8393d7df32d8a57a6130b14a58c047d4_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

resource	yara_rule
static1/unpack001/skywidget_sajulove_new.dll	aspack_v212_v242

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	upx

resource
unpack001/$PLUGINSDIR/DLLWebCount.dll
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/SelfDelete.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/version.dll
unpack002/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 8c7cfdd7fcb3c9ab2daf33bde7235cfb866a2fdbc0367db7969f0b685ddaa272
MD5 8393d7df32d8a57a6130b14a58c047d4
SHA1 2bed4d89af4981dfbee55fde78104aabb77acab5
SHA512 fda4ea2606b21aa70d6a9276dd29e221d72a823e6f011e49e97657fcfd1a105666aaceefc7c1fd3c22255f05794b80bb70a1e9ab01a76f3cd6f8b161924a0220
SSDEEP 24576:xJLXJeWGyTm5+i/z4S/AfEHlMCDHJuB3G5WGo5BH+:LjJef+m9L/AM9DHJcjr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/DLLWebCount.dll

IMPHASH da9753a0859a4bcac292d56630cf47ba
SHA256 9c5f4eeadc9c2881bc02b45d757b35d3bfd2dc7d917d2e8fde2917fabf48908f
MD5 248536afcb6f59c1797f079a0da15b63
SHA1 7fa238f871b357c66168728ab1bb38addcfba3f8
SHA512 b82accc8530650ebae8d4f8752002c2d23ab7b29e958e6c14731ad186a0fcdbbab937723a540de62d58f4659580843191fd53cb415e07167d7b55cd174a79652
SSDEEP 96:jos0e13nQHmwy5PFlufG/cg6TGkB4iuzJFGA98ONfeZEWVCxCSvONfeZEWVArmdj:josH1XZwy5NbgB5KPdNeTYgNeT6dba1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

476B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/FindProcDLL.dll

IMPHASH ba3891ead2b1916a668d1301763262db
SHA256 0ac175b28d2a156e71bda214d4a35321c85d434e325624564f0a5eee23c718be
MD5 849abe37c3b8a6dd48089b769ee789c5
SHA1 81d5d6c4d6328059a07ae59878c717211a726512
SHA512 fa1f60aa1e26dffe6a0b2ee8cba6490cc2d1f94613777466ce434a71431bd88f8c3964718f3ea1dd2c8ca41847cc259999bb293ea2591f4f0a0add286229f76f
SSDEEP 384:kZgOCgkqzx8Cu8d1VKZA9dHC8rotc8dfa3FvCyj72y4hUqAbso4AH:kZhCgkqzCsd1AoaWUgSJORbsopH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SelfDelete.dll

IMPHASH 1e9621cfcd4ae80e95c364e38bcff5d7
SHA256 2f4767da9dc7e720d910d32d451674cd08b7892ca753ec5c10b11fe85e12f06b
MD5 ddc0d6806073a5b034104c88288ca762
SHA1 9663cc10c496f05d6167e19c3920245040e5e431
SHA512 545ca797a397cfcbd9b5d3bd2da2e3219ba7a294e541831655c5763a7f17480fd0b990d0c2e58ba8c71f81d85472b2da6d079b8211b44c40c8c36d21168ec054
SSDEEP 96:kloL9cOmJnnH/4zN0TZquBog7OzRN5wmglWFq7PJv7PJaGvhWf89WrTXEGNR9j:klQcrKR0TDBFcN0lR9hvhWEAEYRB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/version.dll

