d62e9be0531b8a38cc2809f870b56a780440a5370b9fca296b05232dabb0c1a7

Sharing

Copy URL Twitter E-mail

General

Target

d62e9be0531b8a38cc2809f870b56a780440a5370b9fca296b05232dabb0c1a7
Size

236KB
MD5

148520341e0b34e6ce354d3701b05e9d
SHA1

f28a95bfadfa3f635cbef7d27fbeec3d6035ee1e
SHA256

d62e9be0531b8a38cc2809f870b56a780440a5370b9fca296b05232dabb0c1a7
SHA512

14ce6b2e34e364956798d1fff87e719339cf7b217dd6ad89208aa98c878a59c64f59e96b8e051e72d8bb5b4fcc8b9ddd1ba86ba1935b75dd9c4617f09cdc0a10
SSDEEP

6144:iLOYVMZvEuf0aUXolqNYn4a+ow1kYLjo7:i6CtXLY4a+ow1kA8

Score

1^/10

Malware Config

Signatures

Files

d62e9be0531b8a38cc2809f870b56a780440a5370b9fca296b05232dabb0c1a7
.dll windows:5 windows x86 arch:x86

8ff7074f30cb21871966d3a310926f08

Code Sign

20:72:15:4b:98:1e:c5:fd:79:91:b0:c5:17:44:d0:b3
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2013, 00:00

Not After

03/10/2015, 23:59

Subject

CN=Macte! Labs\, Inc.,O=Macte! Labs\, Inc.,L=Vancouver,ST=British Columbia,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:e3:4c:43:2e:fc:bb:04:89:8e:86:4b:19:a9:10:b7:e6:5a:16:cd
Signer

Actual PE Digest

b0:e3:4c:43:2e:fc:bb:04:89:8e:86:4b:19:a9:10:b7:e6:5a:16:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kompexsqlitewrapper

??0SQLiteDatabase@Kompex@@QAE@PBDH0@Z
??0SQLiteStatement@Kompex@@QAE@PAVSQLiteDatabase@1@@Z
?GetSqlResultCString@SQLiteStatement@Kompex@@QAEPBEPBDPBE@Z
?SaveDatabaseFromMemoryToFile@SQLiteDatabase@Kompex@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Close@SQLiteDatabase@Kompex@@QAEXXZ
??1SQLiteStatement@Kompex@@UAE@XZ
??1SQLiteDatabase@Kompex@@UAE@XZ

kernel32

GetConsoleMode
GetConsoleCP
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
FlushFileBuffers
InterlockedDecrement
WaitForSingleObject
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
CloseHandle
Process32Next
OpenProcess
Process32First
CreateToolhelp32Snapshot
WaitForMultipleObjects
ReadFile
SetFilePointer
GetModuleFileNameA
FreeEnvironmentStringsW
lstrlenA
GetStringTypeW
SetEndOfFile
CreateFileA
CreateFileW
SetStdHandle
WriteConsoleW
LoadLibraryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedExchange
Sleep
InitializeCriticalSection
EncodePointer
DecodePointer
LocalFree
RtlUnwind
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCPInfo
GetCurrentThreadId
GetCommandLineA
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoW
GetEnvironmentStringsW

advapi32

RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA

shell32

ShellExecuteExA
ShellExecuteA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

GetErrorInfo
SysAllocStringLen
SysAllocString
VariantClear
VariantInit
SysFreeString
VarBstrCmp

shlwapi

PathFileExistsA

Exports

Exports

AddExtensionInfoToChromePreferences
AddExtensionInfoToOperaBlinkPreferences
AppendOurSafariToolbarButton
PatchAndBuildExtensionChrome
RemoveFirefoxExtensionFromDB
RemoveOperaBlinkExtensionPreferences
RemovePluginPreferences
RemoveSafariExtension
SendHTTPRequest
SetupFirefoxExtension
SetupFirefoxExtensionForProfilePath
SetupOperaExtension
SetupSafariExtension
StopDnsPrefetchingChrome
WaitForProcesses

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ff7074f30cb21871966d3a310926f08

Code Sign

20:72:15:4b:98:1e:c5:fd:79:91:b0:c5:17:44:d0:b3Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

b0:e3:4c:43:2e:fc:bb:04:89:8e:86:4b:19:a9:10:b7:e6:5a:16:cdSigner

Headers

DLL Characteristics

File Characteristics

Imports

kompexsqlitewrapper

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 207KB - Virtual size: 207KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 13KB

20:72:15:4b:98:1e:c5:fd:79:91:b0:c5:17:44:d0:b3
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

b0:e3:4c:43:2e:fc:bb:04:89:8e:86:4b:19:a9:10:b7:e6:5a:16:cd
Signer

.text
Size: 207KB - Virtual size: 207KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 13KB