e00fa2b3277b504f4ac9aef5ec44f320

Sharing

Copy URL Twitter E-mail

General

Target

e00fa2b3277b504f4ac9aef5ec44f320
Size

792KB
MD5

e00fa2b3277b504f4ac9aef5ec44f320
SHA1

14919260ea4e27fcd68e86c0f5072dd2db485684
SHA256

4a7edae00da50eb04a3b597cb6a97dff18afab9d7f1c21bdfa9a4d85a45af0de
SHA512

b273fced8324e73258718e66f55b33e9d1d063d741e16542d83c6af5c5767f65f20d4cdeb69e7d84ff36cf7d4c11f1ea54895300613b5e7fade6e514ea00f1da
SSDEEP

24576:tnMfcHr/hMUOqEaHJLQ+pBPL3kVlCSEe865VGxWsgqrP:tnMqeUOqB/PTOwSEe865iHP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
static1/unpack001/$DESKTOP/temp/TeamViewer3/TeamViewer_.exe	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$DESKTOP/temp/TeamViewer3/TV.dll
unpack002/$PLUGINSDIR/GetVersion.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/out.upx
unpack001/out.upx

Files

e00fa2b3277b504f4ac9aef5ec44f320
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2007, 00:00

Not After

21/02/2008, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:4e:65:13:bc:3c:61:97:e7:79:86:b6:70:d1:cc:1e:25:fb:f5:25
Signer

Actual PE Digest

7f:4e:65:13:bc:3c:61:97:e7:79:86:b6:70:d1:cc:1e:25:fb:f5:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$DESKTOP/temp/TeamViewer3/TeamViewer_.exe
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2007, 00:00

Not After

21/02/2008, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:2a:42:61:c1:cd:f0:3a:fe:e6:12:72:71:0d:93:6c:6a:35:2a:ce
Signer

Actual PE Digest

61:2a:42:61:c1:cd:f0:3a:fe:e6:12:72:71:0d:93:6c:6a:35:2a:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$DESKTOP/temp/TeamViewer3/TV.dll
.dll windows:4 windows x86 arch:x86

2fc47df7b965c898518d83f04434b280

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenMutexA
HeapAlloc
LoadLibraryA
HeapFree
FreeLibrary
GetProcAddress
CloseHandle
ReleaseMutex
OutputDebugStringA
CreateMutexA
GetProcessHeap
WaitForSingleObject

user32

SetWindowsHookExA
ClientToScreen
UnionRect
SetRect
GetWindowThreadProcessId
RegisterWindowMessageA
SetRectEmpty
FindWindowA
MapWindowPoints
GetClientRect
FindWindowExA
IsWindowVisible
CallNextHookEx
UnhookWindowsHookEx
GetUpdateRgn
GetDesktopWindow
SetWindowPos
IsWindow
GetWindowRect
PostMessageA
GetWindowDC
ReleaseDC

gdi32

Rectangle
SelectObject
DeleteObject
GetRegionData
GetStockObject
CreatePen
CreateRectRgn

Exports

Exports

GetChangeRect
GetPauseStatus
SetSingleWindow
StartHooks
StopHooks

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sharedv
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 562B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TeamViewer.exe
.exe windows:4 windows x86 arch:x86

762c314d6d3108e55e42125cb6d9a2cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2007, 00:00

Not After

21/02/2008, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ac:97:f8:ee:2e:55:59:2b:7e:90:b2:56:92:3d:d8:7c:0b:8d:09:99
Signer

Actual PE Digest

ac:97:f8:ee:2e:55:59:2b:7e:90:b2:56:92:3d:d8:7c:0b:8d:09:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer\TeamViewer\qs_release\TeamViewer.pdb

Imports

comctl32

ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Create
InitCommonControlsEx
ImageList_LoadImageW

