7ca7a5bf552c7ea04c2ef11e075de920N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7ca7a5bf552c7ea04c2ef11e075de920N.exe
Size

569KB
MD5

7ca7a5bf552c7ea04c2ef11e075de920
SHA1

1a2231b73ab3e449975de09259ca88c19a95c905
SHA256

489e9804dfc86aac55e9b3647607b28d71fdc95a15dc111d5acc12f20f51394b
SHA512

07d90b6f0bfadc13bb24ca0f7d26c591414bc9c42d1380bff46b33305a3987c17b217ff8bebcdcb3dfce7b3fcb56050b9596182c4991e33688851d4f884e73b8
SSDEEP

12288:ZvzJUU8L1+GFcqymz4ayNLGFGja5rbWMBgGPgNUGPgu:ZrR8L16tPVirbWMBon

Score

1^/10

Malware Config

Signatures

Files

7ca7a5bf552c7ea04c2ef11e075de920N.exe
.exe windows:4 windows x86 arch:x86

dfc469706a10e8b978f1353579575178

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2011, 00:00

Not After

05/01/2013, 23:59

Subject

CN=NHN corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NHN corp.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

88:ea:93:69:93:64:29:b0:88:46:ad:55:64:df:92:52:c5:47:41:a5
Signer

Actual PE Digest

88:ea:93:69:93:64:29:b0:88:46:ad:55:64:df:92:52:c5:47:41:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\DreamHunter\Desktop\Vaccine Src\naversetup\trunk\NaverAppSetupBuilder\Template\NaverAppSetupTemplate.pdb

Imports

kernel32

InterlockedDecrement
lstrlenW
RemoveDirectoryW
FindFirstFileW
InterlockedIncrement
GetExitCodeProcess
WaitForSingleObject
GetFileAttributesW
GetDiskFreeSpaceW
WideCharToMultiByte
GetModuleHandleW
GetVersionExW
DebugBreak
OutputDebugStringW
lstrlenA
GetCurrentProcess
GetCurrentProcessId
lstrcpynW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTickCount
CreateDirectoryW
GetModuleFileNameW
GetSystemDirectoryW
FindResourceW
SizeofResource
LoadResource
LockResource
CreateFileW
SetFilePointer
WriteFile
DeleteFileW
LoadLibraryA
OpenProcess
CloseHandle
LoadLibraryW
GetProcAddress
RaiseException
FreeLibrary
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapReAlloc
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize

user32

SetWindowPos
MessageBoxW
LoadStringW
CharLowerW
UnregisterClassA
GetWindowRect
SystemParametersInfoW
wsprintfW
EndDialog
CharNextW
wvsprintfW

advapi32

RegEnumKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
GetUserNameW
LookupAccountSidW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
RegEnumValueW

ole32

CoInitialize
CoCreateGuid
CoTaskMemFree
CoUninitialize

shell32

SHGetSpecialFolderPathW
ord680
ShellExecuteW
ShellExecuteExW

shlwapi

PathFindFileNameW
PathFileExistsW

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 428KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc469706a10e8b978f1353579575178

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:ccCertificate

Extended Key Usages

Key Usages

88:ea:93:69:93:64:29:b0:88:46:ad:55:64:df:92:52:c5:47:41:a5Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 428KB - Virtual size: 424KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:cc
Certificate

88:ea:93:69:93:64:29:b0:88:46:ad:55:64:df:92:52:c5:47:41:a5
Signer

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 428KB - Virtual size: 424KB