a77f44d10532babdca37f27f93ba1e20N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a77f44d10532babdca37f27f93ba1e20N.exe
Size

469KB
MD5

a77f44d10532babdca37f27f93ba1e20
SHA1

37a815002778e4acd024c1be64816ce31f5f5bab
SHA256

bc4c5052d658d55a012c2533d5446ade6d25b65a3f5f42dea3ec95eea8dfbc6a
SHA512

443469fe0c5d99e9aafc711536651d988756e8e9d5218100db30e7a6cad5d1f6962e1b182eefa7a56ad032436858ec1981a8af154b8be306f2d8a32f06bed453
SSDEEP

6144:MRPAAZaRXI7wEpYQ8E7mIFkvObrPtl2COtKJEFz1mvc+T3xbs1Lf:MtzZaN/g8E/koOtKifmTps17

Score

1^/10

Malware Config

Signatures

Files

a77f44d10532babdca37f27f93ba1e20N.exe
.exe windows:5 windows x64 arch:x64

6da6ed620f05192d1ebf3fc121e124d2

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

22/11/2019, 07:40

Not After

06/11/2020, 06:32

Subject

CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeounggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/02/2020, 00:00

Not After

06/02/2021, 23:59

Subject

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13055375776f6e,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:28:0e:c7:a1:9f:99:7c:67:ff:60:e5:03:18:ce:5c:9d:c2:4e:30:86:8e:46:b6:96:b9:70:87:15:5a:3a:df
Signer

Actual PE Digest

5a:28:0e:c7:a1:9f:99:7c:67:ff:60:e5:03:18:ce:5c:9d:c2:4e:30:86:8e:46:b6:96:b9:70:87:15:5a:3a:df

Digest Algorithm

sha256

PE Digest Matches

true

30:46:b7:31:99:e5:5d:11:59:35:2b:2a:4a:1c:6b:17:bb:c4:12:ae
Signer

Actual PE Digest

30:46:b7:31:99:e5:5d:11:59:35:2b:2a:4a:1c:6b:17:bb:c4:12:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\Build\Product\UTM\1.0client\sslvpn\building\build\AhnLab\Product\GateSecurity\UTM\1.0client\sslvpn\Branch\20180810.2.7.4.8-867-r486978-TG2.7.4_Hotfix\Src\symbol\tgsvpnU64.pdb

