Flash64_11_7_700_169[.]ocx

Resubmissions

30/04/2024, 07:02

240430-hvaqjsfa23 7

30/04/2024, 06:55

240430-hp1psafc6x 7

30/04/2024, 06:36

240430-hc47faef25 7

Sharing

Copy URL Twitter E-mail

General

Target

Flash64_11_7_700_169.ocx
Size

21.2MB
MD5

74fe40a1508752e3886fc4fe27f5ded8
SHA1

3cb853ddd9a091075982590566bb292131f07f45
SHA256

b86c049667efe4c2aae42bc4f7406d2e536b58fc49253964e9621a255c6e126b
SHA512

5d640aa879fe59622bfca01812dedf069b990facdfca13be27b51a821db5d045e43fdbe8b6fedfb925c33e3cef82dba799c04b650ea4fb31d206f637c8b5e3f9
SSDEEP

393216:RNV/Cy4oooZRKrcxeVLpl6pYvI1h5uVV18y6VQudt+rXPIaEAQdr:Z0u7aEAQdr

Score

1^/10

Malware Config

Signatures

Files

Flash64_11_7_700_169.ocx
.dll regsvr32 windows:5 windows x64 arch:x64

0e7bd10a247d82bd71e3f853de6b18c9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

21:36:32:9a:16:7a:6f:d6:bf:4b:b5:e8:77:8e:0b:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/02/2013, 00:00

Not After

25/02/2014, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Flash Player - Fortnight+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c7:68:5e:b8:b3:72:9f:d3:a8:73:59:3a:b7:88:a2:c0:5a:8e:ff:cc
Signer

Actual PE Digest

c7:68:5e:b8:b3:72:9f:d3:a8:73:59:3a:b7:88:a2:c0:5a:8e:ff:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Flash.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW

winmm

mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetNumDevs
waveInGetNumDevs
waveInStart
waveInAddBuffer
mixerGetLineControlsA
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
waveInOpen
timeKillEvent
timeGetTime
timeSetEvent
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
waveOutGetPosition
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInStop
waveOutSetVolume

wininet

InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetCloseHandle

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertAddStoreToCollection
CertOpenStore
CertVerifyRevocation
CertVerifyTimeValidity
CertCompareCertificate
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCompareCertificateName
CryptFindOIDInfo
CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CertCloseStore

rpcrt4

RpcStringFreeA
UuidToStringA

oleaut32

SafeArrayAccessData
SysFreeString
SysAllocStringLen
SysStringLen
SysStringByteLen
VariantInit
VariantClear
SysAllocString
LoadTypeLi
VariantChangeType
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
OleCreatePropertyFrame
VarBstrCat
SysAllocStringByteLen
SafeArrayUnlock
SafeArrayLock
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayUnaccessData

dsound

ord8
ord1

msimg32

AlphaBlend

kernel32

GetTickCount
LCMapStringW
CreateProcessA
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
GetFileSizeEx
CreateFileW
CreateDirectoryW
GetProcessTimes
GetCurrentProcessId
GlobalSize
GetTempFileNameW
GetSystemInfo
GetUserDefaultUILanguage
MoveFileExW
VirtualQuery
GetUserDefaultLangID
DeleteFileA
CreateFileA
WriteFile
SetFilePointer
VerifyVersionInfoW
VerSetConditionMask
CreateThread
ReadFile
GetFileSize
LockResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
GetTimeZoneInformation
GetLocaleInfoW
CreateSemaphoreW
GetSystemDirectoryW
GetSystemWow64DirectoryW
ExpandEnvironmentStringsA
GetTempFileNameA
GetTempPathA
CreateDirectoryA
CreateMutexA
SetFilePointerEx
GetCurrentDirectoryW
SetCurrentDirectoryW
OutputDebugStringA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
GetExitCodeThread
DuplicateHandle
TerminateThread
CreateWaitableTimerW
SetThreadPriority
GetSystemDirectoryA
CompareFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
SwitchToThread
GetSystemTimeAsFileTime
GetStdHandle
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
SetConsoleCtrlHandler
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapSetInformation
HeapCreate
HeapDestroy
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetModuleHandleA
GetNativeSystemInfo
lstrcpynW
GlobalMemoryStatus
FlushConsoleInputBuffer
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
DisableThreadLibraryCalls
SetLastError
OutputDebugStringW
GetCurrentThreadId
GetModuleFileNameW
GetVersionExA
GetModuleFileNameA
GetFileAttributesA
SetFileAttributesA
LocalAlloc
LocalFree
GlobalLock
GlobalUnlock
MulDiv
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
RaiseException
CreateMutexW
GetVersion
LoadLibraryW
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
FreeLibrary
WaitForSingleObject
ResetEvent
CloseHandle
CreateEventW
SetEvent
GetModuleHandleW
GlobalAlloc
GetLastError
GetLocaleInfoA
GetVersionExW
lstrlenW
lstrlenA
WideCharToMultiByte
GlobalFree
DeleteFileW
GetFileAttributesW
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
ExpandEnvironmentStringsW
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
RtlVirtualUnwind
TerminateProcess
RtlPcToFileHeader
HeapReAlloc
GetCommandLineA
FlsSetValue
ExitProcess
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
UnhandledExceptionFilter
InterlockedPopEntrySList
InterlockedPushEntrySList
GetProcessAffinityMask
HeapSize
HeapFree
GetProcessHeap
HeapAlloc
EnumSystemLocalesW
IsValidLocale
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
CompareStringW
GetCurrencyFormatW
GetNumberFormatW
VirtualProtect
ResumeThread
TlsFree
TlsAlloc
FileTimeToSystemTime
SetSystemTime
IsDebuggerPresent
DebugBreak
GlobalMemoryStatusEx
CreateSemaphoreA
VirtualFree
VirtualAlloc
DeviceIoControl
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
ReadConsoleInputA
SetConsoleMode
ReleaseSemaphore

