SecuriteInfo[.]com[.]Trojan[.]TR[.]Crypt[.]XPACK[.]Gen[.]28454[.]17911[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.28454.17911.dll
Size

850KB
MD5

fceade2b432b6a671decef21fc18e758
SHA1

1841ceb4e55426e2365c672494d0102c9cde5f3a
SHA256

7448ee00bad2bf24a6aca228e7318c9d1989f7c596988d313c0918659df3ed45
SHA512

f7cbc405d84344c27e8e7cc9cd65cf0a14a75e09c036b4122338745a2283fcdc5ddbde370ab0b6fc33d1d800800aaf6cbf73127b002e6926791be36d925fe84b
SSDEEP

12288:qYzH/+2q5ORv5J8zLzlG3prualyOJroNORN0P4EF+jXmU:Lzf+TOmRG3pTltsNORNHEwjXmU

Score

1^/10

Malware Config

Signatures

Files

SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.28454.17911.dll
.dll windows:4 windows x86 arch:x86

41507753530d76bf751bd1509806ec8e

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01/09/1998, 12:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2009, 11:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21/12/2009, 09:32

Not After

22/12/2020, 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:40:be:fd:de:bc:6e:f5:22:b5:13:a5:cf:5f:93:34:02
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

12/11/2012, 05:38

Not After

10/11/2013, 09:23

Subject

CN=Hu Chen,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2a:49:f0:74:94:e0:4d:37:c9:d7:e5:48:f3:ad:99:bf:79:fd:29:23
Signer

Actual PE Digest

2a:49:f0:74:94:e0:4d:37:c9:d7:e5:48:f3:ad:99:bf:79:fd:29:23

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

Sections

CODE
Size: 123KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

41507753530d76bf751bd1509806ec8e

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94Certificate

Key Usages

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

11:21:40:be:fd:de:bc:6e:f5:22:b5:13:a5:cf:5f:93:34:02Certificate

Extended Key Usages

Key Usages

2a:49:f0:74:94:e0:4d:37:c9:d7:e5:48:f3:ad:99:bf:79:fd:29:23Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

Sections

CODE Size: 123KB - Virtual size: 232KB

.rsrc Size: 5KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

04:00:00:00:00:01:20:19:c1:90:66
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

11:21:40:be:fd:de:bc:6e:f5:22:b5:13:a5:cf:5f:93:34:02
Certificate

2a:49:f0:74:94:e0:4d:37:c9:d7:e5:48:f3:ad:99:bf:79:fd:29:23
Signer

CODE
Size: 123KB - Virtual size: 232KB

.rsrc
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B