Imports

wininet

DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindCloseUrlCache

iphlpapi

GetBestRoute
GetBestInterface
GetAdaptersInfo

aossdk64

Aossdk_TerminatePdW

ssleay32

ord8
ord48
ord96
ord78
ord108
ord43
ord74
ord183
ord341
ord12
ord87
ord75

mfc90u

ord1975
ord2320
ord5770
ord5772
ord5861
ord3862
ord1772
ord2432
ord1516
ord4187
ord2184
ord5658
ord1963
ord6288
ord4871
ord3269
ord4213
ord789
ord1194
ord824
ord1229
ord1310
ord2436
ord2001
ord4207
ord2141
ord3331
ord5619
ord6058
ord1152
ord1071
ord1122
ord5699
ord5698
ord6398
ord5512
ord2303
ord772
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord4050
ord4687
ord5362
ord5345
ord5696
ord2907
ord3424
ord577
ord4658
ord3783
ord744
ord3393
ord3740
ord512
ord722
ord4699
ord4225
ord4222
ord2222
ord355
ord2014
ord614
ord362
ord617
ord5767
ord1306
ord3391
ord3247
ord2067
ord4322
ord4856
ord3535
ord1080
ord2437
ord5600
ord2650
ord3750
ord677
ord435
ord671
ord2139
ord4349
ord3039
ord3317
ord883
ord5561
ord4174
ord792
ord2392
ord1075
ord916
ord1088
ord1186
ord4035
ord4139
ord280
ord2722
ord2218
ord332
ord1938
ord1820
ord3249
ord1512
ord6381
ord2975
ord2515
ord2531
ord5532
ord1211
ord1215
ord265
ord5771
ord4231
ord4108
ord3376
ord714
ord487
ord286
ord598
ord2195
ord1154
ord1103
ord777
ord3734
ord4596
ord1170
ord601
ord3521
ord3700
ord3707
ord3784
ord3861
ord3859
ord336
ord5718
ord6179
ord5857
ord5653
ord600
ord2433
ord5031
ord3282
ord632
ord266
ord4432
ord2719
ord5966
ord6209
ord6429
ord6427
ord4233
ord6234
ord6207
ord5314
ord5013
ord1714
ord1713
ord1582
ord3135
ord6053
ord1429
ord4355
ord5335
ord4373
ord756
ord2142
ord1626
ord3137
ord6056
ord1661
ord1658
ord4048
ord1430
ord4351
ord5284
ord1954
ord5201
ord6421
ord4294
ord5346
ord3494
ord4843
ord4393
ord1635
ord6101
ord5367
ord5365
ord938
ord943
ord947
ord945
ord949
ord2455
ord2475
ord2459
ord2465
ord2463
ord2461
ord2478
ord2473
ord2457
ord2480
ord2468
ord2450
ord2452
ord2470
ord2233
ord2226
ord1553
ord6423
ord3902
ord6425
ord3436
ord5093
ord6027
ord3014
ord1389
ord5307
ord2010
ord1699
ord1698
ord1634
ord5332
ord2602
ord2797
ord2904
ord4419
ord2780
ord2932
ord2605
ord2711
ord2598
ord3073
ord3818
ord3819
ord3809
ord2709
ord4051
ord4601
ord4372
ord3408
ord2133
ord4343
ord3250
ord2261
ord2936
ord6008
ord6006
ord2214
ord3975
ord508
ord507
ord2881
ord1050
ord4465
ord1051
ord429
ord2871
ord5235
ord1011
ord583
ord1949
ord1307
ord3291
ord1980
ord296
ord2378
ord887
ord1149
ord588
ord3297
ord791
ord1840
ord779
ord337
ord927
ord5791
ord1576
ord1233

msvcr90

__crt_debugger_hook
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
_amsg_exit
fread
_wfopen
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
_vsnwprintf
__iob_func
fclose
__CxxFrameHandler3
fwrite
fwprintf
fflush
_localtime64
wcsrchr
strrchr
wcsncat
sscanf
_atoi64
wcstok
strncmp
_decode_pointer
_onexit
_lock
fopen
__dllonexit
swscanf
_wtol
memcmp
atoi
srand
rand
_wtoi
wcsncmp
_gmtime64
wcschr
strstr
_snwprintf
_swprintf
malloc
_wgetenv
_time64
iswgraph
iswalpha
iswdigit
_localtime64_s
_snprintf
strncpy
_wcsicmp
_CxxThrowException
memcpy
wcsstr
wcsncpy
memset
__wgetmainargs

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
OutputDebugStringW
lstrlenW
RtlLookupFunctionEntry
RtlCaptureContext
TerminateThread
GetPriorityClass
OpenProcess
CreateEventA
CreateFileMappingA
CreateProcessW
SystemTimeToFileTime
GetVersionExW
FindFirstFileW
SetUnhandledExceptionFilter
FindClose
CreateFileA
GetFileSize
CreateFileW
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcess
TerminateProcess
GetFileAttributesA
CompareFileTime
GetEnvironmentVariableW
CreateDirectoryA
GetFileAttributesW
CreateDirectoryW
MulDiv
GetComputerNameW
GetSystemTime
GetProcAddress
CreateEventW
CopyFileW
GetStartupInfoW
GetVersion
FindFirstFileA
LoadLibraryA
GetTickCount
GetSystemDirectoryW
Sleep
CreateThread
GetProcessHeap
HeapFree
SetCurrentDirectoryW
GetUserDefaultLangID
LoadLibraryW
DeleteFileW
WaitForSingleObject
GetModuleFileNameW
SleepEx
CloseHandle
UnmapViewOfFile
FreeLibrary
OpenFileMappingW
MapViewOfFile
GetCurrentThreadId
lstrcpynW
CreateMutexW
GetLastError
ReleaseMutex
WideCharToMultiByte
MultiByteToWideChar
GetVolumeInformationW

