identtur[.]exe

Resubmissions

20/05/2024, 06:53

240520-hnwpfage95 1

20/05/2024, 06:47

240520-hj7adagd28 1

Sharing

Copy URL Twitter E-mail

General

Target

identtur.exe
Size

2.0MB
MD5

6f0020f104e54165828a9f6239ccc2d6
SHA1

45d0296f6eb694a5a23c488c81ac534221afebaf
SHA256

59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820
SHA512

2f3c007dd99e62790cea9975de2d05635cdd63ef3347e925a13253a91cebcc86b16d413130971aeca11166ea9769be6ca5e487a8d40861f157bfa894bd7d39e3
SSDEEP

24576:eq8j8tQeerENq0ZGOWCj3gBDOFhzri7lwFv72GKoxvGeUAUA/Jpf:uPrEw0V1jgDkhziYv72BoxvGeUAUA/Jl

Score

1^/10

Malware Config

Signatures

Files

identtur.exe
.exe windows:5 windows x86 arch:x86

dccc8b360ed979d785a9d91512f716aa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:4f:40:ed:c7:0c:dd:e5:a0:56:f5:57:3a:a3:09:50
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/08/2013, 00:00

Not After

11/10/2016, 23:59

Subject

CN=uvnc bvba,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=uvnc bvba,L=Antwerpen,ST=Antwerpen,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:5a:89:dd:12:0a:2c:68:5d:a2:24:81:59:43:14:69:fe:b1:3e:5e
Signer

Actual PE Digest

29:5a:89:dd:12:0a:2c:68:5d:a2:24:81:59:43:14:69:fe:b1:3e:5e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

l:\UltraVNC_INSTALLER_win2000\ultravnc\UltraVNC Project Root\UltraVNC\winvnc\Release\winvnc.pdb

Imports

ws2_32

gethostname
inet_ntoa
getsockname
send
getpeername
WSAIoctl
select
WSAGetLastError
gethostbyname
shutdown
setsockopt
WSACleanup
bind
__WSAFDIsSet
getsockopt
listen
accept
connect
WSAStartup
inet_addr
htonl
htons
recv
socket
closesocket

winmm

timeSetEvent
PlaySoundA
timeGetTime
timeKillEvent

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

userenv

ExpandEnvironmentStringsForUserA
CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

WaitNamedPipeW
WriteFile
GetSystemDirectoryW
LoadLibraryW
CreateEventA
GetExitCodeProcess
ReadFile
CreateFileW
Process32Next
OpenEventA
WaitForMultipleObjects
lstrcatW
CreateToolhelp32Snapshot
OutputDebugStringA
GetVersionExA
GetCurrentProcessId
GetEnvironmentVariableA
SetCurrentDirectoryA
SetFileAttributesA
ResumeThread
ResetEvent
CreateFileA
GetFileSize
CompareFileTime
GetFileTime
SetFilePointer
MoveFileExA
SetEndOfFile
SetErrorMode
SystemTimeToFileTime
SetFileTime
GetDriveTypeA
GetFileAttributesA
FileTimeToSystemTime
FlushFileBuffers
CreateDirectoryA
GetLogicalDriveStringsA
MoveFileA
GetSystemTime
GetCurrentThread
VirtualFreeEx
ReadProcessMemory
CreateProcessA
TerminateProcess
SetThreadPriority
VirtualAllocEx
TerminateThread
FindResourceA
SetLastError
SizeofResource
LockResource
SetEvent
FormatMessageA
GetStdHandle
WriteConsoleA
GlobalDeleteAtom
GlobalGetAtomNameA
GlobalAddAtomA
SetProcessShutdownParameters
GetConsoleMode
GetConsoleCP
HeapReAlloc
PeekNamedPipe
GetFileInformationByHandle
GetCPInfo
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCurrentDirectoryA
SetEnvironmentVariableA
GetStartupInfoA
GetCommandLineA
SetStdHandle
ExitProcess
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsAlloc
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
TlsSetValue
TlsGetValue
GetLocalTime
GetLocaleInfoA
SetVolumeLabelA
lstrcmpiA
InterlockedExchange
GetProcessHeap
HeapFree
HeapAlloc
lstrcpynA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileType
GetVolumeInformationA
DosDateTimeToFileTime
GetFullPathNameA
lstrcpyA
lstrcatA
AllocConsole
Process32First
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
OpenFileMappingA
ReleaseMutex
CreateMutexA
CreateFileMappingA
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
GetPrivateProfileStructA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
OpenProcess
RaiseException
WritePrivateProfileSectionA
WritePrivateProfileStructA
WinExec
GetLastError
GetComputerNameA
GetVersion
GetSystemInfo
lstrlenA
DeleteFileA
GetTempPathA
FindNextFileA
FindClose
FindFirstFileA
FreeLibrary
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessTimes
InitializeCriticalSection
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcess
GlobalFree
GlobalUnlock
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalSize
CreateThread
CloseHandle
Sleep
GetCurrentThreadId
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableW
GetLocaleInfoW
CompareStringA
CompareStringW
GetTimeZoneInformation
ExitThread
HeapSize
LoadResource
RemoveDirectoryA

