EyeToy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EyeToy.exe
Size

158KB
MD5

7509fd4746aee989bd21fe260cf76e83
SHA1

1fec70975b796e8da324bca7036abb5d47aecb0d
SHA256

df4a9b6c381780dbffe9cc4aee9797eda25528dd826b19d126f54a6cfb5d4822
SHA512

229d31bf5fb6a82892b2deeebd7bbf0f516cf886aeb88fd3e53cba732ca0d039910973100539751a6aedca1b2f6e1ea1abcd95ae2418e4d5c18f075d7db531c0
SSDEEP

3072:wPeHl6ZYeUSPzphcZ6DMgPOjT22lv5nH+uUZTt:geF6Z1Pths6PPt2lv5etZJ

Score

1^/10

Malware Config

Signatures

Files

EyeToy.exe
.exe windows:5 windows x86 arch:x86

9cc6b6a8066979db9d0643f5b223fbbd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:be:ab:c1:21:f4:82:4a:8f:85:a0:b4:33:ea:4f:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/12/2011, 00:00

Not After

01/12/2012, 23:59

Subject

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:fd:2c:ed:f0:c4:23:8f:a6:a8:4c:7b:ab:ba:90:dc:2f:f1:60:a3
Signer

Actual PE Digest

d5:fd:2c:ed:f0:c4:23:8f:a6:a8:4c:7b:ab:ba:90:dc:2f:f1:60:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

msacm32

acmFormatChooseW
acmMetrics

kernel32

GetFileAttributesW
GetModuleHandleW
HeapReAlloc
WriteConsoleW
SetStdHandle
LCMapStringW
HeapSize
MultiByteToWideChar
Sleep
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GlobalAlloc
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetStringTypeW
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RaiseException
HeapAlloc
HeapFree
GetLastError
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
EncodePointer
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
lstrlenW
CreateFileW
GetFileSize
CloseHandle
LoadLibraryW
GetFullPathNameW
FlushFileBuffers
GetProcAddress
FreeLibrary
GetDiskFreeSpaceW
MulDiv
GetEnvironmentStringsW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA

user32

CreatePopupMenu
UpdateWindow
SetWindowPos
GetClientRect
GetWindowRect
GetSystemMetrics
GetWindowTextW
GetWindowLongW
GetSysColor
TranslateMessage
PeekMessageW
TranslateAcceleratorW
DispatchMessageW
WaitMessage
LoadAcceleratorsW
LoadCursorW
LoadImageW
RegisterClassW
GetDC
ReleaseDC
CreateWindowExW
ShowWindow
PostQuitMessage
GetAsyncKeyState
BeginPaint
EndPaint
MoveWindow
DefWindowProcW
PostMessageW
AppendMenuW
GetMenuItemCount
EnableMenuItem
KillTimer
SetTimer
InvalidateRect
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
IsCharAlphaW
IsCharAlphaNumericW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
GetDlgItem
SetFocus
MessageBeep
EnableWindow
MessageBoxW
SetWindowTextW
DialogBoxParamW
EndDialog
GetMenu
GetSubMenu
RemoveMenu
CheckMenuItem

gdi32

SetTextColor
ExtTextOutW
PatBlt
DeleteObject
CreateSolidBrush
CreateFontW
GetStockObject
SelectObject
GetTextMetricsW
SetBkColor

comdlg32

GetOpenFileNameW

advapi32

RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
MkParseDisplayName
CreateBindCtx
CoInitializeEx
CoUninitialize

oleaut32

OleCreatePropertyFrame
SysFreeString

Sections

.text
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cc6b6a8066979db9d0643f5b223fbbd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

17:be:ab:c1:21:f4:82:4a:8f:85:a0:b4:33:ea:4f:b7Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d5:fd:2c:ed:f0:c4:23:8f:a6:a8:4c:7b:ab:ba:90:dc:2f:f1:60:a3Signer

Headers

DLL Characteristics

File Characteristics

Imports

winmm

msacm32

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

Sections

.text Size: 86KB - Virtual size: 85KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 5KB - Virtual size: 18KB

.rsrc Size: 37KB - Virtual size: 37KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

17:be:ab:c1:21:f4:82:4a:8f:85:a0:b4:33:ea:4f:b7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d5:fd:2c:ed:f0:c4:23:8f:a6:a8:4c:7b:ab:ba:90:dc:2f:f1:60:a3
Signer

.text
Size: 86KB - Virtual size: 85KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 18KB

.rsrc
Size: 37KB - Virtual size: 37KB