Unpark-CPU[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

Unpark-CPU.7z
Size

361KB
MD5

ea025571c770d4a63da208c165ffa0e4
SHA1

1ea0094a188340df2a8efb03b03ef7ae64fc027e
SHA256

ba478441f94f75185acc43319e141641fa7016c46bf5c4779121172e2254ef02
SHA512

d4f778fbbf7016523e325f4b7be83934d2394cf6bfbd0ca8d30f6476fa0d25e447df4aae559a981082ed9d83fd26b4883d4e378d08aab511c2004ec2d4e4fc6e
SSDEEP

6144:c1Kq5/DOOajnF1BYSJ7PEnARHTBPbSAPCuT+1Woc7VTFQ6JufZXvX1X:+Km/DvabrKShPPFexuzTFQ6QfBV

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Interop.MSUtil.dll
unpack001/UnparkCPU.exe

Files

Unpark-CPU.7z
.7z
Interop.MSUtil.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LogParser.dll
.dll regsvr32 windows:5 windows x86 arch:x86

2e2b691177bb4205fc4f5eb9fbd1a8d6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

23/05/2002, 08:00

Not After

25/09/2011, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:87:58:00:03:00:00:00:5a
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2005, 23:20

Not After

05/04/2006, 23:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

77:02:6a:1f:b9:95:c3:57:19:2f:be:52:52:3c:fb:71:fe:ed:4e:3b
Signer

Actual PE Digest

77:02:6a:1f:b9:95:c3:57:19:2f:be:52:52:3c:fb:71:fe:ed:4e:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\enlistments\nt_dnsrv\iistest\tools\logparser\main_com\obj\i386\LogParser.pdb

Imports

mfc42u

ord559
ord2057
ord812
ord6140
ord6139
ord942
ord940
ord2810
ord540
ord541
ord801
ord858
ord6379
ord5436
ord6390
ord5446
ord539
ord538
ord922
ord800
ord3648
ord350
ord3608
ord3126
ord5647
ord3658
ord6874
ord5857
ord535
ord823
ord861
ord5858
ord2058
ord925
ord927
ord6136
ord5854
ord5599
ord2606
ord941
ord654
ord4273
ord341
ord5929
ord3050
ord537
ord4272
ord859
ord4124
ord4197
ord825

msvcrt

_wtoi
_snwprintf
wcscat
wcschr
wcslen
wcsncmp
_wcsnicmp
wcsncat
_itow
_wsetlocale
mbtowc
strncmp
wprintf
time
srand
rand
_wtol
isalpha
memmove
_finite
iswctype
modf
wcsrchr
iswprint
iswalnum
towupper
strchr
wcsncpy
wcsstr
floor
_CIexp
_CIpow
_purecall
iswspace
wcscspn
_vsnwprintf
puts
printf
towlower
wcscpy
swprintf
iswalpha
isdigit
_except_handler3
?terminate@@YAXXZ
realloc
malloc
_onexit
__dllonexit
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
free
strstr
_CIfmod
wcscmp
_CxxThrowException
swscanf
_wcsicmp
__CxxFrameHandler
wcstombs
strncpy
localtime
_snprintf
iswdigit

advapi32

OpenBackupEventLogW
RegQueryValueExW
OpenEventLogW
CloseEventLog
IsValidSid
ControlTraceW
CloseTrace
ProcessTrace
OpenTraceW
RegQueryInfoKeyW
ConvertSidToStringSidW
ConvertStringSidToSidW
GetNumberOfEventLogRecords
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyW
RegEnumKeyExW
LookupAccountSidW
RegEnumValueW
CryptAcquireContextW
CryptReleaseContext
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegConnectRegistryW
IsTextUnicode
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
ReadEventLogW

oleaut32

LoadTypeLibEx
OleLoadPicturePath
SysFreeString
SysStringLen
GetErrorInfo
DispGetIDsOfNames
DispInvoke
SetErrorInfo
SysAllocString
CreateErrorInfo
LoadRegTypeLi
SystemTimeToVariantTime
VariantInit
SafeArrayCreateVector
SafeArrayCreate
VariantTimeToSystemTime
SysAllocStringLen
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
UnRegisterTypeLi
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy

kernel32

DeleteFileW
CreateThread
CreateDirectoryW
SetFilePointerEx
GetACP
WideCharToMultiByte
WaitForSingleObject
GetExitCodeThread
FormatMessageW
LocalFree
GetModuleHandleW
GetProcAddress
WriteFile
WaitForMultipleObjects
ReadConsoleInputW
InterlockedCompareExchange
SetEvent
GetOverlappedResult
CreateEventW
GetComputerNameW
GetFileSizeEx
GetDiskFreeSpaceW
GetStdHandle
SetFilePointer
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
ResetEvent
TerminateProcess
GlobalLock
GlobalUnlock
GlobalFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemDefaultLangID
GetSystemDefaultLCID
FileTimeToSystemTime
SignalObjectAndWait
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
GetLastError
GetModuleHandleA
GetShortPathNameA
GetModuleFileNameA
MultiByteToWideChar
MulDiv
GetProcessAffinityMask
GetCurrentProcess
UnhandledExceptionFilter
Sleep
GetCPInfo
SetUnhandledExceptionFilter
GetVersionExW
LocalAlloc
GetPrivateProfileStringW
EnumSystemLocalesW
LoadLibraryExW
FreeLibrary
SetLastError
GetCalendarInfoW
GetLocaleInfoW
GetTimeZoneInformation
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameW
ExpandEnvironmentStringsW
CloseHandle
CreateFileW
VirtualFree
ReadFile
VirtualAlloc
GetFileSize
GetFileTime
SetFileTime
GetEnvironmentVariableW
InitializeCriticalSection
DeleteCriticalSection
GlobalAlloc