SHA256 31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
MD5 fbe588b15eb1bd86defade69f796b56f
SHA1 2f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA512 e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
SSDEEP 384:6Qx38r8QfiLpVjOXf4Rrd2IpZn8LI2EdGZ5D6PDo3rsyfyC8n:6Qx38r8Qgp1OvYd2zqGZ5D6PDmXf98
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 d1304316189dc3db78e313740aaa821ff051519683106cc99f6d6e7975e9ce1a
MD5 cc91478c2ab62714323a98a6f701d130
SHA1 55a3ff7a4c5ab64d9f2e793e79ef81eb7ab3744d
SHA512 b08170fe315e7b2ba3b9acc60ccf09bbf294fab1ba93dd3ce5e2be171173a3886a001081767645b4bb69f8feaca4a79ea54b119964a52084b5ac48c54c2c1b99
SSDEEP 768:BCpqOQqw77eQx6Sse06MpLSZ99Oq26PZApE8tOz:IpqOQve0yr0ROq8kz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

34540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

515B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

skywidget.dll

IMPHASH 2261ad70a5c819fc3178936e86d5f28a
SHA256 215db10bc99f164c478947bc8764599f92dd13825df7c3976a9add160fd84425
MD5 00949b125a4b3c061d08936567cf5e98
SHA1 f8ab4d07b6e74f2665e5f84ff49d028f42d92735
SHA512 4f159d8f6ea53156e6649c4aa888f525994853e66ff132b246c99c887d75af66c72ca4246554c8b4b36b6b8df0316fa9e651a2f69b2a773bcdee60971ea6dac4
SSDEEP 6144:MzwKvibsrgK8WxCJYdS9jUVBrSZuKMKJWjWRhMIl:Mz3K4kKKWSYKM1jYMIl
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

148692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\gmt_업무\09_new상단\93_skywidget\99_skywidget_dll\01_에누리주소창변경\enteri\enteri\release\skywidget.pdb

wininet

InternetCloseHandle InternetQueryDataAvailable HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA DeleteUrlCacheEntry InternetReadFile

kernel32

CreateFileA GetCPInfo GetOEMCP HeapAlloc HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind HeapReAlloc GetCommandLineA GetProcessHeap ExitProcess HeapSize FlushFileBuffers VirtualFree HeapDestroy HeapCreate GetStdHandle TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer WriteFile ReadFile GlobalFlags WritePrivateProfileStringA SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalReAlloc TlsGetValue LocalAlloc FreeResource GlobalGetAtomNameA GlobalFindAtomA LoadLibraryA lstrcmpW GetModuleFileNameW FormatMessageA LocalFree GetCurrentProcessId GlobalAddAtomA CloseHandle GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryW GetProcAddress CompareStringA GetVersion InterlockedExchange GlobalHandle GlobalFree GetLocalTime GlobalLock GlobalUnlock MulDiv lstrcmpA SetLastError Sleep GetCurrentThreadId GlobalAlloc GetCurrentProcess FlushInstructionCache LockResource GetVersionExA GetThreadLocale SetThreadLocale GetModuleHandleA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary InterlockedDecrement InterlockedIncrement IsDBCSLeadByte GetModuleFileNameA lstrcmpiA lstrlenA GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedCompareExchange IsProcessorFeaturePresent

user32

GetSysColorBrush DestroyMenu LoadIconA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA SetActiveWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect GetDlgCtrlID SystemParametersInfoA IsIconic GetWindowPlacement GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled MessageBoxA GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions UnregisterClassA GetMenuState EnableMenuItem CheckMenuItem PostQuitMessage EnableWindow PostMessageA LoadBitmapA FindWindowA PeekMessageA GetCursorPos GetForegroundWindow SetWindowRgn KillTimer ShowWindow BringWindowToTop SetRect GetNextDlgTabItem PtInRect CreateDialogIndirectParamA RegisterWindowMessageA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetWindowRect GetSystemMetrics SetWindowsHookExA CallNextHookEx CreateAcceleratorTableA RegisterClassExA LoadCursorA GetClassInfoExA IsWindow GetDesktopWindow SetFocus GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetFocus DestroyAcceleratorTable BeginPaint EndPaint CallWindowProcA FillRect ReleaseCapture GetClassNameA GetDlgItem GetParent IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient ClientToScreen GetClientRect MoveWindow GetSysColor SendMessageA SetWindowContextHelpId GetWindow SendDlgItemMessageA SetWindowPos CreateWindowExA MapDialogRect EndDialog FindWindowExA DefWindowProcA SetTimer GetWindowLongA SetWindowLongA DestroyWindow UnhookWindowsHookEx CharNextA IsDialogMessageA ModifyMenuA SetCursor

