SecuriteInfo[.]com[.]Trojan[.]Zpevdo[.]13840[.]6966[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe
Size 876KB
Sample240616-e2h4qatcnl
SHA256 8c3ec0d50dcb3d53ed59b59bdeed03a2b612eb621e5165abcac10b2263e5b2bd
MD5 defb954877aaa262579251a39f855933
SHA1 81900aca1e422b7bfe78bc7ea2089d4f8a722168
SHA512 c9f914b87d6cb4c185f2f0b6d637a2ede287ac7b948ac5c826a2a6aeab588f054be768c7e3b168a506ebe8e2d448581b06fa49ff0937e2473b68e201e24f2943
SSDEEP 12288:R7sRowUy7oneiornbBDa222OUYxROhxSIfIkcibNb4WfTyQh:R7zwUKliornbB4HxiS6Ik/Nb4WGU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe

.exe 876KB

SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe

IMPHASH 6d378b6ff06c71c5e5db2ed4c0703c08
SHA256 8c3ec0d50dcb3d53ed59b59bdeed03a2b612eb621e5165abcac10b2263e5b2bd
MD5 defb954877aaa262579251a39f855933
SHA1 81900aca1e422b7bfe78bc7ea2089d4f8a722168
SHA512 c9f914b87d6cb4c185f2f0b6d637a2ede287ac7b948ac5c826a2a6aeab588f054be768c7e3b168a506ebe8e2d448581b06fa49ff0937e2473b68e201e24f2943
SSDEEP 12288:R7sRowUy7oneiornbBDa222OUYxROhxSIfIkcibNb4WfTyQh:R7zwUKliornbB4HxiS6Ik/Nb4WGU
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

f9:03:7c:eb:e5:15:56:cc:b9:f0:a1:88:cd:4f:83:4c:38:a7:e5:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SimpleHelp Ltd,OU=SimpleHelp Ltd,O=SimpleHelp Ltd,L=London,ST=London,C=GB

Chains

Apr 2, 2013

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

36:12:22:96:c5:e3:38:a5:20:a1:d2:5f:4c:d7:09:54

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Jan 1, 2021

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=SimpleHelp Ltd,OU=SimpleHelp Ltd,O=SimpleHelp Ltd,L=London,ST=London,C=GB

Serial Number

56:e4:a1:cf:d0:05:81:c3:83:93:f9:60:8e:41:a8:13

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 17, 2011 - Nov 23, 2013

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

48944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdiplus

GdipDrawRectangleI GdipCreateFromHWND GdipCreatePen1 GdipGetImageWidth GdipFillRectangleI GdipDrawImageI GdipCreateSolidFill GdipDrawImageRectI GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateBitmapFromScan0 GdipDrawImagePointRectI GdipGetImageHeight GdipDeletePen GdipDeleteBrush GdiplusStartup GdipCloneImage GdipCreateBitmapFromFile GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown

wininet

InternetCloseHandle InternetOpenA HttpSendRequestA InternetErrorDlg HttpOpenRequestA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA

winhttp

WinHttpGetProxyForUrl WinHttpOpen WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser

kernel32

HeapFree SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA CompareStringW CompareStringA CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetTimeZoneInformation GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetOEMCP GetACP GetCPInfo HeapSize InitializeCriticalSection LoadLibraryA SetFilePointer ReadFile RtlUnwind FlushFileBuffers GetCurrentProcess GetProcAddress GetModuleHandleA GetVersionExA lstrlenA WaitForSingleObject SetEvent FormatMessageA Sleep CreateEventA GetLastError LocalAlloc CreateMutexA ReleaseMutex CloseHandle LocalFree CreateThread GlobalFree DeleteFileA GetExitCodeProcess CreateProcessA GetCurrentDirectoryA TerminateThread GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate HeapDestroy IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA EnterCriticalSection LeaveCriticalSection CreateDirectoryA GetDriveTypeA GetFullPathNameA GetSystemTimeAsFileTime ExitProcess MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableA ExitThread GetCurrentThreadId GetCommandLineA GetProcessHeap TerminateProcess

user32

DestroyWindow GetMessageA SetTimer GetWindowRect PostThreadMessageA MonitorFromPoint KillTimer LoadIconA SendMessageA GetMonitorInfoA TranslateMessage SetWindowLongA GetWindowLongA CreateWindowExA PeekMessageA DefWindowProcA SetWindowPos GetCursorPos ShowWindow DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA GetDesktopWindow

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Trojan.Zpevdo.13840.6966.exe

PE Signature issue

gdiplus

wininet

winhttp

kernel32

user32

generic