user32

TrackPopupMenu
GetMenuItemID
GetSubMenu
LoadMenuA
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
DestroyMenu
EnableWindow
ToAscii
GetAsyncKeyState
MapVirtualKeyA
VkKeyScanA
IsIconic
DestroyWindow
PostThreadMessageA
SendNotifyMessageA
WaitMessage
PeekMessageA
ChangeClipboardChain
SetClipboardViewer
GetClipboardOwner
ClientToScreen
EnumDesktopWindows
GetClassNameA
OpenDesktopA
FillRect
DrawTextA
GetFocus
AttachThreadInput
WaitForInputIdle
FindWindowExA
WindowFromPoint
RegisterWindowMessageA
EnumWindows
GetIconInfo
IsDlgButtonChecked
SetRect
GetCaretPos
IsWindow
IsWindowVisible
EndPaint
DrawIconEx
BeginPaint
GetUpdateRect
IntersectRect
DestroyIcon
GetKeyboardState
SetActiveWindow
MessageBeep
FlashWindow
ChangeDisplaySettingsExA
keybd_event
GetKeyState
EnumDisplaySettingsA
ScreenToClient
GetWindowRect
SendDlgItemMessageA
SetForegroundWindow
GetClientRect
SetFocus
GetScrollInfo
InvalidateRect
GetDlgItem
EndDialog
GetCursorPos
SetWindowTextA
CheckDlgButton
SetDlgItemInt
GetDlgItemInt
GetProcessWindowStation
GetWindowTextA
GetDlgItemTextA
DialogBoxParamA
SetDlgItemTextA
MoveWindow
ExitWindowsEx
GetDesktopWindow
wsprintfA
GetWindowThreadProcessId
SystemParametersInfoA
GetForegroundWindow
MessageBoxA
CloseClipboard
IsClipboardFormatAvailable
RegisterClipboardFormatA
GetClipboardData
EmptyClipboard
OpenClipboard
SetClipboardData
SendMessageA
PostMessageA
FindWindowA
mouse_event
GetMessageA
GetUserObjectInformationA
SetTimer
RegisterClassExA
PostQuitMessage
GetThreadDesktop
KillTimer
LoadIconA
OpenInputDesktop
CloseDesktop
TranslateMessage
SetWindowLongA
GetWindowLongA
CreateWindowExA
DefWindowProcA
SetWindowPos
ShowWindow
SetThreadDesktop
DispatchMessageA
GetSystemMetrics
LoadImageA
AdjustWindowRect
LoadCursorA
IsRectEmpty
GetDC
ReleaseDC
wvsprintfA
OemToCharA
CharToOemA
LoadStringA

gdi32

GetBitmapBits
SetTextColor
SetBkColor
GdiFlush
CreatePalette
RealizePalette
SelectPalette
CreateFontIndirectA
GetObjectA
ExtEscape
GetSystemPaletteEntries
GetRgnBox
GetRegionData
SetRectRgn
PtInRegion
CombineRgn
OffsetRgn
CreateRectRgn
PatBlt
StretchBlt
CreateDCA
SetBkMode
GetClipBox
GetStockObject
CreateSolidBrush
BitBlt
DeleteDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
SetDIBColorTable
GetPixel
CreateCompatibleBitmap

advapi32

GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
IsValidSecurityDescriptor
IsValidSid
GetSecurityDescriptorOwner
SetKernelObjectSecurity
GetSecurityDescriptorControl
IsValidAcl
GetSecurityDescriptorLength
GetKernelObjectSecurity
RegCreateKeyA
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetServiceStatus
RegDeleteValueA
QueryServiceStatus
RegCreateKeyExA
RegDeleteKeyA
CreateServiceA
RegisterServiceCtrlHandlerA
DeleteService
StartServiceCtrlDispatcherA
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueA
SetTokenInformation
FreeSid
RevertToSelf
AllocateAndInitializeSid
ImpersonateLoggedOnUser
EqualSid
GetTokenInformation
OpenProcessToken
CreateProcessAsUserA
RegSetValueExA
QueryServiceConfigA
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
LookupAccountSidA
OpenServiceA
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

SHAppBarMessage
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
ShellExecuteExA
ShellExecuteA
Shell_NotifyIconA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

imm32

ImmGetDefaultIMEWnd

Sections

.text
Size: 808KB - Virtual size: 808KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 583KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1008KB - Virtual size: 1007KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

dccc8b360ed979d785a9d91512f716aa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

77:4f:40:ed:c7:0c:dd:e5:a0:56:f5:57:3a:a3:09:50Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

29:5a:89:dd:12:0a:2c:68:5d:a2:24:81:59:43:14:69:fe:b1:3e:5eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

winmm

version

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

Sections

.text Size: 808KB - Virtual size: 808KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 14KB - Virtual size: 583KB

.rsrc Size: 1008KB - Virtual size: 1007KB

.reloc Size: 46KB - Virtual size: 46KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

77:4f:40:ed:c7:0c:dd:e5:a0:56:f5:57:3a:a3:09:50
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

29:5a:89:dd:12:0a:2c:68:5d:a2:24:81:59:43:14:69:fe:b1:3e:5e
Signer

.text
Size: 808KB - Virtual size: 808KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 14KB - Virtual size: 583KB

.rsrc
Size: 1008KB - Virtual size: 1007KB

.reloc
Size: 46KB - Virtual size: 46KB