ab7b3e5da3f9881c7d0ae286fe76fa812a94ca9864a3b1daf6f6bc498961a466

Sharing

Copy URL Twitter E-mail

General

Target

ab7b3e5da3f9881c7d0ae286fe76fa812a94ca9864a3b1daf6f6bc498961a466
Size

474KB
MD5

e0d66e31ba39f224c2965b75e0c7eba8
SHA1

f5d74dcaa8324e7951150c38e586bf16eb914696
SHA256

ab7b3e5da3f9881c7d0ae286fe76fa812a94ca9864a3b1daf6f6bc498961a466
SHA512

cc5ea0bcfaad082a4968a3a3f0095c7314e4dcb270a765bb648e3bd16bea750f0905ce17ecf2f2db2838c5d82963c5e3d5dd6ab9e457da22bfdd9d9b3728e377
SSDEEP

6144:g0hzhIZf5PjxxiuHUun0CZsc6z7eNZA35+YeMgGKwsqOz2APokLz1mvc+T3xbseM:Nzif5PPNt67tJ1k9mTpsb

Score

1^/10

Malware Config

Signatures

Files

ab7b3e5da3f9881c7d0ae286fe76fa812a94ca9864a3b1daf6f6bc498961a466
.exe windows:5 windows x64 arch:x64

e3b937074ea8981fbb70b5f708339c8b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

22/11/2019, 07:40

Not After

06/11/2020, 06:32

Subject

CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeounggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/02/2020, 00:00

Not After

06/02/2021, 23:59

Subject

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13055375776f6e,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:a3:e6:03:9a:d8:90:7a:81:3b:ee:db:3b:ca:f1:0b:9b:8c:2e:42:89:15:79:cd:f1:b6:2c:e4:5e:06:cb:d4
Signer

Actual PE Digest

dd:a3:e6:03:9a:d8:90:7a:81:3b:ee:db:3b:ca:f1:0b:9b:8c:2e:42:89:15:79:cd:f1:b6:2c:e4:5e:06:cb:d4

Digest Algorithm

sha256

PE Digest Matches

true

8a:12:eb:50:c9:f5:67:4c:c9:23:21:b3:ee:f8:63:5c:0e:9a:c4:d8
Signer

Actual PE Digest

8a:12:eb:50:c9:f5:67:4c:c9:23:21:b3:ee:f8:63:5c:0e:9a:c4:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Build\Product\UTM\1.0client\sslvpn\building\build\AhnLab\Product\GateSecurity\UTM\1.0client\sslvpn\Branch\20180810.2.7.4.8-867-r486978-TG2.7.4_Hotfix\Src\symbol\tgsvpnL64.pdb

Imports

libeay32

ord3050
ord1178
ord581
ord82
ord501
ord1653
ord1654
ord653
ord657
ord585
ord233
ord401
ord484
ord67
ord420
ord497
ord400
ord641
ord421
ord774
ord93
ord224
ord298
ord3212
ord52
ord109
ord95
ord66
ord87
ord1882
ord57
ord78
ord256
ord257
ord259
ord258
ord961
ord315
ord962
ord316
ord364

ssleay32

ord74
ord183

ws2_32

htonl
WSACleanup
inet_addr
gethostbyname
WSAGetLastError
inet_ntoa
WSAStartup

iphlpapi

GetBestInterface
GetAdaptersInfo

aossdk64

Aossdk_TerminatePdW
Aossdk_SetModeUI
Aossdk_SetModeAsync
Aossdk_StartAosSDKW
Aossdk_GetMkdObjectW

mfc90u

ord3975
ord4349
ord3317
ord671
ord2722
ord3493
ord2860
ord4096
ord2435
ord1061
ord1040
ord2946
ord3750
ord4465
ord3895
ord2560
ord5876
ord2347
ord1516
ord4187
ord4213
ord2184
ord5658
ord3248
ord265
ord3428
ord6451
ord1103
ord4883
ord4233
ord285
ord3008
ord1519
ord916
ord1110
ord1188
ord4108
ord4231
ord4322
ord5966
ord6381
ord5938
ord286
ord6234
ord1820
ord1938
ord5031
ord5653
ord5857
ord2433
ord5718
ord600
ord336
ord3861
ord3859
ord632
ord3282
ord2515
ord1512
ord5532
ord789
ord280
ord2531
ord2320
ord1975
ord5770
ord5771
ord3376
ord6179
ord5772
ord3862
ord1772
ord2014
ord5767
ord1306
ord614
ord355
ord2432
ord1949
ord4222
ord1307
ord1080
ord2218
ord2871
ord3291
ord3247
ord598
ord3250
ord4343
ord1576
ord266
ord5314
ord5013
ord1714
ord1713
ord1582
ord3135
ord6053
ord1429
ord4355
ord5335
ord4373
ord4856
ord5861
ord2719
ord4432
ord3249
ord3297
ord1980
ord296
ord2378
ord1149
ord332
ord588
ord6263
ord6209
ord6429
ord6207
ord4699
ord1840
ord791
ord756
ord583
ord775
ord3408
ord4372
ord4601
ord4051
ord2709
ord3809
ord3819
ord3818
ord3073
ord2598
ord2711
ord2605
ord2932
ord2780
ord4419
ord2904
ord2797
ord2602
ord5332
ord1634
ord1698
ord1699
ord2010
ord5307
ord1389
ord3014
ord6027
ord5093
ord3436
ord6425
ord3902
ord6423
ord1553
ord2226
ord2233
ord2470
ord2452
ord2450
ord2468
ord2480
ord2457
ord2473
ord2478
ord429
ord2973
ord1469
ord2821
ord2814
ord4033
ord2344
ord2336
ord777
ord394
ord1041
ord602
ord3257
ord4345
ord1578
ord2136
ord4205
ord1514
ord1977
ord2067
ord4225
ord3740
ord617
ord362
ord3535
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord4050
ord4687
ord5362
ord5345
ord5696
ord2907
ord4596
ord3424
ord2303
ord6116
ord1071
ord3930
ord772
ord577
ord3783
ord4658
ord5741
ord5738
ord4270
ord6199
ord2461
ord2463
ord2465
ord2459
ord2475
ord2455
ord949
ord945
ord947
ord943
ord938
ord5365
ord5367
ord6101
ord1635
ord4393
ord4843
ord3494
ord5346
ord4294
ord6421
ord5201
ord1954
ord5284
ord4351
ord1430
ord4048
ord1658
ord1661
ord6056
ord3137
ord1626
ord2142
ord779
ord913
ord3979
ord1209
ord6008
ord2956
ord5619
ord5416
ord1963
ord5791
ord1011
ord6058
ord5777
ord5544
ord5531
ord5235
ord6062
ord5849
ord3267
ord5764
ord3391
ord3492
ord722
ord512
ord728
ord3381
ord1615
ord1686
ord2437
ord6204
ord6196
ord6202
ord6023
ord2592
ord4139
ord3784
ord2392
ord643
ord1233

msvcr90

iswgraph
iswalpha
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
_CxxThrowException
__CxxFrameHandler3
memcmp
fopen
__iob_func
fwrite
fwprintf
fflush
_localtime64
memcpy
memset
_invalid_parameter_noinfo
??0exception@std@@QEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBV01@@Z
??1exception@std@@UEAA@XZ
_time64
memmove_s
atoi
swscanf
wcsstr
_wtoi
wcstok_s
wcsncmp
_vsnwprintf
_swprintf
strstr
strncpy
_snprintf
_snwprintf
fread
fclose
ftell
fseek
_wfopen
malloc
free
_vswprintf
wcsncpy
iswdigit
_wcsicmp

kernel32

LoadLibraryA
GetVersion
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
OutputDebugStringW
ReleaseMutex
GetPriorityClass
MulDiv
GetUserDefaultLangID
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
Sleep
GetVolumeInformationW
OpenProcess
GetVersionExW
FindFirstFileW
FindClose
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateMutexW
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
SetLastError
WriteFile
CreateFileW
GetSystemDirectoryW
DeleteFileW
CopyFileW
GetDriveTypeW
GetLogicalDrives
GetCurrentThreadId
GetModuleFileNameW
FreeLibrary
LoadLibraryW
CreateEventW
GetLastError
CreateFileMappingW
RtlCaptureContext
GetEnvironmentVariableW

user32

LoadBitmapW
InvalidateRect
FillRect
GetClientRect
SetClassLongW
CopyRect
ReleaseCapture
SetCapture
GetCapture
wsprintfW
SetRectEmpty
SetParent
DrawFocusRect
ShowWindow
ScreenToClient
PostMessageW
SetWindowRgn
SetFocus
SetWindowPos
GetForegroundWindow
EnumChildWindows
EnableWindow
GetClassLongW
LoadIconW
LoadStringW
FindWindowW
GrayStringW
DrawTextExW
TabbedTextOutW
KillTimer
SetTimer
DrawEdge
GetParent
GetClassLongPtrW
WindowFromDC
wsprintfA
PostQuitMessage
PtInRect
PeekMessageW
GetFocus
SetForegroundWindow
RedrawWindow
IsWindowVisible
UpdateWindow
GetWindowRect
ReleaseDC
GetDC
SetRect
GetSystemMetrics
IsWindow
SystemParametersInfoW
LoadCursorW
RegisterWindowMessageW
DrawTextW
GetSysColor
OffsetRect
MessageBoxW
SendMessageW
InflateRect

gdi32

CreateFontW
SetRectRgn
CreateSolidBrush
Escape
TextOutW
RectVisible
PtVisible
ExtTextOutW
CreateRectRgn
GetBkColor
DPtoLP
GetViewportExtEx
GetWindowExtEx
GetMapMode
LPtoDP
PatBlt
GetTextExtentPoint32W
CombineRgn
SelectObject
BitBlt
DeleteObject
Rectangle
ExtCreatePen
CreateFontIndirectW
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectW
GetStockObject
CreatePen

msimg32

TransparentBlt

advapi32

RegQueryValueExW
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
RegCreateKeyExW

shell32

ShellExecuteW
ShellExecuteExW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

NetWkstaGetInfo
NetApiBufferFree

Sections

.text
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3b937074ea8981fbb70b5f708339c8b

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

dd:a3:e6:03:9a:d8:90:7a:81:3b:ee:db:3b:ca:f1:0b:9b:8c:2e:42:89:15:79:cd:f1:b6:2c:e4:5e:06:cb:d4Signer

8a:12:eb:50:c9:f5:67:4c:c9:23:21:b3:ee:f8:63:5c:0e:9a:c4:d8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libeay32

ssleay32

ws2_32

iphlpapi

aossdk64

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

msvcp90

version

netapi32

Sections

.text Size: 191KB - Virtual size: 191KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 6KB - Virtual size: 22KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 143KB - Virtual size: 143KB

.reloc Size: 7KB - Virtual size: 6KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

dd:a3:e6:03:9a:d8:90:7a:81:3b:ee:db:3b:ca:f1:0b:9b:8c:2e:42:89:15:79:cd:f1:b6:2c:e4:5e:06:cb:d4
Signer

8a:12:eb:50:c9:f5:67:4c:c9:23:21:b3:ee:f8:63:5c:0e:9a:c4:d8
Signer

.text
Size: 191KB - Virtual size: 191KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 6KB - Virtual size: 22KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 143KB - Virtual size: 143KB

.reloc
Size: 7KB - Virtual size: 6KB