323aea504e017eeb9a0abe6faccaf9ae6b593f1b285ef555a00b8f9bb7011295

Sharing

Copy URL Twitter E-mail

General

Target

323aea504e017eeb9a0abe6faccaf9ae6b593f1b285ef555a00b8f9bb7011295
Size

1.2MB
MD5

11c2e44600e009f671cd4f76a2fa030b
SHA1

3473641c9aaaa77b933f90f9f27e59987a818dd0
SHA256

323aea504e017eeb9a0abe6faccaf9ae6b593f1b285ef555a00b8f9bb7011295
SHA512

dbf8846d954fc7dbd404e660224dbbdb3a86f3b4e69d7a09ea8626df4894faba1b829f8438d20582ad400c40af0dccb37a37e4af150951b7eb620ab8bcb4e603
SSDEEP

24576:9Kwwix95h+S3PDuVdtAWGvQV8EbgPkmz2EiNuVWpKVI/H6Z+5i6iA8:395sHAWah7eyI/H6Z+5/8

Score

1^/10

Malware Config

Signatures

Files

323aea504e017eeb9a0abe6faccaf9ae6b593f1b285ef555a00b8f9bb7011295
.exe windows:5 windows x86 arch:x86

48ba97a9505f01bc9869b14e1d47272d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:18:a2:21:48:69:04:60:6b:55:bb:5b:66:75:ce:3e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/12/2015, 00:00

Not After

17/12/2016, 23:59

Subject

CN=Swift Equinox,O=Swift Equinox,L=Escondido,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:c0:f0:25:cc:80:03:9a:3a:63:7e:bf:ee:90:f6:56:52:ca:31:90
Signer

Actual PE Digest

5c:c0:f0:25:cc:80:03:9a:3a:63:7e:bf:ee:90:f6:56:52:ca:31:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetStartupInfoW
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenW
lstrlenA
SetEnvironmentVariableA
SetEndOfFile
WaitForMultipleObjectsEx
MoveFileExW
CopyFileW
DeleteFileW
GetWindowsDirectoryW
GetCommandLineW
CreateProcessW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
SetWaitableTimer
CreateWaitableTimerW
CreateEventW
OpenMutexW
CreateMutexW
lstrcmpiW
FileTimeToSystemTime
GetFileTime
Sleep
WaitForMultipleObjects
WaitForSingleObject
ReleaseMutex
SetEvent
LeaveCriticalSection
EnterCriticalSection
SetErrorMode
GetCurrentThreadId
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
GetProcAddress
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
InterlockedDecrement
DeleteCriticalSection
LockResource
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
LocalFileTimeToFileTime
SystemTimeToFileTime
CloseHandle
SetFilePointer
ReadFile
WriteFile
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetLastError
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetCPInfo
ReadConsoleW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
DuplicateHandle
SetProcessAffinityMask
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointerEx
GetFileType
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
GetCurrentThread
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetVersionExW
SetFileTime
GetComputerNameW
GetTimeFormatW
GetDateFormatW
IsDebuggerPresent
OutputDebugStringW
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
IsProcessorFeaturePresent
RtlUnwind
CreateThread
ExitThread
FatalAppExitA
TryEnterCriticalSection
CreateTimerQueue
RtlCaptureStackBackTrace
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
CreateSemaphoreW

user32

LoadStringW
MessageBoxW
CharNextW
CharUpperW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassW

advapi32

ControlService
SetNamedSecurityInfoW
ConvertSidToStringSidW
CryptDuplicateKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptExportKey
CryptGetHashParam
CryptDestroyKey
CryptDeriveKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CreateProcessAsUserW
LookupAccountNameW
LookupAccountSidW
SetFileSecurityW
MakeAbsoluteSD
MakeSelfRelativeSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
InitializeSecurityDescriptor
AddAce
GetAclInformation
InitializeAcl
CopySid
GetLengthSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
IsValidSid
GetTokenInformation
OpenProcessToken
ReportEventW
RegisterEventSourceW
DeregisterEventSource

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoReleaseServerProcess
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
StringFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoAddRefServerProcess
CLSIDFromString

oleaut32

VarUI4FromStr
VariantClear
SysAllocStringLen
SysFreeString
CreateErrorInfo
GetErrorInfo
SysAllocString
VariantInit
VariantChangeType
SetErrorInfo

shlwapi

PathAppendW
PathCombineW
PathFileExistsW
PathRemoveArgsW
PathRemoveExtensionW
PathRemoveFileSpecW
PathRenameExtensionW
PathStripPathW
PathUnquoteSpacesW

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

winhttp

WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imagehlp

CheckSumMappedFile

psapi

GetModuleFileNameExW

iphlpapi

GetTcpTable
GetUdpTable

wsock32

ntohs

Sections

.text
Size: 1017KB - Virtual size: 1017KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48ba97a9505f01bc9869b14e1d47272d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

78:18:a2:21:48:69:04:60:6b:55:bb:5b:66:75:ce:3eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5c:c0:f0:25:cc:80:03:9a:3a:63:7e:bf:ee:90:f6:56:52:ca:31:90Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

winhttp

version

imagehlp

psapi

iphlpapi

wsock32

Sections

.text Size: 1017KB - Virtual size: 1017KB

.rdata Size: 155KB - Virtual size: 154KB

.data Size: 16KB - Virtual size: 26KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 37KB - Virtual size: 37KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

78:18:a2:21:48:69:04:60:6b:55:bb:5b:66:75:ce:3e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5c:c0:f0:25:cc:80:03:9a:3a:63:7e:bf:ee:90:f6:56:52:ca:31:90
Signer

.text
Size: 1017KB - Virtual size: 1017KB

.rdata
Size: 155KB - Virtual size: 154KB

.data
Size: 16KB - Virtual size: 26KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 37KB - Virtual size: 37KB