gdi32

SetWindowExtEx ScaleWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap TextOutA RectVisible DeleteDC SelectObject DeleteObject SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateBitmap SetBkMode CreateFontA CombineRgn CreateRectRgn GetStockObject GetObjectA CreateSolidBrush PtVisible

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

RegQueryValueA RegOpenKeyA RegEnumKeyA RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

shell32

ShellExecuteA

ole32

OleUninitialize OleInitialize CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID StringFromCLSID OleLockRunning CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoGetClassObject

oleaut32

SysStringLen SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr SysAllocStringLen VariantClear VariantChangeType SysAllocStringByteLen SysStringByteLen VariantInit OleCreateFontIndirect LoadRegTypeLi

shlwapi

PathFindFileNameA PathFindExtensionA

skywidget.exe

IMPHASH 5ea8350563f665041d10600a1a6a0e2c
SHA256 a051240474ebdd520d7e144be42327eb6d031877eebcd317799d9cd5506838f6
MD5 121134436747e494349071ae5fd3374c
SHA1 071412c2bde1d2a021b981831d744f2f789d01fb
SHA512 eb9dfd3c2898c11ac82b7087386f1fa0cb8d9a8c870d4809dd47055d46d150abab6182b9a47a1a463f6926c8b351774db24756a6bbd62f687c1690b66a58bc95
SSDEEP 6144:LfC3g+wZVaOjHb/+O1R0b7cKPFFRDZ85zqNOfBCY9mCOmga2Mf:Lfd+wZMOHmbY6FZ85zRzmagR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

204430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\GMT_업무\09_new상단\93_skywidget\98_skywidget_exe\01_광고주페이지동작수정_20150119\skywidget\release\skywidget.pdb

kernel32

CreateFileA GetFileAttributesA GetFileTime SetErrorMode GetTickCount HeapAlloc HeapFree GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitThread CreateThread HeapSize SetStdHandle GetFileType HeapDestroy GetFullPathNameA VirtualFree GetACP IsValidCodePage GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTimeZoneInformation GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetVolumeInformationA FindFirstFileA LoadLibraryW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile GetOEMCP GetCPInfo GlobalFlags InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime GetThreadLocale GetCurrentProcessId GetModuleFileNameW GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA LoadLibraryA lstrcmpW WritePrivateProfileStringA CreateEventA SuspendThread SetEvent WaitForSingleObject ResumeThread SetThreadPriority FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA lstrcmpA FreeLibrary GetModuleHandleA GetProcAddress GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv SetLastError CompareStringA CompareStringW GetVersion InterlockedExchange ExitProcess GetLastError CreateMutexA CloseHandle MultiByteToWideChar InterlockedDecrement TerminateProcess GetExitCodeProcess OpenProcess GetModuleFileNameA ReadFile lstrlenW CreateProcessA SetHandleInformation CreatePipe Process32Next Process32First RaiseException CreateToolhelp32Snapshot GetCurrentProcess GetLocalTime Sleep lstrlenA GetVersionExA SizeofResource LoadResource FindResourceA LockResource HeapCreate WideCharToMultiByte