user32

DialogBoxIndirectParamW
SetWindowTextW
SendMessageTimeoutW
CreateIconIndirect
GetMonitorInfoW
SetRectEmpty
GetCursor
DestroyIcon
LoadImageW
GetPropW
SetPropW
GetSystemMetrics
InflateRect
GetClipboardFormatNameA
RegisterClipboardFormatA
IsWindow
IsChild
PtInRect
EqualRect
SetWindowRgn
BeginPaint
EndPaint
GetSubMenu
GetQueueStatus
MapVirtualKeyW
LoadStringW
IntersectRect
ReleaseCapture
SetCursorPos
GetMessageTime
SystemParametersInfoW
SetTimer
MessageBoxW
LoadIconW
RegisterClassW
PeekMessageW
DialogBoxParamW
GetDlgItem
EndDialog
GetParent
SetWindowPos
GetFocus
GetKeyState
LoadStringA
MessageBoxA
SendMessageW
GetCapture
SetCursor
GetCursorPos
WindowFromPoint
ScreenToClient
GetMessageW
PostThreadMessageW
CharLowerW
CharUpperW
SetMenuInfo
CreateMenu
DrawMenuBar
DestroyMenu
TrackPopupMenu
CreatePopupMenu
RedrawWindow
DispatchMessageA
GetWindowLongPtrA
DefWindowProcA
RegisterWindowMessageA
PostMessageA
KillTimer
GetClientRect
SetCapture
EnableMenuItem
CheckMenuItem
SetFocus
GetWindowInfo
CopyRect
PostQuitMessage
ClientToScreen
SendInput
ActivateKeyboardLayout
GetKeyboardLayout
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
UnregisterClassW
RegisterClassExW
InvalidateRect
GetWindowLongPtrW
DefWindowProcW
SetWindowLongPtrW
UnionRect
CallWindowProcW
GetDC
ReleaseDC
LoadCursorW
GetClassInfoExW
CharNextW
SetRect
GetForegroundWindow
GetDesktopWindow
EnumDisplayDevicesA
MonitorFromWindow
FillRect
OffsetRect
CreateWindowExW
ShowWindow
DestroyWindow
GetDoubleClickTime
EnumWindows
PostMessageW
IsWindowEnabled
GetWindow
GetClassNameA
GetWindowTextW
GetWindowTextA
GetMenuItemInfoW
SetMenuItemInfoW
RemoveMenu
GetWindowThreadProcessId
RegisterClipboardFormatW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
EmptyClipboard
EnumDisplayDevicesW
SetWindowTextA
DispatchMessageW
TranslateMessage
InsertMenuItemW
DestroyCaret
ShowCaret
CreateCaret
SetCaretPos
MoveWindow
GetActiveWindow
FlashWindowEx
GetSystemMenu
IsZoomed
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
ShowWindowAsync
IsIconic
EnumDisplaySettingsW
MapWindowPoints
GetMessageA
SetWindowLongPtrA
CreateWindowExA
RegisterClassExA
GetWindowLongA
UnregisterClassA
EnumDisplayMonitors
MonitorFromRect
GetMonitorInfoA
GetUserObjectInformationW
GetProcessWindowStation
GetWindowTextLengthW
DeleteMenu
WaitForInputIdle
wsprintfW
UpdateWindow

