b26ca8cad72c4f5f8101eceb2256288d635d222c566a9c1358bd9ca5e565becb

Sharing

Copy URL Twitter E-mail

General

Target

b26ca8cad72c4f5f8101eceb2256288d635d222c566a9c1358bd9ca5e565becb
Size

1003KB
MD5

ff443c2eb4e61499c6e8885b3efd31a9
SHA1

3a23e4318c838939a79c2d1b2953683e9cae7edb
SHA256

b26ca8cad72c4f5f8101eceb2256288d635d222c566a9c1358bd9ca5e565becb
SHA512

fd8f26cc6274f1749f7eb4969cdb235c10500af920813419a7ffd62046998e76a51130078c559fc3f07947554dd75250624b2a59e176c3f677b052b619c15c95
SSDEEP

24576:D3xjKo3EIGodtztNz2ifaQ0vYrLPYvtCgeNFPVM4ZzQp:tjKo3hGodt3SuaQAYrEtCgeNJV1ZUp

Score

1^/10

Malware Config

Signatures

Files

b26ca8cad72c4f5f8101eceb2256288d635d222c566a9c1358bd9ca5e565becb
.dll windows:5 windows x86 arch:x86

2625fef2fc65549a0d47106122120b2d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

49:4f:f8:e9:16:07:15:8c:d4:80:b2:3c:61:5c:ff:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/02/2012, 00:00

Not After

28/03/2015, 23:59

Subject

CN=Spigot\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Spigot\, Inc.,L=El Granada,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:3c:17:97:54:0f:da:a7:d1:c6:74:20:97:28:c6:37:29:bb:46:e1
Signer

Actual PE Digest

11:3c:17:97:54:0f:da:a7:d1:c6:74:20:97:28:c6:37:29:bb:46:e1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\AutoBuild\Work\WidgiProject\WidgiToolbar\Release STATIC RUNTIME\WidgiInstallHelper.pdb

Imports

msi

ord118
ord160
ord159
ord32
ord49
ord171
ord145
ord74
ord103
ord125
ord8
ord17
ord111
ord47
ord158
ord64
ord51
ord135

kernel32

WideCharToMultiByte
DebugBreak
OutputDebugStringW
lstrlenA
ExpandEnvironmentStringsW
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
GetExitCodeProcess
GetModuleHandleA
GetVersion
GetFileAttributesW
LoadLibraryW
OutputDebugStringA
GetTempPathW
MultiByteToWideChar
FreeLibrary
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
ReadFile
SetFilePointer
WriteFile
CreateDirectoryW
MoveFileW
MoveFileExW
SetFileAttributesW
DeleteFileW
CopyFileW
GetTempFileNameW
FindFirstFileW
FindNextFileW
FindClose
SetCurrentDirectoryW
GetSystemTime
SystemTimeToFileTime
SetFileTime
FlushFileBuffers
SetEndOfFile
GetFileSize
GetFullPathNameW
GetFullPathNameA
CreateFileA
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
GetTickCount
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
FormatMessageW
GetFileAttributesA
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetCurrentProcessId
GlobalFree
AreFileApisANSI
DeleteFileA
CreateMutexW
ReleaseMutex
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
VirtualQuery
VirtualProtect
GetCommandLineA
GetCurrentDirectoryW
SetEnvironmentVariableW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedDecrement
GlobalHandle
RemoveDirectoryW
lstrlenW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetProcAddress
GetModuleHandleW
FindResourceExW
SizeofResource
Sleep
WaitForSingleObject
LocalAlloc
LocalFree
lstrcmpW
MulDiv
FlushInstructionCache
GetCurrentProcess
SetLastError
RaiseException
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
LoadResource
FindResourceW
InterlockedIncrement
GetTempPathA

user32

GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
SetDlgItemTextW
SetWindowTextW
LoadStringW
UnregisterClassA
SetWindowContextHelpId
MapDialogRect
CreateWindowExW
RegisterClassExW
EndDialog
DefWindowProcW
SetWindowLongW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
CallWindowProcW
InvalidateRgn
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
DestroyWindow
GetClassInfoExW
RedrawWindow
CharNextW
GetSysColor
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
SetFocus
MonitorFromWindow
GetFocus
GetWindow
GetWindowLongW
LoadCursorW
EnumChildWindows
IsCharAlphaNumericW
IsChild
EnumWindows
IsWindowVisible
FindWindowW
wvsprintfW
DialogBoxParamW
DialogBoxIndirectParamW
GetActiveWindow
PostMessageW
GetWindowThreadProcessId
SendMessageTimeoutW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
BeginPaint
EndPaint

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetObjectW
GetDeviceCaps
GetStockObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegRestoreKeyW
RegSaveKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetLengthSid
CopySid
DuplicateTokenEx
RegDeleteKeyW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertSidToStringSidW
IsValidSid
GetTokenInformation
OpenProcessToken
SetSecurityInfo
DeleteAce
GetAce
GetAclInformation
GetSecurityInfo
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteExW

ole32

CreateStreamOnHGlobal
OleUninitialize
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CoCreateInstance
CoCreateGuid
CoTaskMemFree
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject

oleaut32

VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString

shlwapi

PathFileExistsW
PathIsDirectoryW
PathIsSystemFolderW
PathAddBackslashW

userenv

UnloadUserProfile

wininet

InternetQueryOptionW
HttpQueryInfoW
InternetCrackUrlW
InternetReadFile
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetCloseHandle
HttpSendRequestW
InternetGetConnectedState

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

Exports

Exports

?ValidateInternetExplorerFeature@@YAKK@Z
ApproveBHO
CheckAllowedOperations
CleanupFoldersRollback
CloseAllBrowsers
DeleteFolders
DeleteSearchSettingsFolders
DeployFFBinary
DeployGCExtension
DisableGCWarning
DisableToolbarCoupons
DllMain
DummyCustomAction
EnableGCExtensions
GenerateISN
HandleInstallLogging
InstallFFLink
LoadBrowserSettings
MarkVCMSMsAsInstalled
OpenInstallPage
OpenPrivacyPolicy
OpenUninstallPage
PostMsgInstallProviders
PreserveUserPreferences
ReEnableIEBHO
RenameFiles
RenameFilesRollback
RestoreIEHook
SaveBrowserSettings
SetFFLink
SetHomePageURL
SetInstallTimeStamp
SetLocalWebSearchUrl
SetURLSearchHooks
ShowRebootRequired
StopSearchSettings
UnInstallFFLink
VC90CRTUpgradeFix
ValidateFirefoxFeature

Sections

.text
Size: 546KB - Virtual size: 545KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2625fef2fc65549a0d47106122120b2d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

49:4f:f8:e9:16:07:15:8c:d4:80:b2:3c:61:5c:ff:8bCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

11:3c:17:97:54:0f:da:a7:d1:c6:74:20:97:28:c6:37:29:bb:46:e1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

wininet

psapi

Exports

Exports

Sections

.text Size: 546KB - Virtual size: 545KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 13KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 28KB - Virtual size: 27KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

49:4f:f8:e9:16:07:15:8c:d4:80:b2:3c:61:5c:ff:8b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

11:3c:17:97:54:0f:da:a7:d1:c6:74:20:97:28:c6:37:29:bb:46:e1
Signer

.text
Size: 546KB - Virtual size: 545KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 13KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 28KB - Virtual size: 27KB