DisplayLink_7[.]7M4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DisplayLink_7.7M4.exe
Size

20.2MB
MD5

49258f8534979697b2117b80755f08f2
SHA1

637616834393b2eaf1b76987e442872e0b01dd12
SHA256

f4915a6babd1dea95496e0badb0d582394976ca1fb24bd4dff804698f3e771d2
SHA512

870f323c64c02c7a840474e8cb7a748c1d0061e01d526d114f6aa3597454c89e2dc44bc6072b0c609efa63b0fff4c51a43c24d226ff1638475bc023f929a832c
SSDEEP

393216:k5LcdcHAQ8wP0vhqXGaMaBvnmsjyG8QBjof2WVVGeJkusmdPjso:QNf90WGaRbv8QB6VlsmH

Score

1^/10

Malware Config

Signatures

Files

DisplayLink_7.7M4.exe
.exe windows:5 windows x86 arch:x86

07aba3fcf11f244c2be77902429dded0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

73:d1:49:28:54:f5:a6:1b:01:ee:5f:e8:c8:a8:50:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/11/2014, 00:00

Not After

02/01/2018, 23:59

Subject

CN=DISPLAYLINK,O=DISPLAYLINK,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f5:e4:15:fe:23:dd:a0:ae:60:57:c6:5e:85:91:a4:b0:4d:ed:bd:33
Signer

Actual PE Digest

f5:e4:15:fe:23:dd:a0:ae:60:57:c6:5e:85:91:a4:b0:4d:ed:bd:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\CCNet\sw\branches\R7.7\01-devel\CLEAN\nivo\bin\Win32\Setup.pdb

Imports

setupapi

SetupGetInfFileListW
SetupDiClassNameFromGuidW
CM_Locate_DevNodeA
CM_Get_Sibling
CM_Get_DevNode_Registry_PropertyA
CM_Get_Child
SetupDiSetDeviceInstallParamsA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDriverInfoList
SetupDiEnumDriverInfoA
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceInstallParamsA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetINFClassW
SetupPromptReboot

kernel32

CloseHandle
WriteFile
SetFilePointer
GetStringTypeExA
LCMapStringA
GetStringTypeExW
LoadLibraryA
ReadFile
CreateFileW
CreateFileA
GetFileAttributesW
CreateDirectoryW
LockResource
GetProcAddress
GetLastError
SizeofResource
MoveFileExW
LoadResource
FreeLibrary
FindResourceW
CreateMutexW
SetCurrentDirectoryW
GetBinaryTypeW
CopyFileW
OutputDebugStringW
GetModuleHandleW
FindResourceExW
LocalFree
FormatMessageW
IsValidLocale
GetUserDefaultUILanguage
GetStdHandle
DeleteFileW
GetFullPathNameW
GetTempFileNameW
SetFileAttributesW
GetTempPathW
WaitForSingleObject
Sleep
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
OpenProcess
IsDebuggerPresent
RaiseException
GetCurrentProcess
GetCurrentThreadId
GetLocalTime
CreateThread
GetCurrentThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
VerSetConditionMask
GetVersionExA
IsWow64Process
LoadLibraryExA
VerifyVersionInfoW
FindClose
FindFirstFileW
FindNextFileW
SetLastError
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetModuleFileNameW
GetSystemWow64DirectoryW
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
FindFirstFileA
FindNextFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
OutputDebugStringA
FileTimeToSystemTime
SetEvent
ResetEvent
CreateEventA
WaitForMultipleObjects
LoadLibraryExW
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
GetCommandLineA
RtlUnwind
IsProcessorFeaturePresent
AreFileApisANSI
GetSystemTimeAsFileTime
GetFileType
GetModuleHandleExW
WriteConsoleW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetStartupInfoW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
HeapSize
GetProcessHeap
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
VirtualQuery
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
ReadConsoleW
SetEndOfFile
SetEnvironmentVariableA
HeapAlloc

