e196728b83f1ab32e0fa08fa8b57b5d0

Sharing

Copy URL Twitter E-mail

General

Target
e196728b83f1ab32e0fa08fa8b57b5d0
Size 1.1MB
Sample240327-nwyrnabc74
SHA256 e9ff045d0824a92b99592d028bcd98d271cf6c8bc152be0184b4d7c7cd88e15f
MD5 e196728b83f1ab32e0fa08fa8b57b5d0
SHA1 b0c96db89c67fa01f09f31f4ac6c3c509b1e4b1a
SHA512 21f9cca508e5debd68ebba79a8e9b0892274c639ef274e5dc755036d589f63a85ab1c42eaa781f61622bc0587b773709503cfccdea912e9a54897c04b71ed7f7
SSDEEP 24576:4HJPPbNKyO7Jp+Iwkymo73EhLHHI1FN9f/8RJ:y3bsyOjvyP3ElHHMFjf/YJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e196728b83f1ab32e0fa08fa8b57b5d0

.dll 1.1MB

e196728b83f1ab32e0fa08fa8b57b5d0

IMPHASH 5af596e33214a9fd4a197c938e61cd06
SHA256 e9ff045d0824a92b99592d028bcd98d271cf6c8bc152be0184b4d7c7cd88e15f
MD5 e196728b83f1ab32e0fa08fa8b57b5d0
SHA1 b0c96db89c67fa01f09f31f4ac6c3c509b1e4b1a
SHA512 21f9cca508e5debd68ebba79a8e9b0892274c639ef274e5dc755036d589f63a85ab1c42eaa781f61622bc0587b773709503cfccdea912e9a54897c04b71ed7f7
SSDEEP 24576:4HJPPbNKyO7Jp+Iwkymo73EhLHHI1FN9f/8RJ:y3bsyOjvyP3ElHHMFjf/YJ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

40:d4:bd:57:f5:03:95:23:94:5f:17:8c:a8:d8:48:5c:79:04:c9:88

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Smart Shopper Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Smart Shopper Inc,L=Wilmington,ST=Delaware,C=US

Chains

Jan 27, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Smart Shopper Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Smart Shopper Inc,L=Wilmington,ST=Delaware,C=US

Serial Number

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6c

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2008 - Oct 7, 2010

Minor OS version

Major OS version

Entry point

635768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\100126_173414_build_SmartShopper_Build_SmartShopper_2.6.71.0\source\source_sms\bin\ShoppingReport.pdb

kernel32

HeapFree GetCurrentProcess SetLastError CreateDirectoryA SetCurrentDirectoryA GetCurrentDirectoryA GetWindowsDirectoryA GetModuleHandleA CompareStringA GetCurrentProcessId VirtualQuery GetModuleFileNameA HeapReAlloc lstrlenA WaitForSingleObject GetSystemDirectoryA LoadLibraryA GetTickCount LocalAlloc LockResource GetDriveTypeA LoadResource FlushInstructionCache LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection SetEnvironmentVariableA SetConsoleCtrlHandler SetStdHandle GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID IsBadCodePtr IsBadReadPtr GetOEMCP GetTimeZoneInformation GetDateFormatA GetTimeFormatA UnhandledExceptionFilter GetEnvironmentStrings RaiseException GetStartupInfoA GetFileType SizeofResource SetHandleCount LCMapStringA TerminateProcess TlsGetValue TlsSetValue TlsFree TlsAlloc QueryPerformanceCounter FatalAppExitA VirtualFree HeapCreate GetLocalTime GetCommandLineA GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind GetSystemTimeAsFileTime ExitProcess HeapSize HeapDestroy GetVersionExA MoveFileExW CreateFileA DeleteFileA GetSystemDefaultLangID GlobalHandle GlobalFree PulseEvent ReleaseSemaphore WriteFile ReadFile FlushFileBuffers SetFilePointer GetFileSize SetEndOfFile CreateThread TerminateThread SetThreadPriority ResumeThread GetCurrentThread IsBadWritePtr SetUnhandledExceptionFilter MulDiv GlobalAlloc GlobalLock GlobalUnlock GetFileTime SystemTimeToFileTime SetFileTime Sleep FindClose GetSystemTime FileTimeToSystemTime GetExitCodeProcess WaitForMultipleObjects MapViewOfFile UnmapViewOfFile ResetEvent SetEvent ReleaseMutex CloseHandle LocalFree FreeLibrary InterlockedDecrement InterlockedIncrement GetLastError GetCurrentThreadId HeapAlloc GetStdHandle GetProcessHeap GetThreadLocale GetLocaleInfoA GetACP FreeEnvironmentStringsA InterlockedExchange GetFullPathNameA

