e196728b83f1ab32e0fa08fa8b57b5d0

Sharing

Copy URL Twitter E-mail

General

Target

e196728b83f1ab32e0fa08fa8b57b5d0
Size

1.1MB
MD5

e196728b83f1ab32e0fa08fa8b57b5d0
SHA1

b0c96db89c67fa01f09f31f4ac6c3c509b1e4b1a
SHA256

e9ff045d0824a92b99592d028bcd98d271cf6c8bc152be0184b4d7c7cd88e15f
SHA512

21f9cca508e5debd68ebba79a8e9b0892274c639ef274e5dc755036d589f63a85ab1c42eaa781f61622bc0587b773709503cfccdea912e9a54897c04b71ed7f7
SSDEEP

24576:4HJPPbNKyO7Jp+Iwkymo73EhLHHI1FN9f/8RJ:y3bsyOjvyP3ElHHMFjf/YJ

Score

1^/10

Malware Config

Signatures

Files

e196728b83f1ab32e0fa08fa8b57b5d0
.dll regsvr32 windows:4 windows x86 arch:x86

5af596e33214a9fd4a197c938e61cd06

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/10/2008, 00:00

Not After

07/10/2010, 23:59

Subject

CN=Smart Shopper Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Smart Shopper Inc,L=Wilmington,ST=Delaware,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

40:d4:bd:57:f5:03:95:23:94:5f:17:8c:a8:d8:48:5c:79:04:c9:88
Signer

Actual PE Digest

40:d4:bd:57:f5:03:95:23:94:5f:17:8c:a8:d8:48:5c:79:04:c9:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\100126_173414_build_SmartShopper_Build_SmartShopper_2.6.71.0\source\source_sms\bin\ShoppingReport.pdb

Imports

kernel32

HeapFree
GetCurrentProcess
SetLastError
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetCurrentProcessId
VirtualQuery
GetModuleFileNameA
HeapReAlloc
lstrlenA
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
GetTickCount
LocalAlloc
LockResource
GetDriveTypeA
LoadResource
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
UnhandledExceptionFilter
GetEnvironmentStrings
RaiseException
GetStartupInfoA
GetFileType
SizeofResource
SetHandleCount
LCMapStringA
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
QueryPerformanceCounter
FatalAppExitA
VirtualFree
HeapCreate
GetLocalTime
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
HeapSize
HeapDestroy
GetVersionExA
MoveFileExW
CreateFileA
DeleteFileA
GetSystemDefaultLangID
GlobalHandle
GlobalFree
PulseEvent
ReleaseSemaphore
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
SetEndOfFile
CreateThread
TerminateThread
SetThreadPriority
ResumeThread
GetCurrentThread
IsBadWritePtr
SetUnhandledExceptionFilter
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileTime
SystemTimeToFileTime
SetFileTime
Sleep
FindClose
GetSystemTime
FileTimeToSystemTime
GetExitCodeProcess
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
ResetEvent
SetEvent
ReleaseMutex
CloseHandle
LocalFree
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentThreadId
HeapAlloc
GetStdHandle
GetProcessHeap
GetThreadLocale
GetLocaleInfoA
GetACP
FreeEnvironmentStringsA
InterlockedExchange
GetFullPathNameA

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl
RegCloseKey

user32

InvalidateRgn
GetDesktopWindow
GetSysColor
EndPaint
BeginPaint
SetFocus
IsChild
GetFocus
GetDlgItem
RedrawWindow
TranslateMessage
MsgWaitForMultipleObjects
UpdateWindow
GetTopWindow
InvalidateRect
GetKeyState
SetWindowRgn
BringWindowToTop
MapWindowPoints
EnumChildWindows
OffsetRect
InflateRect
KillTimer
DestroyWindow
ReleaseDC
GetDC
ShowWindow
IsWindow
GetParent
GetClientRect
CopyRect
MoveWindow
EqualRect
GetWindowRect
IsIconic
IsWindowVisible
SetTimer
ReplyMessage
FillRect
SetCapture
ReleaseCapture
UnregisterClassA
EnumWindows
SetRectEmpty
GetSysColorBrush
DestroyAcceleratorTable
GetWindow
MapDialogRect
SetWindowContextHelpId
SetWindowPos

gdi32

DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateRectRgn
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
OffsetRgn
FillRgn
SelectObject

sensapi

IsNetworkAlive

version

GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
StringFromCLSID
CoCreateGuid
CoCreateInstance
ProgIDFromCLSID
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
OleRun
CoUninitialize
CoInitialize
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CLSIDFromString

oleaut32

VarBstrCat
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VariantClear
DispCallFunc
VariantInit
VariantChangeType
UnRegisterTypeLi
RegisterTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleCreateFontIndirect
VariantCopy
VarBstrCmp
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
VectorFromBstr
SafeArrayGetDim
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayPutElement
VarUdateFromDate
SafeArrayGetVartype
BstrFromVector

shlwapi

StrToIntW
StrRChrW
PathFileExistsW
PathFindExtensionW

urlmon

CreateURLMoniker

ws2_32

inet_addr
WSAGetLastError
gethostbyname
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
ntohs
getservbyport
WSASetLastError
WSACleanup
WSACloseEvent
WSAEnumNetworkEvents
WSAConnect
WSAGetOverlappedResult
WSASend
WSAResetEvent
WSARecv
WSAEventSelect
WSASetEvent
WSACreateEvent
WSAStartup
closesocket
WSASocketW

comctl32

_TrackMouseEvent
ord17
ImageList_GetImageCount
ImageList_ReplaceIcon

crypt32

CryptMsgGetParam
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CertFindCertificateInStore

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllSendIdsRequestAbort
DllSendIdsRequestAlreadyInstalled
DllSendIdsRequestCancel
DllSendIdsRequestInstalledOnVista
DllSendIdsRequestOk
DllSendUninstallReport
DllUnregisterServer

Sections

.text
Size: 760KB - Virtual size: 757KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5af596e33214a9fd4a197c938e61cd06

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6cCertificate

Extended Key Usages

Key Usages

40:d4:bd:57:f5:03:95:23:94:5f:17:8c:a8:d8:48:5c:79:04:c9:88Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

gdi32

sensapi

version

iphlpapi

ole32

oleaut32

shlwapi

urlmon

ws2_32

comctl32

crypt32

shell32

Exports

Exports

Sections

.text Size: 760KB - Virtual size: 757KB

.rdata Size: 204KB - Virtual size: 203KB

.data Size: 20KB - Virtual size: 31KB

.rsrc Size: 108KB - Virtual size: 106KB

.reloc Size: 56KB - Virtual size: 55KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6c
Certificate

40:d4:bd:57:f5:03:95:23:94:5f:17:8c:a8:d8:48:5c:79:04:c9:88
Signer

.text
Size: 760KB - Virtual size: 757KB

.rdata
Size: 204KB - Virtual size: 203KB

.data
Size: 20KB - Virtual size: 31KB

.rsrc
Size: 108KB - Virtual size: 106KB

.reloc
Size: 56KB - Virtual size: 55KB