user32

PostThreadMessageA MessageBeep GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableA CharNextA GetSysColorBrush ShowWindow MoveWindow SetWindowTextA IsDialogMessageA EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA CreateDialogIndirectParamA IsWindowEnabled GetNextDlgTabItem EndDialog SetCursor RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture GetClassLongA SetPropA GetPropA RemovePropA IsWindow SetFocus GetLastActivePopup SetActiveWindow GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA LoadCursorA GetWindowTextLengthA IsWindowVisible SetTimer CallWindowProcA GetWindowLongA SetWindowLongA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState GetCursorPos ValidateRect GetWindow SetWindowContextHelpId DestroyMenu MapDialogRect PostMessageA RegisterClipboardFormatA UnregisterClassA GetWindowTextA GetForegroundWindow IsIconic LoadIconA SetWindowPos KillTimer EnumWindows GetAncestor GetSystemMetrics GetWindowThreadProcessId GetDesktopWindow GetWindowRect DrawIcon GetClientRect FindWindowA SendMessageA EnableWindow PeekMessageA GetClassNameA CharUpperA GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState CheckMenuItem EnableMenuItem ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage

gdi32

GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode GetStockObject DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject GetDeviceCaps ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap Escape

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyA RegCloseKey GetUserNameA RegSetValueExA CheckTokenMembership RegQueryValueExA CreateWellKnownSid RegCreateKeyExA GetTokenInformation OpenProcessToken

shell32

ShellExecuteA SHGetSpecialFolderPathA ord680

comctl32

InitCommonControlsEx

shlwapi

UrlUnescapeA PathStripToRootA PathIsUNCA PathFindExtensionA PathFindFileNameA

oledlg

ord8

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

VariantClear SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayUnaccessData SafeArrayDestroy SysAllocStringByteLen SysAllocStringLen SysStringByteLen SysFreeString VariantInit SysStringLen VariantChangeType VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString

urlmon

URLDownloadToFileA

wininet

InternetCanonicalizeUrlA InternetCrackUrlA InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA DeleteUrlCacheEntry

skywidget_sajulove_new.dll

SHA256 85fb5445d1589a8c658637fd12c9e2798dbef2e248b038efff4943a20b9c0da5
MD5 0d52b0d2b60dc415af2850221b2c5002
SHA1 ddaaaa685379f6242a1d4e7ea4ecf27acf7bbe4b
SHA512 7f6486f2e218a0cb23f92c058d4953cd26b058cb3b949f3e25da66d1a7cf327e2217fd158625f0cbdaa1474e8f3c01a44642d537acc468608f80f82439ab4eb9
SSDEEP 12288:QLK8OzhR89DTgIUdebG4Ug1avAkALRC3Wc+NxO2IfhdEv66OyafWg:QW84IUgb5B/9Xc+NxOz4v66Oyaeg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
NSIS installer

installer

PE Signature issue

Digest

14:4a:50:4c:40:c8:9a:a2:a4:88:5a:d1:d5:95:a5:eb:6c:16:54:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Chains

Apr 13, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

40:6a:e2:1b:65:14:86:a6:67:bc:ec:13:cb:d2:09:fa

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 12, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

5

Entry point

2031617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

527KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.itext

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

13KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

skywidgeted.exe

IMPHASH 9b102b4e253fa5637ea5c79baa0d682b
SHA256 25190a20daf29836a63a18abe96e0c3bd7409d1c04e654c615b61f1c0d4fb6fa
MD5 e1e03923033ef166bb15011e66121ac4
SHA1 c8ab795189c08ff24caeb32c39e0f3c4f6e72395
SHA512 44e1bb79e10d25e5db5b786511a1eef89c5a945d77dfa1269188840db935efd876c5822f891a77b9e411dd28436f05823ff92f35eaf22033cd90cbf2fa9389d5
SSDEEP 6144:2Wpv43MCMsnMa4VqaeQhaXScUTNgSiK6f43h96RCFEdioAig7+KBWTxd:2Wpv+MH2aVatUTNgSiv7RCfoAig78x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