iphlpapi

GetAdaptersInfo

mpr

WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW

kernel32

QueryPerformanceCounter
SetHandleCount
GetEnvironmentStrings
FreeEnvironmentStringsA
GetOEMCP
GetConsoleMode
GetConsoleCP
HeapCreate
ExitThread
GetDateFormatA
GetTimeFormatA
GetStringTypeA
LCMapStringA
ExitProcess
GetStdHandle
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
ReleaseSemaphore
CreateSemaphoreA
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
lstrcmpW
GetCurrentThread
SetThreadPriority
ResumeThread
CreateThread
CreateEventA
SetEvent
GetVersionExW
GlobalFree
GetCurrentProcessId
CreateFileA
SetUnhandledExceptionFilter
InterlockedExchange
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetLocalTime
CompareFileTime
GetFileTime
SetFileTime
GetFileType
SetEndOfFile
SetFilePointer
ReadFile
SetErrorMode
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
ResetEvent
WaitForSingleObject
FlushFileBuffers
LocalFree
WriteFile
GetModuleFileNameA
GetCommandLineW
ReleaseMutex
InterlockedDecrement
OpenProcess
InterlockedIncrement
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
FreeLibrary
UnmapViewOfFile
CloseHandle
Sleep
MulDiv
SetProcessShutdownParameters
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
LoadResource
LockResource
SizeofResource
RaiseException
GetTickCount
GetSystemTime
SetLastError
FlushInstructionCache
GetLastError
GetCurrentProcess
LeaveCriticalSection
VirtualQuery
EnterCriticalSection
GetCurrentThreadId
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableA
RtlUnwind

user32

DrawFocusRect
GetSystemMenu
GetSysColor
PtInRect
EndDeferWindowPos
BeginDeferWindowPos
GetCapture
GetMessagePos
GetWindowPlacement
SetWindowPlacement
DrawEdge
GetNextDlgTabItem
DestroyAcceleratorTable
FillRect
SetRectEmpty
FlashWindow
GetDialogBaseUnits
DeferWindowPos
MapDialogRect
SetCapture
ReleaseCapture
GetShellWindow
TrackPopupMenuEx
GetSubMenu
GetDlgCtrlID
PostQuitMessage
EnableMenuItem
GetMenu
BringWindowToTop
MessageBoxA
UnhookWindowsHookEx
DestroyCursor
GetFocus
ToUnicode
GetKeyboardState
ToAscii
GetAsyncKeyState
GetKeyState
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
MessageBeep
GetDlgItemTextA
CreateWindowExA
ScreenToClient
GetGUIThreadInfo
GetWindowThreadProcessId
BlockInput
ChangeClipboardChain
SetClipboardViewer
SendInput
IntersectRect
GetIconInfo
GetCursorInfo
GetWindowDC
UnionRect
EnumWindows
WindowFromPoint
CloseDesktop
GetUserObjectInformationW
FrameRect
ClientToScreen
OpenDesktopW
UnregisterClassA
GetMenuStringW
RegisterWindowMessageW
GetDC
GetScrollInfo
UpdateWindow
SetScrollPos
BeginPaint
SetParent
CallNextHookEx
EndPaint
InvalidateRect
MoveWindow
ReleaseDC
InvalidateRgn
GetMenuItemInfoW
IsWindow
GetCursorPos
GetWindow
GetWindowRect
GetParent
MapWindowPoints
SetWindowPos
ScrollWindowEx
GetDlgItem
TranslateMessage
OffsetRect
IsWindowVisible
ShowWindow
CreateIconIndirect
DestroyWindow
DestroyIcon
SetCursor
SetForegroundWindow
SetCursorPos
GetClientRect
SetScrollInfo
InflateRect
KillTimer
SetTimer
EndDialog
GetActiveWindow
SetWindowRgn
ShowScrollBar
AdjustWindowRect
SetFocus
CopyRect
GetSystemMetrics
OpenInputDesktop
SetThreadDesktop
SetRect
EqualRect
RedrawWindow
GetThreadDesktop
GetForegroundWindow

gdi32

MaskBlt
PatBlt
CreatePatternBrush
SetDIBitsToDevice
DPtoLP
CreatePen
CreateSolidBrush
StrokeAndFillPath
EndPath
BeginPath
SetBkMode
GetPixel
CreateBitmap
GetDIBits
GetSystemPaletteEntries
CreateRoundRectRgn
LineTo
GetDeviceCaps
CombineRgn
CreateRectRgn
CreatePalette
DeleteDC
DeleteObject
SelectObject
SetPixel
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
RealizePalette
SelectPalette
SetBrushOrgEx
StretchBlt
SetBkColor
GetObjectType
SetTextColor
SetViewportOrgEx
MoveToEx
ExtEscape
Rectangle
SetStretchBltMode
GetStockObject
RoundRect
BitBlt

advapi32

SetSecurityDescriptorDacl
RegCloseKey
CryptDestroyHash
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
CryptGetUserKey
CryptDecrypt
CryptEncrypt
CryptVerifySignatureW
CryptSignHashW
CryptReleaseContext
CryptAcquireContextA
CryptGenKey
CryptGetKeyParam
RegQueryValueExA
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptImportKey
CryptExportKey
CreateProcessAsUserW
RegOpenKeyW
DuplicateTokenEx
SetTokenInformation
CryptDestroyKey
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor

shell32

CommandLineToArgvW
SHGetSpecialFolderLocation

ole32

RevokeDragDrop
CoTaskMemRealloc
CoCreateInstance
RegisterDragDrop
OleInitialize
ReleaseStgMedium
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathCompactPathW

wsock32

htonl
bind
listen
accept
connect
getsockname
getpeername
send
WSAGetLastError
__WSAFDIsSet
recvfrom
select
recv
inet_ntoa
sendto
socket
setsockopt
gethostname
gethostbyname
ntohs
inet_addr
htons
WSAStartup
WSACleanup
shutdown
closesocket
ioctlsocket

wininet

InternetConnectW
HttpSendRequestA
InternetGoOnlineA
HttpQueryInfoA
InternetErrorDlg
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryOptionW
InternetCloseHandle
InternetOpenW
InternetSetOptionW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/temp/TeamViewer3/TeamViewer.ini
$DESKTOP/temp/TeamViewer3/logo.bmp
$PLUGINSDIR/GetVersion.dll
.dll windows:4 windows x86 arch:x86

add11ce79d4925abda7b305cc53287d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetVersionExA
GetProcAddress
GetModuleHandleA
lstrcmpiA
FreeLibrary
GlobalAlloc
lstrcatA
lstrcpynA

user32

wsprintfA
GetSystemMetrics

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

IEVersion
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsType
WindowsVersion

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

70dd3dc09a6a9df40b2eeb3eb051c3ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
SetLastError
CloseHandle
GlobalFree
LocalFree
FormatMessageA
MultiByteToWideChar
GetLastError
CreateProcessA
GlobalAlloc
lstrlenA
LoadLibraryA
FreeLibrary
lstrcatA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiA
lstrcpyA
GetVersionExA
GetCurrentProcess
GetCurrentThread
GetCurrentProcessId
Sleep
CreateThread
GetStartupInfoA
GetCommandLineA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA

user32

EnableWindow
GetWindowLongA
DestroyWindow
LoadImageA
SetWindowLongA
EndDialog
MessageBoxA
SendMessageW
DialogBoxParamA
CharNextA
SendMessageTimeoutA
DefWindowProcA
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
PostMessageA
IsWindow
ShowWindow
SetWindowTextA
wsprintfA
GetDlgItem
LoadStringA
SendMessageA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteExA

ole32

CoInitialize
CoUninitialize

Exports

Exports

Exec
ExecCodeSegment
ExecWait
GetElevationType
IsAdmin
RunElevated
ShellExec
ShellExecWait
SupportsUAC
Unload

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

6bc108eed3ca99f68adee56e9c99fac6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 657B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 85B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5Certificate

Extended Key Usages

Key Usages

7f:4e:65:13:bc:3c:61:97:e7:79:86:b6:70:d1:cc:1e:25:fb:f5:25Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 188KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 24KB - Virtual size: 24KB

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5Certificate

Extended Key Usages

Key Usages

61:2a:42:61:c1:cd:f0:3a:fe:e6:12:72:71:0d:93:6c:6a:35:2a:ceSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 180KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 4KB

2fc47df7b965c898518d83f04434b280

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 36B

.sharedv Size: 512B - Virtual size: 64B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 562B

762c314d6d3108e55e42125cb6d9a2cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5Certificate

Extended Key Usages

Key Usages

ac:97:f8:ee:2e:55:59:2b:7e:90:b2:56:92:3d:d8:7c:0b:8d:09:99Signer

Headers

File Characteristics

PDB Paths

Imports

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

7f:4e:65:13:bc:3c:61:97:e7:79:86:b6:70:d1:cc:1e:25:fb:f5:25
Signer

UPX0
Size: - Virtual size: 188KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 24KB - Virtual size: 24KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

61:2a:42:61:c1:cd:f0:3a:fe:e6:12:72:71:0d:93:6c:6a:35:2a:ce
Signer

UPX0
Size: - Virtual size: 180KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 36B

.sharedv
Size: 512B - Virtual size: 64B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 562B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

09:93:02:9b:c5:50:fb:0a:04:cc:b4:bd:26:41:34:d5
Certificate

ac:97:f8:ee:2e:55:59:2b:7e:90:b2:56:92:3d:d8:7c:0b:8d:09:99
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 278KB - Virtual size: 278KB

.data
Size: 116KB - Virtual size: 398KB

.rsrc
Size: 176KB - Virtual size: 176KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 180B

.reloc
Size: 512B - Virtual size: 368B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 812B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B