VNC-Viewer-7[.]12[.]1-Windows-32bit[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

VNC-Viewer-7.12.1-Windows-32bit.exe
Size

9.2MB
MD5

b61541bba8ba2fead806cca47aedfec1
SHA1

1144c0afc2833211e01cdfe34274382227e85628
SHA256

960031c4f7d6dfa04cd1310ca68b73f962ad3354af31607c4c58f643cf559c9f
SHA512

7771fa0a3c668a4b2b8f91ea0091067a810843714ea5d3001b08abdcb6671d4dc3e32f6ecfa24a3bc68370e73920ece1b014e0d262344b4939a898b9d6e3c871
SSDEEP

196608:Y68hayuuB792CXtQdFD8U4e3enVNZMlbC:liac79TQP8UFYVTMl2

Score

1^/10

Malware Config

Signatures

Files

VNC-Viewer-7.12.1-Windows-32bit.exe
.exe windows:6 windows x86 arch:x86

Password: infected

138f75f350602236f10981ace6500667

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:86:ff:b0:20:0b:73:1e:ab:b1:41:ae:a9:2d:65:f3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

24-10-2023 00:00

Not After

31-10-2026 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:c4:ca:8e:0b:b6:9d:ff:1c:44:7b:90:00:5e:1a:2c:58:68:46:13:77:23:6e:14:92:5c:85:01:2f:b9:43:1d
Signer

Actual PE Digest

5f:c4:ca:8e:0b:b6:9d:ff:1c:44:7b:90:00:5e:1a:2c:58:68:46:13:77:23:6e:14:92:5c:85:01:2f:b9:43:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ent-slave-root\workspace\VNCConnect\Builds\Clients\VNC_7.12.x\label\con-windows-64\bld32\RelWithDebInfo\vncviewer.pdb

Imports

crypt32

CryptUnprotectData
CryptAcquireCertificatePrivateKey
CryptProtectData
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertCloseStore
CertGetEnhancedKeyUsage

ws2_32

WSADuplicateSocketW
WSASocketW
htons
ntohs
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
accept
bind
closesocket
ioctlsocket
getsockopt
setsockopt
socket
WSAStartup
WSAConnect
getpeername
getsockname
WSASetLastError
htonl
shutdown
send
recv
listen
select
WSASendTo
WSASend
WSAGetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohl
inet_ntoa
inet_addr

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Add
ImageList_Create
ImageList_Destroy
_TrackMouseEvent

imm32

ImmGetVirtualKey
ImmGetContext
ImmSetOpenStatus

kernel32

GetFileAttributesW
RemoveDirectoryW
SetEndOfFile
SetFilePointer
MoveFileW
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
GetLocaleInfoW
GetUserDefaultLCID
ConnectNamedPipe
CreateNamedPipeW
WaitForMultipleObjects
CompareStringW
LCMapStringW
FormatMessageW
GetHandleInformation
SetHandleInformation
CreateProcessW
LockResource
SizeofResource
FindResourceW
GetComputerNameW
GetSystemDirectoryA
LoadLibraryA
GetSystemDirectoryW
GetVersionExW
GetTempPathW
GetTempFileNameW
CreateThread
GetCurrentThread
TerminateThread
ResumeThread
GetThreadTimes
WriteFile
OutputDebugStringW
RtlCaptureStackBackTrace
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetExitCodeProcess
GetProcessId
LocalAlloc
ReOpenFile
GetSystemInfo
FlushFileBuffers
GetNumberFormatW
DuplicateHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTimeFormatW
GetDateFormatW
ExitProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
QueryFullProcessImageNameW
GetCurrentProcess
SearchPathW
GetProcAddress
GetSystemTimeAsFileTime
GetCommandLineW
WriteConsoleW
CreateDirectoryW
GetConsoleMode
FreeConsole
AllocConsole
SetLastError
GetFileType
SetStdHandle
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetNativeSystemInfo
WakeAllConditionVariable
TryEnterCriticalSection
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
CreateSemaphoreW
SetThreadPriority
InitializeCriticalSectionEx
WaitForSingleObjectEx
ReleaseSemaphore
QueryPerformanceFrequency
QueryPerformanceCounter
GetLongPathNameA
CancelIo
GetOverlappedResult
ReadFile
WaitForSingleObject
GetCurrentThreadId
Sleep
SetFileAttributesW
CreateFileW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalSize
GetFileAttributesExW
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetErrorMode
GetVolumeInformationW
GetLogicalDrives
GetFileAttributesA
GetCurrentDirectoryW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
FindFirstFileA
FindClose
LocalFree
GetLastError
LoadLibraryW
GetModuleFileNameW
FreeLibrary
LoadLibraryExA
GetCurrentProcessId
CloseHandle
DeleteFileW
SetCurrentDirectoryW
ReadConsoleW
OpenProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
LoadLibraryExW
SetFilePointerEx
GetConsoleOutputCP
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
IsValidLocale
EnumSystemLocalesW
GetFileSizeEx
DecodePointer
SetConsoleCtrlHandler
HeapReAlloc
SetEnvironmentVariableW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
HeapSize
VirtualProtect
VirtualQuery
LoadResource