advapi32

GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorSacl RegCloseKey

user32

InvalidateRgn GetDesktopWindow GetSysColor EndPaint BeginPaint SetFocus IsChild GetFocus GetDlgItem RedrawWindow TranslateMessage MsgWaitForMultipleObjects UpdateWindow GetTopWindow InvalidateRect GetKeyState SetWindowRgn BringWindowToTop MapWindowPoints EnumChildWindows OffsetRect InflateRect KillTimer DestroyWindow ReleaseDC GetDC ShowWindow IsWindow GetParent GetClientRect CopyRect MoveWindow EqualRect GetWindowRect IsIconic IsWindowVisible SetTimer ReplyMessage FillRect SetCapture ReleaseCapture UnregisterClassA EnumWindows SetRectEmpty GetSysColorBrush DestroyAcceleratorTable GetWindow MapDialogRect SetWindowContextHelpId SetWindowPos

gdi32

DeleteObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC GetStockObject BitBlt GetDeviceCaps CreateSolidBrush CreateRectRgn CombineRgn CreatePolygonRgn CreateRoundRectRgn OffsetRgn FillRgn SelectObject

sensapi

IsNetworkAlive

version

GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA VerQueryValueW VerQueryValueA GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc StringFromGUID2 StringFromCLSID CoCreateGuid CoCreateInstance ProgIDFromCLSID CreateStreamOnHGlobal OleInitialize OleUninitialize OleLockRunning CoGetClassObject CLSIDFromProgID OleRun CoUninitialize CoInitialize CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CLSIDFromString

oleaut32

VarBstrCat SysAllocString SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen SysAllocStringLen VarUI4FromStr LoadRegTypeLi LoadTypeLi VariantClear DispCallFunc VariantInit VariantChangeType UnRegisterTypeLi RegisterTypeLi GetErrorInfo SetErrorInfo CreateErrorInfo OleCreateFontIndirect VariantCopy VarBstrCmp SafeArrayLock SafeArrayUnlock SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate SafeArrayDestroy SafeArrayCopy SystemTimeToVariantTime VariantTimeToSystemTime VectorFromBstr SafeArrayGetDim SafeArrayGetElement SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement VarUdateFromDate SafeArrayGetVartype BstrFromVector

shlwapi

StrToIntW StrRChrW PathFileExistsW PathFindExtensionW

urlmon

CreateURLMoniker

ws2_32

inet_addr WSAGetLastError gethostbyname inet_ntoa htonl getservbyname htons gethostbyaddr ntohs getservbyport WSASetLastError WSACleanup WSACloseEvent WSAEnumNetworkEvents WSAConnect WSAGetOverlappedResult WSASend WSAResetEvent WSARecv WSAEventSelect WSASetEvent WSACreateEvent WSAStartup closesocket WSASocketW

comctl32

_TrackMouseEvent ord17 ImageList_GetImageCount ImageList_ReplaceIcon

crypt32

CryptMsgGetParam CertGetNameStringW CryptMsgClose CertCloseStore CertFreeCertificateContext CryptQueryObject CertFindCertificateInStore

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

e196728b83f1ab32e0fa08fa8b57b5d0

PE Signature issue

kernel32

advapi32

user32

gdi32

sensapi

version

iphlpapi

ole32

oleaut32

shlwapi

urlmon

ws2_32

comctl32

crypt32

shell32

generic