189706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\GMT_업무\09_new상단\93_skywidget\09_skywidget_ever\00_처음제작\skywidgeted\release\skywidgeted.pdb

kernel32

VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RaiseException RtlUnwind ExitThread CreateThread HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree GetACP IsValidCodePage GetStdHandle FreeEnvironmentStringsA HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetTimeZoneInformation LCMapStringA LCMapStringW GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA HeapAlloc GetFileTime FileTimeToLocalFileTime SetErrorMode GetOEMCP GetCPInfo GlobalFlags InterlockedIncrement FileTimeToSystemTime TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetModuleFileNameW GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile GetThreadLocale CreateEventA SuspendThread SetEvent WaitForSingleObject ResumeThread SetThreadPriority WritePrivateProfileStringA GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA GetCurrentProcessId FreeResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom FreeLibrary lstrcmpW GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv GetVersion InterlockedExchange CompareStringA MultiByteToWideChar CompareStringW ExitProcess lstrcmpA ReadFile GetLocalTime GetVersionExA CreateFileA GetTickCount GetCurrentThreadId GetConsoleCP Sleep GetCurrentProcess DeleteFileA CreateDirectoryA lstrlenA GetFileAttributesA SetLastError LoadLibraryA GetModuleHandleA CloseHandle GetLastError GetProcAddress GetModuleFileNameA SizeofResource LoadResource FindResourceA LockResource GetEnvironmentStrings WideCharToMultiByte LoadLibraryW

user32

PostThreadMessageA WinHelpA IsChild GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageA MapWindowPoints GetKeyState SetForegroundWindow IsWindowVisible UpdateWindow GetMenu MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA CopyAcceleratorTableA SetWindowPos SystemParametersInfoA GetWindowPlacement GetWindow EndPaint BeginPaint GetWindowDC GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostMessageA GetNextDlgGroupItem DrawFocusRect OffsetRect DrawEdge ReleaseCapture WindowFromPoint ClientToScreen GetCapture GetWindowLongA SetWindowRgn GetWindowRect DrawStateA InflateRect CharUpperA IsIconic CallNextHookEx UnhookWindowsHookEx SetDlgItemTextA GetDlgItem KillTimer IsWindow CharNextA DestroyMenu SetWindowsHookExA ReleaseDC ScreenToClient GetDC LoadIconA GetCursorPos LoadBitmapA SetRect SetTimer DrawIcon GetSystemMetrics GetParent GetSysColor GetClientRect GrayStringA DrawTextExA EnableWindow DrawTextA RegisterClipboardFormatA UnregisterClassA TabbedTextOutA InvalidateRect SendMessageA MessageBeep SetCapture InvalidateRgn IntersectRect IsRectEmpty LoadCursorA GetSysColorBrush SetCursor GetMessageA TranslateMessage ValidateRect GetDesktopWindow GetActiveWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog SetWindowContextHelpId MapDialogRect PostQuitMessage GetWindowThreadProcessId IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SendDlgItemMessageA GetMenuCheckMarkDimensions ModifyMenuA EnableMenuItem CheckMenuItem SetWindowLongA RegisterWindowMessageA SetMenuItemBitmaps

gdi32

SelectObject StretchBlt DeleteDC GetDeviceCaps SaveDC RestoreDC SetBkColor SetBkMode SetTextColor SetMapMode GetClipBox LineTo MoveToEx SetViewportOrgEx GetObjectA SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreateBitmap CreateFontIndirectA CreateRectRgnIndirect GetTextColor GetRgnBox DeleteObject CombineRgn CreateRectRgn GetPixel SelectClipRgn CreatePen GetTextExtentPoint32A GetStockObject CreateSolidBrush GetViewportExtEx GetWindowExtEx GetMapMode Escape CreateCompatibleBitmap LPtoDP CreateCompatibleDC BitBlt ExtTextOutA TextOutA GetBkColor RectVisible OffsetViewportOrgEx PtVisible DPtoLP

