netmarble_launcher_v100[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

netmarble_launcher_v100.exe
Size

6.4MB
MD5

6905ec959b8f5e280fea35b769984296
SHA1

850472062126ffbea093404346a63d5f4dd57fe1
SHA256

0e24c9a45704e7d2563a3f5e3cad576e120d1acf8ab09dd01e0584a96e7d89e8
SHA512

3784903de31c9092152be5ee54c5a106c16bc2513ffe48d55a5e191271994a3a110f4b3ff2ccf45ad0338cb866c901b2f40e97043592f9ce384f2bd23f9cb4e5
SSDEEP

98304:Hn/6pJRKUA/sHdxVUKmWCHWjMGW8wN/LUfmqwUf4iydrEfrZd:fyJRK4rn0Qo5Nj+Go4i+o9d

Score

1^/10

Malware Config

Signatures

Files

netmarble_launcher_v100.exe
.exe windows:4 windows x86 arch:x86

fc349687b82a59bedb5788849f9f2c0e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:8f:3a:01:bf:7e:7a:e8:4a:3e:b3:42:ab:0e:ec:f9
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

12/04/2011, 00:00

Not After

11/04/2013, 23:59

Subject

CN=CJ E&M Corp.,O=CJ E&M Corp.,L=Mapo-gu\ ,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

92:07:a0:50:c3:e3:82:8b:13:62:ba:26:82:e9:99:1a:ed:1c:3f:c6
Signer

Actual PE Digest

92:07:a0:50:c3:e3:82:8b:13:62:ba:26:82:e9:99:1a:ed:1c:3f:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

lstrcpynA
lstrcmpiA
GetFileAttributesA
lstrcatA
FindClose
FindFirstFileA
IsBadReadPtr
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
CreateFileMappingA
VirtualQuery
CompareStringA
CreateDirectoryA
CompareStringW
GetCurrentDirectoryA
ExpandEnvironmentStringsA
SetFileAttributesA
FileTimeToLocalFileTime
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
IsDBCSLeadByte
MoveFileExA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
WriteFile
lstrlenA
Sleep
CloseHandle
CreateProcessA
lstrlenW
GetDriveTypeA
FindResourceExA
GetPrivateProfileIntA
GetFileSize
SetFilePointer
CreateEventA
QueryPerformanceFrequency
ReleaseMutex
GetSystemDefaultLangID
CreateMutexA
SetErrorMode
LoadLibraryA
FreeLibrary
GetDiskFreeSpaceA
VerLanguageNameA
ReadFile
GetTickCount
GetCommandLineA
ExitThread
CreateThread
GetExitCodeProcess
FreeResource
MulDiv
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
GetLocaleInfoA
GetWindowsDirectoryA
InterlockedDecrement
LocalFree
InterlockedIncrement
FormatMessageA
GetTempPathA
GetVersionExA
CreateFileA
GlobalFree
FindResourceA
LoadResource
SizeofResource
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GetSystemDirectoryA
SetCurrentDirectoryA
WaitForSingleObject
ExitProcess
GetCurrentProcess
lstrcpyA
DuplicateHandle
GetThreadContext
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
ResumeThread
GetLastError
SetLastError
DeleteFileA
RemoveDirectoryA
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
FindNextFileA
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
lstrcmpA
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
ResetEvent
SearchPathA
VirtualProtect
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetVersion
GetCurrentProcessId
InitializeCriticalSection
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
HeapReAlloc
RaiseException
RtlUnwind
DeleteCriticalSection
InterlockedExchange
GetTempFileNameA
OpenProcess
CompareFileTime
GetProcessTimes
TerminateProcess
GetLocalTime
GetTimeFormatA
GetDateFormatA

user32

CharUpperA
DialogBoxIndirectParamA
WaitForInputIdle
SetActiveWindow
SetForegroundWindow
SetWindowLongA
SetWindowTextA
SendMessageA
GetDlgItem
LoadIconA
EndDialog
MoveWindow
GetWindowRect
wsprintfA
MessageBoxA
SetFocus
BeginPaint
LoadStringA
FillRect
EndPaint
GetMessageA
DefWindowProcA
GetWindow
SystemParametersInfoA
GetSystemMetrics
MapWindowPoints
GetPropA
EnableMenuItem
SetPropA
RemovePropA
GetSysColor
LoadImageA
GetDC
ReleaseDC
CreateDialogParamA
GetParent
GetWindowTextA
IsWindowVisible
CreateDialogIndirectParamA
GetDesktopWindow
ExitWindowsEx
RegisterClassExA
InvalidateRect
IntersectRect
EnumChildWindows
GetWindowDC
GetDlgItemTextA
CreateWindowExA
UpdateWindow
DrawIcon
MapDialogRect
GetClassNameA
CallWindowProcA
DrawFocusRect
InflateRect
DrawTextA
CopyRect
GetClientRect
IsWindowEnabled
FindWindowExA
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
EnableWindow
ShowWindow
SendDlgItemMessageA
PostMessageA
ScreenToClient
SetWindowPos
IsWindow
DestroyWindow
GetWindowLongA
SetDlgItemTextA

gdi32

SetBkMode
SetTextColor
TextOutA
RestoreDC
SetBkColor
CreateSolidBrush
UnrealizeObject
SelectPalette
RealizePalette
BitBlt
CreateCompatibleDC
SelectObject
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
DeleteDC
CreateHalftonePalette
GetDeviceCaps
TranslateCharsetInfo
GetObjectA
CreateFontIndirectA
DeleteObject
DeleteMetaFile
CreateCompatibleBitmap
CreateDCA
GetStockObject
GetTextExtentPoint32A
CreatePatternBrush
CreateDIBitmap
SetMetaFileBitsEx
SetStretchBltMode
SelectClipRgn
CreateRectRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC

advapi32

SetSecurityDescriptorGroup
RegCreateKeyExA
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegDeleteKeyA
RegEnumValueA
RegQueryValueExA
RegDeleteValueA
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
RegSetValueExA
SetSecurityDescriptorDacl
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoInitialize
CoUninitialize
CoInitializeSecurity

oleaut32

VariantChangeType
VariantClear
GetErrorInfo
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SysReAllocStringLen

lz32

LZOpenFileA
LZCopy
LZClose

msi

ord87
ord168
ord8
ord136
ord141

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

Sections

.text
Size: 406KB - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc349687b82a59bedb5788849f9f2c0e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

05:8f:3a:01:bf:7e:7a:e8:4a:3e:b3:42:ab:0e:ec:f9Certificate

Extended Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

92:07:a0:50:c3:e3:82:8b:13:62:ba:26:82:e9:99:1a:ed:1c:3f:c6Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

msi

rpcrt4

Sections

.text Size: 406KB - Virtual size: 406KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 30KB - Virtual size: 36KB

.rsrc Size: 300KB - Virtual size: 300KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

05:8f:3a:01:bf:7e:7a:e8:4a:3e:b3:42:ab:0e:ec:f9
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

92:07:a0:50:c3:e3:82:8b:13:62:ba:26:82:e9:99:1a:ed:1c:3f:c6
Signer

.text
Size: 406KB - Virtual size: 406KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 30KB - Virtual size: 36KB

.rsrc
Size: 300KB - Virtual size: 300KB