Tcpview[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Tcpview.exe
Size

293KB
MD5

9aa5a93712c584acdcaa7eef9d25ef4d
SHA1

9589b7b51791c5bb819cbee9f85d49249602768a
SHA256

c00d90c50a5e05d270b796645d5f12dee94a31ca94b8ddc90c91af1f9e208850
SHA512

21b4c6b7e16cdc3e729fb708b5e9bded3386dbf6bdb8f286bd4ae8e9f0f59f935674730b96eca2d266e648a7badf3973e1a9ae9d365adad2fc24816de98a8e9a
SSDEEP

6144:51o12lUr7EbaK1fw9mdo7DZJ/wDAUZlYm3UhM9lY:5C1ZobTw9tDZJwDrPYmOf

Score

1^/10

Malware Config

Signatures

Files

Tcpview.exe
.exe windows:5 windows x86 arch:x86

3ce43dcc9f8226b50b65387f4477de91

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

4b:08:48:9c:56:bd:95:a8:40:c8:89:d8:54:b9:8b:70:e8:14:ef:91
Signer

Actual PE Digest

4b:08:48:9c:56:bd:95:a8:40:c8:89:d8:54:b9:8b:70:e8:14:ef:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\Tcpview\Release\Tcpview.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

gethostbyname
WSAGetLastError
socket
connect
send
recv
closesocket
WSAStartup
getservbyport
gethostname
gethostbyaddr
htons
htonl
ntohl
ntohs

iphlpapi

SetTcpEntry
GetTcpTable
GetUdpTable

comctl32

ImageList_Create
ord6
ord17
CreateToolbarEx
ImageList_ReplaceIcon

psapi

GetModuleFileNameExA

kernel32

ReadProcessMemory
CreateEventA
DeviceIoControl
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
CreateFileA
GetModuleFileNameA
GetLastError
GetNumberFormatA
GetLocaleInfoA
FormatMessageA
GetTickCount
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetProcessHeap
GetVersion
InitializeCriticalSection
ExpandEnvironmentStringsA
GetConsoleCP
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
SetHandleCount
HeapSize
GetStdHandle
WriteFile
ExitProcess
Sleep
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
FatalAppExitA
DeleteCriticalSection
OpenProcess
LCMapStringA
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetCommandLineA
HeapReAlloc
ResumeThread
CreateThread
GetCurrentThreadId
ExitThread
HeapAlloc
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
ResetEvent
GetVersionExA
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
GetCommandLineW
LocalAlloc
LoadLibraryA
LocalFree
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
GetConsoleMode
GetStringTypeA
LoadLibraryW
SetEvent
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
LCMapStringW
WaitForSingleObject
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
GetLocaleInfoW
SetEndOfFile
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileType
GetStringTypeW

user32

GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
LoadMenuA
InsertMenuA
CreateMenu
GetSubMenu
SetMenuItemInfoA
DrawMenuBar
PostQuitMessage
LoadStringA
DialogBoxParamA
TrackPopupMenu
RedrawWindow
UpdateWindow
DestroyIcon
SetDlgItemTextA
GetParent
ChildWindowFromPoint
InvalidateRect
SetCapture
ReleaseCapture
SetWindowLongA
GetWindowLongA
GetCursorPos
GetClientRect
CreateWindowExA
SetFocus
CallWindowProcA
GetSysColor
LoadAcceleratorsA
LoadIconA
DrawIconEx
InvalidateRgn
SetWindowPos
GetMenu
CheckMenuItem
SetTimer
KillTimer
GetWindowRect
IsIconic
IsZoomed
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetFocus
GetDC
DrawTextA
ReleaseDC
GetSystemMetrics
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
PostMessageA
DestroyWindow
DefWindowProcA
MessageBoxA
DialogBoxIndirectParamA
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextA
LoadCursorA
SetCursor
InflateRect
SendMessageA
FillRect
EnableMenuItem

gdi32

GetTextMetricsA
SetBkMode
GetDeviceCaps
SetMapMode
StartDocA
EndDoc
EndPage
StartPage
SetTextColor
SelectObject
CreateFontIndirectA
DeleteDC
CreateCompatibleDC
GetObjectA
GetStockObject
DeleteObject
CreateSolidBrush
SetBkColor
GetBkColor

comdlg32

ChooseFontA
GetSaveFileNameA
PrintDlgA

advapi32

AllocateAndInitializeSid
GetTokenInformation
EqualSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ConvertSidToStringSidA
FlushTraceA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
FreeSid
RegOpenKeyExA
RegOpenKeyA

shell32

ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
CommandLineToArgvW

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket

oleaut32

SysStringLen
SysFreeString
VariantClear
VariantInit
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SafeArrayUnaccessData
CreateErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
GetErrorInfo
SetErrorInfo
SysAllocString

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ce43dcc9f8226b50b65387f4477de91

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:04:ca:69:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

4b:08:48:9c:56:bd:95:a8:40:c8:89:d8:54:b9:8b:70:e8:14:ef:91Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

iphlpapi

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 6KB - Virtual size: 17KB

.rsrc Size: 9KB - Virtual size: 9KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:04:ca:69:00:00:00:00:00:08
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

4b:08:48:9c:56:bd:95:a8:40:c8:89:d8:54:b9:8b:70:e8:14:ef:91
Signer

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 6KB - Virtual size: 17KB

.rsrc
Size: 9KB - Virtual size: 9KB