ole32

StringFromCLSID
CoWaitForMultipleHandles
CLSIDFromString
CoCreateInstance
CLSIDFromProgID
CoSetProxyBlanket
CoCreateInstanceEx
CoTaskMemFree

user32

DestroyMenu
TrackPopupMenu
GetSubMenu
LoadMenuW
SetWindowTextW
ShowWindow
SetPropW
CreateDialogParamW
LoadAcceleratorsW
FillRect
DrawTextExW
InvalidateRect
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MessageBoxW
PostQuitMessage
IsWindowEnabled
EnableMenuItem
CheckMenuItem
EnableWindow
ScreenToClient
MoveWindow
GetClientRect
GetPropW
DestroyWindow
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
GetDlgItem
SendMessageW
PostMessageW
GetWindowRect
SystemParametersInfoW
SetTimer
LoadStringW
wsprintfW
ReleaseDC
LoadIconW
SetFocus
GetDC

ws2_32

ntohl
socket
bind
connect
closesocket
send
WSAGetLastError
htons
gethostbyaddr
htonl
ntohs
WSAStartup
inet_addr
gethostbyname

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

activeds

ord3
ord9

odbc32

ord4
ord111
ord127
ord176
ord78
ord29
ord13
ord18
ord43
ord24
ord75
ord139
ord141
ord119
ord12
ord136
ord31
ord9

gdi32

BitBlt
DeleteObject
SelectObject
GetStockObject
GetObjectW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPoint32W
GetTextMetricsW
CreateCompatibleDC
CreateCompatibleBitmap
SetBkColor
SetTextColor
CreateSolidBrush
DeleteDC

comdlg32

ChooseFontW

wininet

HttpQueryInfoW
InternetGetLastResponseInfoW
InternetOpenUrlW
InternetOpenW
InternetReadFile
InternetCloseHandle

netapi32

NetMessageBufferSend

msimg32

GradientFill

crypt32

CryptProtectData
CryptUnprotectData

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 903KB - Virtual size: 902KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 437KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UnparkCPU.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Admin\Desktop\UnparkCPU\obj\x86\Debug\UnparkCPU.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UnparkCPU.vshost.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

69:7d:56:0d:a3:fe:3b:5c:0d:47:01:ed:dc:fa:ab:ea:ea:68:9c:9e
Signer

Actual PE Digest

69:7d:56:0d:a3:fe:3b:5c:0d:47:01:ed:dc:fa:ab:ea:ea:68:9c:9e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\dd\vsproject\vshost\vshost32\objr\i386\vshost32.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UnparkCPU.vshost.exe.manifest

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 60KB - Virtual size: 60KB

.rsrc Size: 1024B - Virtual size: 776B

.reloc Size: 512B - Virtual size: 12B

2e2b691177bb4205fc4f5eb9fbd1a8d6

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7eCertificate

Extended Key Usages

Key Usages

61:05:87:58:00:03:00:00:00:5aCertificate

Extended Key Usages

Key Usages

77:02:6a:1f:b9:95:c3:57:19:2f:be:52:52:3c:fb:71:fe:ed:4e:3bSigner

Headers

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

advapi32

oleaut32

kernel32

ole32

user32

ws2_32

version

activeds

odbc32

gdi32

comdlg32

wininet

netapi32

msimg32

crypt32

Exports

Exports

Sections

.text Size: 903KB - Virtual size: 902KB

.data Size: 58KB - Virtual size: 437KB

.rsrc Size: 154KB - Virtual size: 153KB

.reloc Size: 56KB - Virtual size: 56KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 27KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

.text
Size: 60KB - Virtual size: 60KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 512B - Virtual size: 12B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

61:05:87:58:00:03:00:00:00:5a
Certificate

77:02:6a:1f:b9:95:c3:57:19:2f:be:52:52:3c:fb:71:fe:ed:4e:3b
Signer

.text
Size: 903KB - Virtual size: 902KB

.data
Size: 58KB - Virtual size: 437KB

.rsrc
Size: 154KB - Virtual size: 153KB

.reloc
Size: 56KB - Virtual size: 56KB

.text
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 512B - Virtual size: 12B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

69:7d:56:0d:a3:fe:3b:5c:0d:47:01:ed:dc:fa:ab:ea:ea:68:9c:9e
Signer

.text
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B