627cbbff4280a38e3c5a981c1fdaf010N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

627cbbff4280a38e3c5a981c1fdaf010N.exe
Size

7.4MB
MD5

627cbbff4280a38e3c5a981c1fdaf010
SHA1

ed3e508fd6c78ef431361c43949246e9718e1922
SHA256

599dcf4aacdf9fb4d15b2f3ed104bb5619b33f352cbadc4737e0b28f9a0eb2be
SHA512

366e394fb1d4d9dbdabcb9ae3d12718acc5345cf609d8cf7a1ed1ee504344f01bfdae4a76812e1101a80db11e6320ac6f5bd7381f8a764cadc21985459d5ec5f
SSDEEP

98304:wHKGA1DJoUDjH9tDfnqwFfVofZKRte0r0J8pONtM4:wqGA1DJs90wW4

Score

1^/10

Malware Config

Signatures

Files

627cbbff4280a38e3c5a981c1fdaf010N.exe
.exe windows:4 windows x86 arch:x86

82935279cc64d412044c6dabd2edb61e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:71:3d:35:f5:d4:9e:ca:b0:a8:0b:32:d4:76:15:4e
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

07/03/2011, 00:00

Not After

06/03/2013, 23:59

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:45:2b:64:eb:e3:c2:76:57:a6:1e:df:cb:c6:ac:33:ab:1e:e1:6b
Signer

Actual PE Digest

3e:45:2b:64:eb:e3:c2:76:57:a6:1e:df:cb:c6:ac:33:ab:1e:e1:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetVolumeInformationA
DeviceIoControl
IsBadReadPtr
GlobalUnlock
GlobalLock
MulDiv
lstrcpyA
EnumResourceLanguagesA
ConvertDefaultLocale
lstrcmpA
GlobalDeleteAtom
FreeResource
GlobalAddAtomA
lstrcmpW
lstrcatA
GlobalFindAtomA
GlobalGetAtomNameA
GlobalReAlloc
GlobalHandle
LocalReAlloc
TlsFree
GlobalFlags
LockFile
UnlockFile
GetCPInfo
GetOEMCP
SetErrorMode
GetFileTime
VirtualAllocEx
RtlUnwind
ExitProcess
VirtualQuery
HeapReAlloc
GetStartupInfoA
GetCommandLineA
ExitThread
GetDriveTypeA
GetSystemTimeAsFileTime
GetFileType
HeapSize
HeapDestroy
HeapCreate
IsBadWritePtr
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
SetStdHandle
GetStringTypeA
GetStringTypeW
IsBadCodePtr
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetEnvironmentVariableA
CreateRemoteThread
ReadProcessMemory
VirtualProtectEx
VirtualFreeEx
DosDateTimeToFileTime
SetFileTime
CreateJobObjectA
SetInformationJobObject
AssignProcessToJobObject
TerminateProcess
OpenEventA
OpenMutexA
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateThread
WaitForMultipleObjects
ResetEvent
GetProcessId
QueryInformationJobObject
GetProcessTimes
GetExitCodeProcess
TerminateJobObject
OpenProcess
OpenThread
WritePrivateProfileStringA
WriteProcessMemory
GetFullPathNameA
TlsAlloc
ResumeThread
TlsSetValue
TlsGetValue
FlushFileBuffers
MoveFileA
CopyFileA
LocalFileTimeToFileTime
SetFileAttributesA
DeleteFileA
FindNextFileA
GetFileAttributesExA
GetCurrentDirectoryA
SetThreadAffinityMask
QueryPerformanceCounter
QueryPerformanceFrequency
DebugBreak
DuplicateHandle
CreateDirectoryA
GetWindowsDirectoryA
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
CreateEventA
SetEndOfFile
SetFilePointer
WriteFile
SetEvent
TerminateThread
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
IsDBCSLeadByte
InterlockedIncrement
lstrcpynA
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
LoadLibraryExA
FindResourceA
LockResource
SizeofResource
ReleaseMutex
CreateMutexA
lstrlenW
FindResourceExA
LoadResource
GlobalAlloc
ReadFile
GlobalFree
WideCharToMultiByte
GetFileAttributesW
CreateFileW
GetFileSize
GetProcessHeap
HeapAlloc
GetPrivateProfileStringW
HeapFree
GetModuleFileNameW
FindFirstFileW
FindNextFileW
GetUserDefaultLCID
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLangID
GetLocaleInfoW
GetNumberFormatW
GetDateFormatW
LoadLibraryW
FreeLibrary
GetModuleFileNameA
GetPrivateProfileStringA
GetCurrentProcessId
lstrlenA
MultiByteToWideChar
GetLastError
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
WaitForSingleObject
Sleep
IsDebuggerPresent
LoadLibraryA
GetTickCount
GetCurrentThread
GetThreadContext
SetThreadContext
SetUnhandledExceptionFilter
OutputDebugStringA
FindFirstFileA
FindClose
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileA
GetCurrentThreadId
CreateProcessA
CloseHandle
GetFileAttributesA
DeleteCriticalSection
InitializeCriticalSection
RaiseException

user32

ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetPropA
RemovePropA
IsChild
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
DefWindowProcA
CallWindowProcA
CopyRect
RegisterWindowMessageA
RegisterClipboardFormatA
GetWindow
SetWindowContextHelpId
MapDialogRect
UnregisterClassA
IntersectRect
GetWindowDC
BeginPaint
EndPaint
GetSysColorBrush
SetForegroundWindow
AttachThreadInput
SetMenuItemBitmaps
ModifyMenuA
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetLastActivePopup
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetWindowTextA
GetFocus
SetWindowPos
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetMenuState
IsRectEmpty
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
GetMenuItemID
GetSubMenu
FindWindowExA
SetWindowPlacement
WaitForInputIdle
GetWindowPlacement
EnumWindows
PostThreadMessageA
GetSystemMetrics
GetWindowThreadProcessId
GetForegroundWindow
FindWindowA
GetWindowRect
MoveWindow
SetFocus
SystemParametersInfoA
PostMessageA
wsprintfA
CharLowerBuffW
PtInRect
OffsetRect
GetCursorPos
SetCapture
ReleaseCapture
IsWindow
SetCursor
LoadCursorA
MessageBoxW
CharLowerBuffA
LoadIconA
PostQuitMessage
SetRect
EnableMenuItem
GetMenuItemCount
InsertMenuA
SendMessageA
GetSystemMenu
IsIconic
SetWindowRgn
GetClientRect
InvalidateRect
SetTimer
EnableWindow
CharUpperA
GetClassNameA
ShowWindow
GetLastInputInfo
IsWindowVisible
GetParent
MessageBoxA
ChangeDisplaySettingsA
GetDC
ReleaseDC
CharNextA
SetPropA

gdi32

GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect
GetStockObject
DeleteDC
ExtSelectClipRgn
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
GetObjectA
SetBkColor
CreateRoundRectRgn
CreateRectRgn
GetDeviceCaps
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetTextColor
GetClipBox
SetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
CryptDeriveKey
CryptHashData
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExW
CryptSetKeyParam
RevertToSelf
ImpersonateSelf
RegCreateKeyExW
RegOpenKeyExW
RegSetKeySecurity
CryptDecrypt
CryptAcquireContextW
CryptCreateHash

shell32

SHGetSpecialFolderPathA
ShellExecuteExA
SHFileOperationA

comctl32

ord17

shlwapi

PathFileExistsA
PathRemoveFileSpecA
PathStripPathA
PathAppendA
PathAppendW
PathRemoveFileSpecW
PathUnquoteSpacesW
PathFindExtensionA
PathIsUNCA
PathFindFileNameA
PathStripToRootA

oledlg

ord8

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
StringFromCLSID
CoSetProxyBlanket
CLSIDFromProgID
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoInitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoUninitialize
CoCreateGuid
CLSIDFromString

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit
DispCallFunc
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
VariantCopy
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect

urlmon

URLDownloadToCacheFileA

rasapi32

RasEnumEntriesA

ws2_32

gethostname
gethostbyname
ntohl
WSACleanup
WSAStartup

crypt32

CertFreeCertificateContext
CertNameToStrA
CryptMsgGetAndVerifySigner
CryptQueryObject
CryptMsgClose

wintrust

WinVerifyTrust

wininet

InternetCloseHandle
HttpAddRequestHeadersA
InternetGetLastResponseInfoA
InternetReadFile
InternetQueryOptionA
HttpSendRequestA
HttpQueryInfoA
InternetOpenA
InternetConnectA
HttpOpenRequestA

winmm

timeGetTime
PlaySoundA

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dinput8

DirectInput8Create

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 503KB - Virtual size: 502KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pecode
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pccode
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.phs
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

82935279cc64d412044c6dabd2edb61e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1f:71:3d:35:f5:d4:9e:ca:b0:a8:0b:32:d4:76:15:4eCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

3e:45:2b:64:eb:e3:c2:76:57:a6:1e:df:cb:c6:ac:33:ab:1e:e1:6bSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

rasapi32

ws2_32

crypt32

wintrust

wininet

winmm

iphlpapi

psapi

dinput8

version

Sections

.text Size: 503KB - Virtual size: 502KB

.pecode Size: 81KB - Virtual size: 80KB

.pccode Size: 9KB - Virtual size: 9KB

.rdata Size: 139KB - Virtual size: 138KB

.data Size: 14KB - Virtual size: 37KB

.phs Size: 1KB - Virtual size: 1KB

.rsrc Size: 95KB - Virtual size: 94KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1f:71:3d:35:f5:d4:9e:ca:b0:a8:0b:32:d4:76:15:4e
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

3e:45:2b:64:eb:e3:c2:76:57:a6:1e:df:cb:c6:ac:33:ab:1e:e1:6b
Signer

.text
Size: 503KB - Virtual size: 502KB

.pecode
Size: 81KB - Virtual size: 80KB

.pccode
Size: 9KB - Virtual size: 9KB

.rdata
Size: 139KB - Virtual size: 138KB

.data
Size: 14KB - Virtual size: 37KB

.phs
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 95KB - Virtual size: 94KB