30
ord27
ord28
ord37
ord60
ord42
ord64
ord48
ord15
ord49

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegisterEventSourceW
ReportEventW
UnregisterTraceGuids
RegOverridePredefKey
ConvertSidToStringSidW
IsValidSid
GetLengthSid
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegGetValueW
EventWrite
EventUnregister
EventRegister
RegOpenKeyExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegEnumValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
TraceEvent
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyW
DeregisterEventSource

cabinet

ord21
ord22
ord23
ord10
ord11
ord13
ord14
ord20

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
DeleteDC
DeleteObject
EnumFontFamiliesExW
GetClipBox
GetClipRgn
TranslateCharsetInfo
SelectClipRgn
SelectObject
SetLayout
GetLayout
LPtoDP
SetViewportOrgEx
CreateFontIndirectW
GetDeviceCaps
GetStockObject
SetBkMode
BitBlt
GetTextMetricsW
GetObjectW
SetBkColor
CopyMetaFileW
CreateFontW
GetCurrentObject
RestoreDC
SaveDC
StretchBlt
CreateDIBSection
SetDIBColorTable
ExtTextOutW
CreateBitmap
CreatePatternBrush
GetTextColor
IntersectClipRect
SetBrushOrgEx
CreateDIBitmap
SetPixel
SetTextColor

gdiplus

GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmNotifyIME
ImmGetContext

kernel32

Wow64RevertWow64FsRedirection
IsWow64Process
GlobalLock
GlobalUnlock
WaitForMultipleObjects
lstrcmpiW
CreateSemaphoreW
MoveFileW
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetFileInformationByHandleEx
OpenFileById
GetTimeFormatW
GetStringTypeW
GetLocaleInfoW
GetNumberFormatW
GetCurrencyFormatW
ConvertDefaultLocale
EnumSystemLocalesW
K32EnumProcesses
K32GetProcessImageFileNameW
SetUnhandledExceptionFilter
ExitProcess
LoadLibraryA
GetDateFormatW
GetDriveTypeW
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
DisassociateCurrentThreadFromCallback
SubmitThreadpoolWork
StartThreadpoolIo
CancelThreadpoolIo
WritePrivateProfileStringW
ReadDirectoryChangesW
GetCurrentDirectoryW
CompareFileTime
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
LocalFileTimeToFileTime
SetFileTime
ReleaseSemaphore
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
LoadResource
LockResource
SizeofResource
GlobalMemoryStatus
FindResourceW
OpenFileMappingW
GetSystemTimeAsFileTime
GetFileTime
FileTimeToDosDateTime
GlobalAlloc
RegisterApplicationRestart
GetCurrentThread
GlobalSize
GlobalFree
AddAtomW
GetProcessHeap
HeapSetInformation
VirtualProtect
WerRegisterMemoryBlock
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
EncodePointer
UnhandledExceptionFilter
DecodePointer
IsProcessorFeaturePresent
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
InitializeCriticalSectionEx
FlsAlloc
FlsGetValue
FlsFree
Wow64DisableWow64FsRedirection
CloseThreadpoolIo
CreateThreadpoolIo
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
CreateThreadpoolWork
GetVersionExA
GetSystemTime
GlobalMemoryStatusEx
OpenProcess
CreateProcessW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
CreateMutexW
WaitForSingleObject
GetModuleHandleExW
CloseHandle
GetFileAttributesW
OutputDebugStringA
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetVersion
GetVersionExW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount
CreateDirectoryW
RemoveDirectoryW
GetTempFileNameW
Beep
lstrlenW
WideCharToMultiByte
FormatMessageA
SetEvent
ResetEvent
CreateEventW
OpenEventW
GetCurrentProcess
FlushInstructionCache
LocalFree
TerminateProcess
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileW
FindNextChangeNotification
FindNextFileW
CreateFileW
GetFileSize
GetShortPathNameW
SetFileAttributesW
Sleep
GetSystemInfo
GetSystemDirectoryW
GetWindowsDirectoryW
FormatMessageW
CopyFileW
VirtualQuery
FreeLibrary
SetDllDirectoryW
LocalAlloc
FindAtomW
SetProcessDEPPolicy
LoadLibraryExW
lstrlenA
CompareStringW
MultiByteToWideChar
LCMapStringW
GetUserDefaultLCID
GetCommandLineW
DeleteFileW
FindFirstFileExW
FlushFileBuffers
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetLongPathNameW
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetTempPathW
DebugBreak
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex

msimg32

GradientFill
AlphaBlend

ole32

CoCreateInstance
CoInitializeSecurity
ReleaseStgMedium
OleDuplicateData
DoDragDrop
WriteClassStg
StgCreateDocfile
OleSetClipboard
CreateStreamOnHGlobal
OleGetClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoCreateGuid
ProgIDFromCLSID
CoSetProxyBlanket
StgOpenStorageOnILockBytes
PropVariantClear
CreateBindCtx
CoTaskMemAlloc
IsAccelerator
OleLockRunning
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
StringFromGUID2
CoCreateFreeThreadedMarshaler
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CLSIDFromString
CoTaskMemFree
StringFromIID
CLSIDFromProgID
IIDFromString

oleaut32

VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCopyData
SafeArrayCreate
SysReAllocStringLen
SysAllocStringLen
VariantChangeType
UnRegisterTypeLibForUser
RegisterTypeLibForUser
CreateErrorInfo
VarDateFromStr
VariantTimeToSystemTime
GetErrorInfo
SetErrorInfo
LoadTypeLibEx
VariantChangeTypeEx
VariantCopyInd
SafeArrayGetVartype
VariantClear
SafeArrayCreateVector
SysFreeString
SysStringLen
VariantInit
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
LoadTypeLi
LoadRegTypeLi

Exports

Exports

?DumpBinary@@YGXPAUIGrooveByteInputStream@@@Z
?DumpBinary@@YGXXZ
?DumpCommand@@YGXPAUIGrooveUICommand2@@@Z
?DumpCommandContainer@@YGXPAUIGrooveUICommandContainer3@@@Z
?DumpDisseminatedDesign@@YGXXZ
?DumpDynamicsDocument@@YGXPAVGCoDynamics@@@Z
?DumpElement@@YGXPAUIGrooveElement@@@Z
?DumpElement@@YGXXZ
?DumpElementToFile@@YGXPAUIGrooveElement@@@Z
?DumpElementToFile@@YGXXZ
?DumpFileSystemRecords@@YGXXZ
?DumpFileSystemSchema@@YGXXZ
?DumpRAFPropertyList@@YGXXZ
?DumpRecord3@@YGXPAUIGrooveRecord3@@@Z
?DumpRecord3@@YGXXZ
?DumpRecord3ToString@@YGXAAVGCStackStrBase@@@Z
?DumpRecord3ToString@@YGXPAUIGrooveRecord3@@AAVGCStackStrBase@@@Z
?DumpRecord@@YGXPAUIGrooveRecord@@@Z
?DumpRecord@@YGXXZ
?DumpSandboxedDesign@@YGXXZ
?DumpSiteCatalog@@YGXXZ
?DumpSiteCatalogToolEntry@@YGXXZ
?DumpSystemRecords@@YGXXZ
?DumpTable@@YGXPAUIGrooveTable@@@Z
?DumpTable@@YGXXZ
?DumpUserDataRecords@@YGXXZ
?DumpUserDataSchema@@YGXXZ
?DumpWSSHostCache@@YGXXZ
?DumpWSSSiteCache@@YGXXZ
?FormatDateTime@@YGXXZ
?g_pDumpTable@@3PAUIGrooveTable@@A
SPWChainCoCreateInstance
SPWChainGetGlobalInterfacePtrAddress

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 74KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e1b47e1a00d7c7fc892d5c52922379f

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88Certificate

Extended Key Usages

Key Usages

61:02:8e:42:00:00:00:00:00:1fCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

4f:d3:03:a2:28:93:ae:f4:8f:01:41:92:1c:9a:9e:6e:76:90:6c:89Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

msvcp100

atl100

advapi32

cabinet

gdi32

gdiplus

imm32

kernel32

msimg32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.data Size: 74KB - Virtual size: 75KB

.rsrc Size: 147KB - Virtual size: 147KB

.reloc Size: 438KB - Virtual size: 438KB

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

61:02:8e:42:00:00:00:00:00:1f
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

4f:d3:03:a2:28:93:ae:f4:8f:01:41:92:1c:9a:9e:6e:76:90:6c:89
Signer

.text
Size: 7.1MB - Virtual size: 7.1MB

.data
Size: 74KB - Virtual size: 75KB

.rsrc
Size: 147KB - Virtual size: 147KB

.reloc
Size: 438KB - Virtual size: 438KB