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

OpenProcessToken RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyA RegCloseKey RegSetValueExA CheckTokenMembership RegQueryValueExA GetUserNameA CreateWellKnownSid GetTokenInformation RegCreateKeyExA

shell32

ShellExecuteExA ord680 ShellExecuteA SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathFindFileNameA PathFindExtensionA PathStripToRootA PathFileExistsA PathIsUNCA

oledlg

ord8

ole32

CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoGetClassObject CoTaskMemFree OleUninitialize CoFreeUnusedLibraries StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysStringLen SysAllocStringByteLen VariantClear VariantChangeType VariantInit SysAllocStringLen VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString SysFreeString

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetCloseHandle InternetOpenUrlA InternetOpenA HttpOpenRequestA DeleteUrlCacheEntry HttpSendRequestA InternetConnectA

skywidgeter.exe

IMPHASH 0e9c34221245956ba98ff2684baf8660
SHA256 ad300d5180b5d5effb70eac81be707e58f13aa328bc03ae12ea09331fe3fc62a
MD5 b8e601ec45dda3531bd7302b64cb254c
SHA1 dce10e74b9373075817f3453351e14b62dfae112
SHA512 228c1a0f1add618ddbf648cafd7ec7f3e4264e8d2015bc98e44b915aa68420a97d9bba031a68561cce697416c8e1da5e9f4fa2bf43a7e712e7d3e337abf7ee8b
SSDEEP 6144:5Vz9umS0sF9Kw1T1SpoJCZyqqyXV2JM6twCeNjKs:5Vh49KKhioJ2yqrsJvwCG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

176874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\GMT_업무\09_new상단\93_skywidget\96_skywidgeter_exe\00_처음제작\Skywidgeter\release\skywidgeter.pdb

kernel32

DuplicateHandle GetCurrentProcess FindClose FindFirstFileA GetVolumeInformationA GetFullPathNameA CreateFileA GetTickCount SetErrorMode FileTimeToLocalFileTime GetFileAttributesA GetFileTime HeapAlloc HeapFree HeapReAlloc GetSystemTimeAsFileTime VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitThread CreateThread HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetFileSize IsValidCodePage HeapDestroy HeapCreate VirtualFree GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetStringTypeA GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA SetEndOfFile UnlockFile LoadLibraryW LockFile FlushFileBuffers SetFilePointer WriteFile GetOEMCP GetCPInfo GlobalFlags TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetModuleFileNameW FileTimeToSystemTime WritePrivateProfileStringA GetCurrentProcessId SuspendThread SetEvent ResumeThread SetThreadPriority GetCurrentThread ConvertDefaultLocale GetModuleFileNameA EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA lstrcmpA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv GetThreadLocale InterlockedIncrement FreeResource GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom FreeLibrary LoadLibraryA SetLastError lstrcmpW GetModuleHandleA GetProcAddress GetVersion InterlockedExchange CompareStringA CompareStringW Process32Next Process32First CreateToolhelp32Snapshot GetVersionExA lstrlenA RaiseException WaitForSingleObject TerminateProcess GetExitCodeProcess CreateEventA CloseHandle OpenProcess InterlockedDecrement ExitProcess GetLocalTime GetLastError CreateMutexA Sleep lstrlenW CreateProcessA ReadFile SetHandleInformation CreatePipe MultiByteToWideChar LockResource WideCharToMultiByte SizeofResource LoadResource GetACP FindResourceA