user32

DefWindowProcW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromRect
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
CreateIconIndirect
CreateWindowExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
ChangeClipboardChain
SetClipboardViewer
SendMessageTimeoutW
CreateMenu
SetMenu
SetParent
ShowCursor
ScrollWindowEx
IsWindowVisible
SetWindowRgn
IsZoomed
CloseClipboard
OpenClipboard
GetClipboardOwner
GetParent
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
MapVirtualKeyW
IsDialogMessageW
EnumChildWindows
SetWindowTextW
EndDialog
DialogBoxParamW
CreateDialogParamW
GetDoubleClickTime
SetMenuItemInfoW
InsertMenuItemW
RegisterWindowMessageW
GetMenuItemCount
CheckMenuItem
GetMenuState
GetKeyboardLayoutNameW
WindowFromPoint
GetClassNameW
IsWindowEnabled
PostMessageW
GetCursor
OffsetRect
GetWindowTextW
GetClipboardData
LoadIconW
GetDesktopWindow
SetForegroundWindow
GetForegroundWindow
ReleaseCapture
SetCapture
GetKeyState
GetDlgCtrlID
GetWindowPlacement
keybd_event
VkKeyScanExW
VkKeyScanExA
ToAsciiEx
GetAsyncKeyState
GetKeyboardLayoutList
ToUnicodeEx
SendInput
mouse_event
PostThreadMessageW
MsgWaitForMultipleObjects
MessageBoxW
PeekMessageW
PostQuitMessage
GetSystemMetrics
GetCursorPos
BeginPaint
EndPaint
GetSysColor
GetSysColorBrush
FillRect
SendMessageW
GetSystemMenu
EnableMenuItem
GetDlgItem
EnableWindow
ShowWindow
SetWindowPos
DrawTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
TranslateMessage
RedrawWindow
KillTimer
SetTimer
DefDlgProcW
DeleteMenu
DestroyWindow
IsChild
GetMessageW
GetComboBoxInfo
InflateRect
DrawFocusRect
DrawFrameControl
GetKeyboardState
GetKeyboardLayout
MapWindowPoints
SetCursor
MessageBeep
AdjustWindowRectEx
UpdateWindow
IsIconic
GetAncestor
GetNextDlgTabItem
SystemParametersInfoW
FrameRect
ReleaseDC
GetWindowDC
GetDC
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
LoadCursorW
ScreenToClient
ClientToScreen
InvalidateRect
SetMenuDefaultItem
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
GetMessagePos
RegisterClipboardFormatW
GetFocus
SetFocus
EmptyClipboard
SetClipboardData
GetWindowThreadProcessId
GetOpenClipboardWindow
SetWindowLongW
GetWindowLongW
DispatchMessageW

