60dc5734b85a9b40588704dabeaf9c50N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

60dc5734b85a9b40588704dabeaf9c50N.exe
Size

5.1MB
MD5

60dc5734b85a9b40588704dabeaf9c50
SHA1

c084b3949e2467cd9ad35cbb8bec043c2406f6d4
SHA256

eaf98bc39c59012e7c384e17a6393f573c7f13ed075d324035c7d165c26d5aa2
SHA512

62e007aa9b02ec19bae01923b4639fcc650aeac9aa65ecee0052b536a224c9d0d9bd479f04cc90807124027914adc21133f96d1310c61c95e26af37960236f70
SSDEEP

98304:SatrnB0vrbzzzzzkzzzzz4CSOzp3xzOswPmUQPeviSDDaDZMjEZWkSmVRjRm22Oy:SatjB2bzzzzzkzzzzz4CFp5OsBUQmviL

Score

1^/10

Malware Config

Signatures

Files

60dc5734b85a9b40588704dabeaf9c50N.exe
.exe windows:4 windows x86 arch:x86

f79fdd2b42a1052a2ddbd3b1cf24bc90

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/06/2015, 00:00

Not After

07/09/2018, 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:c2:ef:fe:d2:f6:f7:ae:c6:6f:1d:08:77:a1:8c:45:cc:80:b7:26
Signer

Actual PE Digest

5a:c2:ef:fe:d2:f6:f7:ae:c6:6f:1d:08:77:a1:8c:45:cc:80:b7:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Project\personal\2012\code\setup\compsdll\7zsfxnoover_xor7zinfo\Release\7zSfx.pdb

Imports

comctl32

ord17

user32

FindWindowA
CharNextA
LoadStringA
SetWindowTextA
GetDlgItem
MessageBoxA
IsChild
GetDesktopWindow
GetLastActivePopup
GetWindowThreadProcessId
GetForegroundWindow
IsWindow
GetWindowInfo
CharUpperW
CharUpperA
PostMessageA
ShowWindow
EnableWindow
EnableMenuItem
GetMenuItemID
GetMenuItemCount
GetSystemMenu
SetTimer
EndDialog
KillTimer
IsWindowVisible
DialogBoxParamA
wsprintfA
SendMessageA

gdi32

CreateFontA
DeleteObject

oleaut32

VarBstrCat
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayDestroy
SysFreeString
VariantClear
SysAllocString
SysAllocStringLen
VariantInit

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA

shlwapi

PathAppendA
PathFindFileNameA
StrStrIA
PathAppendW
PathFindFileNameW
StrStrIW
PathRemoveExtensionA

kernel32

FlushFileBuffers
SetStdHandle
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetStringTypeA
InterlockedIncrement
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
LCMapStringW
LCMapStringA
TerminateProcess
GetLocaleInfoW
GetStringTypeW
ExitProcess
IsBadWritePtr
HeapCreate
HeapDestroy
TlsGetValue
InterlockedDecrement
GetProcessHeap
DeviceIoControl
LocalFree
GetFileType
TlsSetValue
TlsFree
TlsAlloc
GetCPInfo
GetOEMCP
ExitThread
HeapReAlloc
lstrlenA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetPrivateProfileIntA
GetModuleFileNameA
SetUnhandledExceptionFilter
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SuspendThread
GetProcAddress
GetModuleHandleA
RaiseException
CreateFileA
FreeLibrary
LoadLibraryA
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
GetLastError
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrlenW
GetTempPathA
CreateFileW
GetTempPathW
VirtualProtect
CreateDirectoryA
lstrcpynA
GetSystemTime
GetTickCount
GetFileAttributesA
WriteFile
ReadFile
SetFilePointer
GetFileSize
WaitForSingleObject
lstrcatA
GetStartupInfoA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
FindFirstFileA
GetPrivateProfileStringA
MoveFileA
GetFileSizeEx
OutputDebugStringA
Sleep
GetPrivateProfileSectionA
GetDiskFreeSpaceA
lstrcpyA
ReleaseMutex
TerminateThread
ResumeThread
CreateThread
GetCommandLineA
CreateMutexA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
SetFileTime
SetLastError
SetFileAttributesW
CreateDirectoryW
DeleteFileW
FindFirstFileW
SetEndOfFile
GetSystemInfo
RtlUnwind
HeapAlloc
HeapFree
VirtualQuery
GetSystemTimeAsFileTime

wininet

HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
InternetConnectA
InternetAttemptConnect
InternetCloseHandle

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ole32

CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 796KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f79fdd2b42a1052a2ddbd3b1cf24bc90

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2dCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5a:c2:ef:fe:d2:f6:f7:ae:c6:6f:1d:08:77:a1:8c:45:cc:80:b7:26Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

user32

gdi32

oleaut32

advapi32

shlwapi

kernel32

wininet

rpcrt4

version

ole32

Sections

.text Size: 180KB - Virtual size: 178KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 12KB - Virtual size: 1.0MB

.rsrc Size: 796KB - Virtual size: 792KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5a:c2:ef:fe:d2:f6:f7:ae:c6:6f:1d:08:77:a1:8c:45:cc:80:b7:26
Signer

.text
Size: 180KB - Virtual size: 178KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 12KB - Virtual size: 1.0MB

.rsrc
Size: 796KB - Virtual size: 792KB