82d81c164e4d33845eb157c84c664530N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

82d81c164e4d33845eb157c84c664530N.exe
Size

5.2MB
MD5

82d81c164e4d33845eb157c84c664530
SHA1

fca52039d8c272b2a2fe886fe4febe428e5ff559
SHA256

0c64b2298a6a2be13833165f8b6715deda756578b4218adeecb3bb3fb7a6fd82
SHA512

6b8979cbfcb1340005be93de6b2847c132ed038bd65aadc1f6503704453a3296aaf82d0c2951a2b8c493645c27d3bf84dcb6f314ff3019cdba20a205c4f46bd4
SSDEEP

98304:baBrnB0vrbzzzzzkzzzzzJJTRDdUjcqrFfSXo3QR2k1fpAcq3yVHq627uqucoA0:baBjB2bzzzzzkzzzzzHa5r0XeQlxAcqm

Score

1^/10

Malware Config

Signatures

Files

82d81c164e4d33845eb157c84c664530N.exe
.exe windows:4 windows x86 arch:x86

f79fdd2b42a1052a2ddbd3b1cf24bc90

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/06/2015, 00:00

Not After

07/09/2018, 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:8a:34:9f:ea:c1:9a:a5:f8:b7:c2:d8:24:c5:e5:d5:6e:58:14:08
Signer

Actual PE Digest

56:8a:34:9f:ea:c1:9a:a5:f8:b7:c2:d8:24:c5:e5:d5:6e:58:14:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Project\personal\2012\code\setup\compsdll\7zsfxnoover_xor7zinfo\Release\7zSfx.pdb

Imports

comctl32

ord17

user32

FindWindowA
CharNextA
LoadStringA
SetWindowTextA
GetDlgItem
MessageBoxA
IsChild
GetDesktopWindow
GetLastActivePopup
GetWindowThreadProcessId
GetForegroundWindow
IsWindow
GetWindowInfo
CharUpperW
CharUpperA
PostMessageA
ShowWindow
EnableWindow
EnableMenuItem
GetMenuItemID
GetMenuItemCount
GetSystemMenu
SetTimer
EndDialog
KillTimer
IsWindowVisible
DialogBoxParamA
wsprintfA
SendMessageA

gdi32

CreateFontA
DeleteObject

oleaut32

VarBstrCat
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayDestroy
SysFreeString
VariantClear
SysAllocString
SysAllocStringLen
VariantInit

advapi32

RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA

shlwapi

PathAppendA
PathFindFileNameA
StrStrIA
PathAppendW
PathFindFileNameW
StrStrIW
PathRemoveExtensionA

kernel32

FlushFileBuffers
SetStdHandle
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetStringTypeA
InterlockedIncrement
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
LCMapStringW
LCMapStringA
TerminateProcess
GetLocaleInfoW
GetStringTypeW
ExitProcess
IsBadWritePtr
HeapCreate
HeapDestroy
TlsGetValue
InterlockedDecrement
GetProcessHeap
DeviceIoControl
LocalFree
GetFileType
TlsSetValue
TlsFree
TlsAlloc
GetCPInfo
GetOEMCP
ExitThread
HeapReAlloc
lstrlenA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetPrivateProfileIntA
GetModuleFileNameA
SetUnhandledExceptionFilter
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SuspendThread
GetProcAddress
GetModuleHandleA
RaiseException
CreateFileA
FreeLibrary
LoadLibraryA
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
GetLastError
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrlenW
GetTempPathA
CreateFileW
GetTempPathW
VirtualProtect
CreateDirectoryA
lstrcpynA
GetSystemTime
GetTickCount
GetFileAttributesA
WriteFile
ReadFile
SetFilePointer
GetFileSize
WaitForSingleObject
lstrcatA
GetStartupInfoA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
FindFirstFileA
GetPrivateProfileStringA
MoveFileA
GetFileSizeEx
OutputDebugStringA
Sleep
GetPrivateProfileSectionA
GetDiskFreeSpaceA
lstrcpyA
ReleaseMutex
TerminateThread
ResumeThread
CreateThread
GetCommandLineA
CreateMutexA
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
VirtualAlloc
VirtualFree
CreateEventA
SetEvent
ResetEvent
SetFileTime
SetLastError
SetFileAttributesW
CreateDirectoryW
DeleteFileW
FindFirstFileW
SetEndOfFile
GetSystemInfo
RtlUnwind
HeapAlloc
HeapFree
VirtualQuery
GetSystemTimeAsFileTime

wininet

HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
InternetConnectA
InternetAttemptConnect
InternetCloseHandle

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ole32

CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 796KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f79fdd2b42a1052a2ddbd3b1cf24bc90

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2dCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

56:8a:34:9f:ea:c1:9a:a5:f8:b7:c2:d8:24:c5:e5:d5:6e:58:14:08Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

user32

gdi32

oleaut32

advapi32

shlwapi

kernel32

wininet

rpcrt4

version

ole32

Sections

.text Size: 180KB - Virtual size: 178KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 12KB - Virtual size: 1.0MB

.rsrc Size: 796KB - Virtual size: 792KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

56:8a:34:9f:ea:c1:9a:a5:f8:b7:c2:d8:24:c5:e5:d5:6e:58:14:08
Signer

.text
Size: 180KB - Virtual size: 178KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 12KB - Virtual size: 1.0MB

.rsrc
Size: 796KB - Virtual size: 792KB