user32

RegisterClipboardFormatA PostThreadMessageA EndPaint BeginPaint GetWindowDC ReleaseDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA SetWindowContextHelpId MapDialogRect SetCursor GetMessageA TranslateMessage ValidateRect PostQuitMessage GetActiveWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog CharNextA IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuA GetMenuState EnableMenuItem UnregisterClassA RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextA GetLastActivePopup SetActiveWindow DispatchMessageA GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetKeyState SetForegroundWindow GetMenu GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx ScreenToClient EqualRect EnableWindow DrawIcon FindWindowA CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow MessageBeep SetCapture InvalidateRgn DrawEdge GetDC WindowFromPoint IsRectEmpty CopyAcceleratorTableA LoadCursorA GetSysColorBrush CheckMenuItem DestroyMenu GetWindowRect SendMessageA GetForegroundWindow UpdateWindow SetWindowPos GetWindowLongA KillTimer SetWindowLongA EnumWindows SetLayeredWindowAttributes GetWindowThreadProcessId PeekMessageA PostMessageA IsWindow GetClassNameA GetWindowTextLengthA SetTimer IsWindowVisible GetAncestor IsIconic GetDesktopWindow GetClientRect LoadIconA GetSystemMetrics CharUpperA SetRect OffsetRect DrawFocusRect ClientToScreen InvalidateRect ReleaseCapture GetParent GetSysColor GetNextDlgGroupItem LoadBitmapA GetCapture GetCursorPos

gdi32

ExtSelectClipRgn ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetRgnBox SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetObjectA SetMapMode SetBkMode RestoreDC SaveDC GetTextColor GetBkColor GetDeviceCaps GetStockObject CreateBitmap SetBkColor SetTextColor GetClipBox DeleteDC DeleteObject StretchBlt BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegOpenKeyExA RegSetValueExA RegQueryValueA RegEnumKeyA RegQueryValueExA RegOpenKeyA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetSpecialFolderPathA ShellExecuteA

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathFindExtensionA PathStripToRootA PathFindFileNameA PathIsUNCA

oledlg

ord8

ole32

CLSIDFromString CLSIDFromProgID CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CoSetProxyBlanket CoInitializeSecurity CoCreateInstance CoInitializeEx CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysAllocString SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayUnaccessData SafeArrayDestroy SysFreeString VariantClear VariantChangeType VariantInit OleCreateFontIndirect SysStringLen SysAllocStringByteLen VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen

urlmon

URLDownloadToFileA

wininet

InternetQueryDataAvailable InternetOpenA InternetConnectA InternetCloseHandle InternetReadFile DeleteUrlCacheEntry HttpSendRequestA HttpOpenRequestA

winmm

timeSetEvent timeKillEvent timeBeginPeriod

skywidgets.exe

IMPHASH 05b75db021947ddd3c5a2ee7a0d7db3f
SHA256 df90b340b912983f1c49d9f63b00375a5274ededb8bef3c901d0fed31476d389
MD5 ddccd6e8903414bd4f80246926379ed1
SHA1 d19177ad5b02a4d40a5e4393edd786511841cb87
SHA512 452f5dd1b2d1feb1e1d9571644678daeacb216ad2e15e8af011817525df6cf5c97ff93df9e729a4048d782b08c491377959086c12e610751a8358b14ff03f9bd
SSDEEP 6144:GLYdfzIxHkFk1tVbalFMc76mMig5olK3V00uJbNm7Lrdi5PJssl/F:GEVEqkag/Eg5olK3viNK8is
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=B&C,OU=IT Team,O=B&C,L=Bupyung-gu,ST=Incheon,C=KR

Serial Number

6e:3c:b1:c5:f3:65:ee:91:b6:16:26:07:80:24:5e:0f

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 21, 2014 - Aug 20, 2016

Minor OS version

0

Major OS version

4

Entry point

198980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\GMT_업무\09_new상단\93_skywidget\97_skywidgets_exe\00_처음제작\skywidgets\release\skywidgets.pdb