user32

SetWindowRgn
IsWindow
SetClassLongW
GetClassLongW
EnumChildWindows
LoadStringW
FindWindowW
PtInRect
GetClassNameW
DrawIcon
EnableMenuItem
GetWindowThreadProcessId
LoadMenuW
IsIconic
IsWindowVisible
GetDesktopWindow
SetCursor
GetCursorPos
SendMessageTimeoutW
CopyRect
InflateRect
wsprintfA
wsprintfW
AttachThreadInput
GetForegroundWindow
SetWindowPos
SetFocus
PostMessageW
LoadBitmapW
ScreenToClient
FindWindowExW
ShowWindow
LoadIconW
LoadCursorW
RegisterWindowMessageW
MessageBoxW
SetForegroundWindow
BringWindowToTop
FillRect
GetClientRect
SendMessageW
DrawTextW
OffsetRect
GetSysColor
SystemParametersInfoW
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
RedrawWindow
UpdateWindow
GetSubMenu
GetWindowRect
InvalidateRect

gdi32

Rectangle
ExtCreatePen
DeleteObject
GetTextExtentPoint32W
BitBlt
CreateCompatibleDC
CombineRgn
SetRectRgn
CreateRectRgn
CreateCompatibleBitmap
CreateSolidBrush
GetObjectW
CreateFontIndirectW
CreatePen
SelectObject
GetDeviceCaps
CreateFontW
GetStockObject

msimg32

TransparentBlt

advapi32

RegEnumKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW

shell32

Shell_NotifyIconW
ShellExecuteExW
ShellExecuteW

comctl32

_TrackMouseEvent

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
OleRun

oleaut32

CreateErrorInfo
SetErrorInfo
VariantInit
VariantClear
VariantChangeType
GetErrorInfo
SysFreeString
SysAllocString
SysAllocStringLen

ws2_32

socket
setsockopt
recvfrom
sendto
htonl
bind
send
select
recv
WSACleanup
htons
connect
closesocket
WSAStartup
inet_addr
gethostbyname
WSAGetLastError
inet_ntoa

msvcp90

?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEBAPEB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

netapi32

NetApiBufferFree
NetWkstaGetInfo

Sections

.text
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6da6ed620f05192d1ebf3fc121e124d2

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69Certificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

5a:28:0e:c7:a1:9f:99:7c:67:ff:60:e5:03:18:ce:5c:9d:c2:4e:30:86:8e:46:b6:96:b9:70:87:15:5a:3a:dfSigner

30:46:b7:31:99:e5:5d:11:59:35:2b:2a:4a:1c:6b:17:bb:c4:12:aeSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

iphlpapi

aossdk64

ssleay32

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

ole32

oleaut32

ws2_32

msvcp90

version

netapi32

Sections

.text Size: 175KB - Virtual size: 174KB

.rdata Size: 115KB - Virtual size: 114KB

.data Size: 6KB - Virtual size: 181KB

.pdata Size: 13KB - Virtual size: 13KB

.rsrc Size: 143KB - Virtual size: 143KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

1d:56:1a:97:1e:67:60:3e:06:ee:ec:69
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

44:1e:97:24:4f:89:1a:07:d0:35:c8:d8:62:ea:d1:c3
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

5a:28:0e:c7:a1:9f:99:7c:67:ff:60:e5:03:18:ce:5c:9d:c2:4e:30:86:8e:46:b6:96:b9:70:87:15:5a:3a:df
Signer

30:46:b7:31:99:e5:5d:11:59:35:2b:2a:4a:1c:6b:17:bb:c4:12:ae
Signer

.text
Size: 175KB - Virtual size: 174KB

.rdata
Size: 115KB - Virtual size: 114KB

.data
Size: 6KB - Virtual size: 181KB

.pdata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 143KB - Virtual size: 143KB