gdi32

CloseMetaFile
SetWindowOrgEx
CreateMetaFileW
GdiAlphaBlend
StretchBlt
BitBlt
SetStretchBltMode
CreateCompatibleBitmap
ExtTextOutW
GetObjectW
GetStretchBltMode
EnumFontFamiliesW
CreateSolidBrush
Rectangle
StretchDIBits
RectVisible
GetClipBox
SetViewportOrgEx
DeleteMetaFile
CreateRectRgnIndirect
GetObjectType
SetTextAlign
TextOutW
SetWindowExtEx
GetICMProfileA
CreateDCA
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
ExtTextOutA
SetTextColor
CreateFontIndirectA
IntersectClipRect
GetClipRgn
CreateRectRgn
SetBkMode
GetTextAlign
GetBkMode
GetTextColor
SelectClipRgn
GetBkColor
SetTextCharacterExtra
CreatePen
GetTextExtentPoint32W
GetCurrentObject
EnumFontFamiliesA
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
GetDeviceCaps
CreateDIBSection
SelectObject
LPtoDP
GetStockObject
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
LineTo
StartPage
EndPage
GetFontData
EnumFontFamiliesExW
SetPolyFillMode
SaveDC
BeginPath
EndPath
SetBkColor
MoveToEx

comdlg32

GetOpenFileNameW
CommDlgExtendedError
PrintDlgW
GetSaveFileNameW

advapi32

CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteValueA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetTokenInformation
OpenProcessToken
GetSidSubAuthorityCount
GetSidSubAuthority
IsValidSid
CryptImportKey
CryptGenKey
CryptDestroyKey
CryptExportKey
CryptEncrypt
CryptAcquireContextA
RegOpenKeyA
RegQueryValueExW
RegCreateKeyA
RegEnumKeyExW
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetDiskFreeSpaceExW
SHGetSettings
SHGetFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
ord165
SHAppBarMessage

ole32

CoTaskMemRealloc
CreateOleAdviseHolder
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
StringFromGUID2
WriteClassStm
OleSaveToStream
ReadClassStm
MkParseDisplayName
PropVariantClear
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleUninitialize
CoUninitialize
CoInitializeEx
CoRegisterMessageFilter
CoTaskMemFree
CoInitialize
CreateBindCtx
CoTaskMemAlloc
CoSetProxyBlanket
CoFreeUnusedLibraries
ReleaseStgMedium
CoCreateInstance
OleInitialize

ws2_32

WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
ntohl
select
gethostname
socket
ioctlsocket
connect
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
recvfrom
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSACloseEvent
htons
getsockname
ntohs
send
recv
WSASocketW
WSAStartup
setsockopt

shlwapi

UrlCanonicalizeW
AssocQueryStringW

urlmon

HlinkSimpleNavigateToMoniker
RegisterBindStatusCallback
CreateURLMoniker
CopyStgMedium

mscms

DeleteColorTransform
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
TranslateBitmapBits

Exports

Exports

AdobeCPGetAPI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule

Sections

.text
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 495KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 703KB - Virtual size: 702KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0e7bd10a247d82bd71e3f853de6b18c9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

21:36:32:9a:16:7a:6f:d6:bf:4b:b5:e8:77:8e:0b:fbCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c7:68:5e:b8:b3:72:9f:d3:a8:73:59:3a:b7:88:a2:c0:5a:8e:ff:ccSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

winmm

wininet

crypt32

rpcrt4

oleaut32

dsound

msimg32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

ws2_32

shlwapi

urlmon

mscms

Exports

Exports

Sections

.text Size: 15.7MB - Virtual size: 15.7MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 495KB - Virtual size: 1.4MB

.pdata Size: 703KB - Virtual size: 702KB

.rsrc Size: 138KB - Virtual size: 138KB

.reloc Size: 250KB - Virtual size: 249KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

21:36:32:9a:16:7a:6f:d6:bf:4b:b5:e8:77:8e:0b:fb
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c7:68:5e:b8:b3:72:9f:d3:a8:73:59:3a:b7:88:a2:c0:5a:8e:ff:cc
Signer

.text
Size: 15.7MB - Virtual size: 15.7MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 495KB - Virtual size: 1.4MB

.pdata
Size: 703KB - Virtual size: 702KB

.rsrc
Size: 138KB - Virtual size: 138KB

.reloc
Size: 250KB - Virtual size: 249KB