user32

GetClientRect
GetDlgCtrlID
SendDlgItemMessageW
EndDialog
DialogBoxIndirectParamW
EnumChildWindows
GetWindowTextW
MessageBoxA
GetUserObjectInformationA
GetThreadDesktop
CloseDesktop
GetSysColor
OpenInputDesktop
OpenDesktopA
GetWindowLongA
CreateWindowExW
DestroyIcon
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcA
DispatchMessageW
CopyRect
SetWindowTextW
SendMessageW
IsWindow
CreateDialogParamW
ShowWindow
SetWindowPos
GetParent
GetSysColorBrush
FillRect
SetThreadDesktop
LoadIconW
SetWindowLongW
GetWindowLongW
DrawFocusRect
ScreenToClient
RemovePropW
GetPropW
SetCursor
LoadCursorW
MessageBoxW
DestroyWindow
GetWindowRect
SystemParametersInfoW
LoadStringA
GetClassInfoExW
LoadStringW
SetPropW
InvalidateRect
ReleaseDC
GetMessageW
PostMessageW
TranslateMessage
IsDialogMessageW
OffsetRect
GetDlgItem
GetDesktopWindow
ChangeDisplaySettingsExA
EnumDisplaySettingsA
EnumDisplayDevicesA
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
EnumWindows
GetMessageA
DispatchMessageA
PostThreadMessageA
CallWindowProcW
SetCapture
ReleaseCapture
GetDC
SetWindowLongA

advapi32

SetEntriesInAclA
GetSecurityInfo
SetSecurityInfo
ConvertSecurityDescriptorToStringSecurityDescriptorA
QueryServiceStatusEx
OpenServiceA
LookupAccountSidA
StartServiceA
ControlService
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
GetLengthSid
CopySid
RegEnumValueW
RegEnumKeyW
RegDeleteKeyW
RegEnumValueA
RegEnumKeyExA
RegOpenUserClassesRoot
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegOpenCurrentUser
RegSetValueExA
RegDeleteValueA
OpenSCManagerA
CloseServiceHandle
RegSetValueExW
RegOpenKeyExA
RegFlushKey
RegDeleteValueW
RegCreateKeyExW
GetUserNameW
RegDeleteKeyA
RegCreateKeyExA
DuplicateToken
OpenThreadToken
CreateProcessAsUserW
OpenProcessToken
DuplicateTokenEx
SetThreadToken

crypt32

CertFindCertificateInStore
CertGetNameStringW
CryptMsgGetParam
CryptMsgClose
CryptQueryObject
CertCloseStore
CertFreeCertificateContext

wintrust

WinVerifyTrust

shlwapi

SHDeleteKeyA

comctl32

InitCommonControlsEx

userenv

LoadUserProfileA
UnloadUserProfile
LoadUserProfileW

msi

ord205
ord204

dbghelp

MiniDumpWriteDump

gdi32

SetTextColor
CreateFontIndirectW
DeleteObject
SetBkMode
GetObjectW

shell32

SHFileOperationW
ShellExecuteW

Sections

.text
Size: 984KB - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.8MB - Virtual size: 18.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07aba3fcf11f244c2be77902429dded0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

73:d1:49:28:54:f5:a6:1b:01:ee:5f:e8:c8:a8:50:5bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f5:e4:15:fe:23:dd:a0:ae:60:57:c6:5e:85:91:a4:b0:4d:ed:bd:33Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

user32

advapi32

crypt32

wintrust

shlwapi

comctl32

userenv

msi

dbghelp

gdi32

shell32

Sections

.text Size: 984KB - Virtual size: 984KB

.rdata Size: 344KB - Virtual size: 343KB

.data Size: 38KB - Virtual size: 95KB

.rsrc Size: 18.8MB - Virtual size: 18.8MB

.reloc Size: 58KB - Virtual size: 57KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

73:d1:49:28:54:f5:a6:1b:01:ee:5f:e8:c8:a8:50:5b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f5:e4:15:fe:23:dd:a0:ae:60:57:c6:5e:85:91:a4:b0:4d:ed:bd:33
Signer

.text
Size: 984KB - Virtual size: 984KB

.rdata
Size: 344KB - Virtual size: 343KB

.data
Size: 38KB - Virtual size: 95KB

.rsrc
Size: 18.8MB - Virtual size: 18.8MB

.reloc
Size: 58KB - Virtual size: 57KB