gdi32

GetRegionData
SetMapMode
GetTextExtentPoint32W
SetDIBColorTable
CreateDIBSection
GdiAlphaBlend
CreateBitmap
StretchBlt
GetClipBox
CreateDCW
CreateCompatibleDC
GetTextMetricsW
SetRectRgn
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
GetPixel
PatBlt
GetCharWidthW
SetWindowOrgEx
SetPaletteEntries
SelectPalette
RealizePalette
OffsetRgn
GetRandomRgn
CreateRectRgn
CreatePalette
BitBlt
RoundRect
CreateSolidBrush
CreateCompatibleBitmap
SetBkColor
Rectangle
GetStockObject
CreateBrushIndirect
MoveToEx
LineTo
DeleteObject
CreatePen
StretchDIBits
GetDeviceCaps
EndPage
StartPage
EndDoc
StartDocW
ResetDCW
DeleteDC
SetBkMode
GetObjectW
SetTextColor
GetDIBits
CreateFontIndirectW
SelectObject

shell32

SHGetKnownFolderPath
SHGetMalloc
SHAddToRecentDocs
Shell_NotifyIconW
SHFileOperationW
ord74
SHGetPathFromIDListW
DragQueryFileA
ShellExecuteW
SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder

ole32

CoTaskMemFree
OleGetClipboard
ReleaseStgMedium
OleSetClipboard
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
OleInitialize
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
PropVariantClear
DoDragDrop
CoTaskMemRealloc
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
OleUninitialize

oleaut32

SafeArrayGetDim
SysFreeString
SysAllocString
SafeArrayGetElement
VariantClear

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

GetTokenInformation
CryptCreateHash
CryptSetProvParam
CryptReleaseContext
CryptDestroyHash
CryptSignHashW
CreateProcessAsUserW
OpenProcessToken
EqualSid
RegCloseKey
CryptGenRandom
CryptAcquireContextW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityDescriptorSacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
SetSecurityDescriptorControl
MakeSelfRelativeSD
MakeAbsoluteSD
InitializeSecurityDescriptor
GetSecurityDescriptorLength
GetSecurityDescriptorControl
SetEntriesInAclW
InitializeAcl
GetAclInformation
ConvertStringSidToSidW
ConvertSidToStringSidW
LookupAccountNameW
LookupAccountSidW
IsValidSid
GetSidIdentifierAuthority
GetLengthSid
FreeSid
CopySid
AllocateAndInitializeSid
CreateProcessWithLogonW
LogonUserW
CryptHashData
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetUserNameW
SetSecurityInfo
GetSecurityInfo
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW

Sections

.text
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 789KB - Virtual size: 789KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 336KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

138f75f350602236f10981ace6500667

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:86:ff:b0:20:0b:73:1e:ab:b1:41:ae:a9:2d:65:f3Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5f:c4:ca:8e:0b:b6:9d:ff:1c:44:7b:90:00:5e:1a:2c:58:68:46:13:77:23:6e:14:92:5c:85:01:2f:b9:43:1dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

ws2_32

comctl32

imm32

kernel32

user32

gdi32

shell32

ole32

oleaut32

comdlg32

advapi32

Sections

.text Size: 6.3MB - Virtual size: 6.3MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 78KB - Virtual size: 127KB

.rodata Size: 2KB - Virtual size: 2KB

.rsrc Size: 789KB - Virtual size: 789KB

.reloc Size: 336KB - Virtual size: 335KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:86:ff:b0:20:0b:73:1e:ab:b1:41:ae:a9:2d:65:f3
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5f:c4:ca:8e:0b:b6:9d:ff:1c:44:7b:90:00:5e:1a:2c:58:68:46:13:77:23:6e:14:92:5c:85:01:2f:b9:43:1d
Signer

.text
Size: 6.3MB - Virtual size: 6.3MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 78KB - Virtual size: 127KB

.rodata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 789KB - Virtual size: 789KB

.reloc
Size: 336KB - Virtual size: 335KB