MGADiag[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MGADiag.exe
Size

958KB
MD5

e0ad350cb71ff1024da035adba6be8a9
SHA1

4ad22a1255962d8b4ee0a9508184e6cbe3521595
SHA256

f0313fb8421caf48e5b3a932a73247f461606565488a96e95ef1fc87c8f5b3cc
SHA512

2cfc679c955e809eb39c5d227482a4955d11c080e0c42142e203d84c1eb464679f97c3e1bcd8492f2437b033c7c7cce7a904d0177f8de6287836e226f6017734
SSDEEP

12288:17HLHh/mfhjScnTvIvsMfxT4EY8mL3XaR7rVS6ZCD:1x/mMMT+5T4EmL3XaRPZCD

Score

1^/10

Malware Config

Signatures

Files

MGADiag.exe
.exe windows:6 windows x86 arch:x86

6d9b8e241918742c58f836d26c86d8e8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

be:b3:13:6a:d1:f5:b7:de:cc:3b:11:2e:7e:7c:15:a2:6e:3c:6e:22
Signer

Actual PE Digest

be:b3:13:6a:d1:f5:b7:de:cc:3b:11:2e:7e:7c:15:a2:6e:3c:6e:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\bt\11\src\client\obfuscate\obj\i386\oWGADiag2.pdb

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetSystemTime
GetExitCodeThread
GetLogicalDriveStringsA
GlobalMemoryStatus
GetCurrentThreadId
QueryPerformanceCounter
HeapAlloc
GetModuleHandleA
GetProcessAffinityMask
SetThreadAffinityMask
ResumeThread
DeviceIoControl
SetLastError
GetTickCount
CreateThread
WaitForSingleObject
CloseHandle
GetFileAttributesA
SetFileAttributesA
HeapFree
GetProcessHeap
GetSystemDirectoryA
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GetProcAddress
FreeLibrary
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeInformationW
GetSystemInfo
lstrlenW
lstrlenA
FindNextFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesW
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetLocalTime
SystemTimeToFileTime
CompareFileTime
ExpandEnvironmentStringsW
GetCommandLineA
GetVersionExA
GetStartupInfoA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
Sleep
HeapSize
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
SetFilePointer
MultiByteToWideChar
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
SetEndOfFile
ReadFile
GetTimeZoneInformation
ReadProcessMemory
GlobalFree
FindClose
FindFirstFileA
FindFirstFileW
GetSystemDirectoryW
GetDriveTypeA
CreateDirectoryW
GetCurrentDirectoryW
CreateDirectoryA
LocalFree
LocalAlloc
GetSystemDefaultLangID
TryEnterCriticalSection
GetComputerNameW
GetVolumeInformationA
CreateFileW
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualProtect

advapi32

CryptHashData
CryptCreateHash
CryptAcquireContextA
RegEnumKeyA
GetCurrentHwProfileW
RegEnumKeyExA
RegEnumKeyExW
GetCurrentHwProfileA
CryptDecrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegCreateKeyExW
RegQueryValueExW
RegSetValueExA
RegCreateKeyExA
LookupAccountNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
CryptImportKey
CryptExportKey
CryptGenKey
CryptDeriveKey

gdi32

DeleteObject
SelectObject
GetTextMetricsA
GetTextFaceA
CreateFontA
SetTextColor
SetBkMode
GetStockObject

user32

LoadCursorA
BroadcastSystemMessageA
wsprintfA
GetDesktopWindow
SetDlgItemTextA
GetDlgItem
EndDialog
GetDlgCtrlID
SetWindowPos
GetSystemMetrics
GetDC
GetClientRect
MapWindowPoints
MoveWindow
ReleaseDC
GetWindowLongA
IsWindow
CallWindowProcA
DrawTextA
DrawFocusRect
GetWindowRect
DestroyCursor
GetParent
PostMessageA
EnableWindow
LoadStringA
DialogBoxParamA
MessageBoxA
GetCursor
SetWindowLongA
SetCursor
InvalidateRect
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
SendMessageA

ole32

IIDFromString
CLSIDFromProgID
CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

comctl32

PropertySheetA
ord17
CreatePropertySheetPageA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

crypt32

CertEnumCertificatesInStore
CryptSignCertificate
CryptExportPublicKeyInfo
CryptEncodeObject
CertVerifySubjectCertificateContext
CertFindExtension
CertFreeCertificateContext
CertDuplicateCertificateContext
CertCreateCertificateContext
CertCloseStore
CertComparePublicKeyInfo
CertOpenStore
CryptUnprotectData
CertGetIssuerCertificateFromStore

wininet

HttpSendRequestA
InternetConnectA
InternetQueryOptionA
HttpOpenRequestA
InternetErrorDlg
InternetAutodial
InternetSetOptionA
InternetOpenA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetGetConnectedState

setupapi

SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo

shell32

ShellExecuteA

oleaut32

SysAllocString
SysStringLen
VariantClear
VariantInit
SysAllocStringByteLen
SysAllocStringLen
SysFreeString

Sections

.text
Size: 650KB - Virtual size: 649KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 281KB - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d9b8e241918742c58f836d26c86d8e8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

be:b3:13:6a:d1:f5:b7:de:cc:3b:11:2e:7e:7c:15:a2:6e:3c:6e:22Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

gdi32

user32

ole32

comctl32

version

crypt32

wininet

setupapi

shell32

oleaut32

Sections

.text Size: 650KB - Virtual size: 649KB

.data Size: 281KB - Virtual size: 281KB

.rsrc Size: 19KB - Virtual size: 18KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

be:b3:13:6a:d1:f5:b7:de:cc:3b:11:2e:7e:7c:15:a2:6e:3c:6e:22
Signer

.text
Size: 650KB - Virtual size: 649KB

.data
Size: 281KB - Virtual size: 281KB

.rsrc
Size: 19KB - Virtual size: 18KB