kernel32

CreateFileA GetFileAttributesA GetFileTime SetErrorMode GetTickCount HeapAlloc HeapFree HeapReAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitThread CreateThread HeapSize SetStdHandle GetFileType HeapDestroy GetFullPathNameA VirtualFree GetACP IsValidCodePage GetStdHandle LCMapStringA LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTimeZoneInformation GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetVolumeInformationA FindFirstFileA LoadLibraryW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile GetOEMCP GetCPInfo GlobalFlags InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime GetThreadLocale GetCurrentProcessId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA lstrcmpW WritePrivateProfileStringA CreateEventA SuspendThread SetEvent WaitForSingleObject ResumeThread SetThreadPriority FreeResource GetModuleFileNameW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA lstrcmpA FreeLibrary GetModuleHandleA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv SetLastError CompareStringW GetVersion InterlockedExchange CompareStringA LoadLibraryA GetProcAddress InterlockedDecrement GetModuleFileNameA ReadFile lstrlenW GetLocalTime CreateProcessA SetHandleInformation GetCurrentProcess GetVersionExA CreatePipe Process32Next Process32First CreateToolhelp32Snapshot RaiseException Sleep MultiByteToWideChar GetLastError lstrlenA CreateMutexA ExitProcess TerminateProcess GetExitCodeProcess CloseHandle OpenProcess SizeofResource LoadResource FindResourceA LockResource HeapCreate WideCharToMultiByte

user32

RegisterClipboardFormatA PostThreadMessageA GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableA CharNextA UnregisterClassA ReleaseCapture SetCapture GetSysColorBrush EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA ShowWindow SetWindowTextA IsDialogMessageA CreateDialogIndirectParamA IsWindowEnabled GetNextDlgTabItem EndDialog SetCursor RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture GetClassLongA SetPropA GetPropA RemovePropA IsWindow SetFocus GetWindowTextA SetActiveWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints UpdateWindow GetMenu MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetWindowLongA SetWindowLongA LoadCursorA GetWindowThreadProcessId DrawIcon MoveWindow OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState GetCursorPos ValidateRect GetWindow SetWindowContextHelpId MapDialogRect UnhookWindowsHookEx SetMenuItemBitmaps MessageBeep GetMenuCheckMarkDimensions LoadBitmapA DestroyMenu GetLastActivePopup SetForegroundWindow SetWindowPos SendMessageA PeekMessageA EnableWindow GetClassNameA GetWindowTextLengthA IsWindowVisible PostMessageA GetForegroundWindow GetAncestor LoadIconA SetTimer IsIconic GetDesktopWindow GetWindowRect GetClientRect KillTimer FindWindowA GetSystemMetrics EnumWindows CharUpperA GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState PostQuitMessage CheckMenuItem EnableMenuItem ModifyMenuA GetParent GetFocus TabbedTextOutA

gdi32

GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode GetStockObject DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject GetDeviceCaps ExtTextOutA TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap Escape

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

GetUserNameA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegOpenKeyA RegDeleteValueA CheckTokenMembership RegSetValueExA CreateWellKnownSid GetTokenInformation RegQueryValueExA OpenProcessToken RegCreateKeyExA RegCloseKey

shell32

ShellExecuteA ord680 SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA UrlUnescapeA PathStripToRootA PathIsUNCA PathFileExistsA PathFindFileNameA

oledlg

ord8

ole32

CoInitialize CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysStringByteLen SysFreeString SysAllocStringLen VariantInit SysAllocString VariantClear SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayUnaccessData SafeArrayDestroy SysStringLen VariantChangeType VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocStringByteLen

urlmon

URLDownloadToFileA

wininet

InternetCanonicalizeUrlA InternetCrackUrlA InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA DeleteUrlCacheEntry

uninstall.exe.nsis

SHA256 fb21a20ca7cdeb5ef6927094e66347c6272b3b26558a254c99e4f5cedc367499
MD5 7fc43a764526fd321afdc73edef4b11e
SHA1 1fd4a66561dac38efdc86f8230c81fdeda924686
SHA512 698175a92079b6c24d838b67e84da50d0899a082402abb2c435cf55b0e98f41465611c789d97a0f49b02f69e51e1483db1ffcda349bf2f46193d7ffc963f3a7c
SSDEEP 1536:uVuW4OWLctkhgZYZf/uPxw5+s1+9zpVxxV:ukW4O4ctha/uP65+cUx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer