552c65ac7f2a0b665d9c70f1f824cda0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

552c65ac7f2a0b665d9c70f1f824cda0N.exe
Size

182KB
MD5

552c65ac7f2a0b665d9c70f1f824cda0
SHA1

dc29125e7cb5096b3f020c7664b81c6a16b5687e
SHA256

a5cee32efd4cdda1266090b34979b45eee1482903dc444b3614192d810d71a23
SHA512

28916614afa6ed8e4dbea04f6d7e7405e36d532ecd0b3dc1d6a72c78ded43c83268599a31d6519907416d95a7adcb7f8b0f7395ea1e645731532a25ea7f5f1e3
SSDEEP

3072:eFtCyPsV1itDkSpTd3NBvPjwO89doXRzRAQROhyVzaMy:esVwDkW9BkBSvvROhygJ

Score

1^/10

Malware Config

Signatures

Files

552c65ac7f2a0b665d9c70f1f824cda0N.exe
.dll windows:6 windows x64 arch:x64

f254db7a12a8709ce37d352381804db1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/04/2015, 00:00

Not After

13/04/2018, 23:59

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:5e:f2:b7:72:28:2b:e7:e1:c8:31:c4:9e:7c:51:36:85:97:a2:80
Signer

Actual PE Digest

2b:5e:f2:b7:72:28:2b:e7:e1:c8:31:c4:9e:7c:51:36:85:97:a2:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

glib-lite

ord219
ord286
ord295
ord368
ord376
ord377
ord285
ord289
ord209
ord302
ord213
ord303
ord301
ord314
ord172
ord372
ord353
ord308
ord279
ord222
ord223
ord105
ord107
ord102
ord108
ord103
ord166
ord176
ord179
ord350
ord358
ord381
ord300
ord362
ord129
ord6
ord2
ord27
ord95
ord77
ord253
ord251
ord357
ord370
ord175
ord170
ord147
ord312
ord313
ord319
ord263
ord169
ord168
ord3

gstreamer-lite

ord117
ord85
ord158
ord156
ord45
ord4
ord2
ord6
ord5
ord3
ord1
ord180
ord174
ord72
ord159
ord114
ord103
ord106
ord102
ord97
ord145
ord70
ord175
ord177
ord178
ord176
ord78
ord179
ord173
ord171
ord155
ord93
ord96
ord91
ord92
ord182
ord169
ord153
ord151
ord54
ord83
ord113
ord125
ord128
ord146
ord64
ord63
ord19
ord164
ord172
ord163
ord94
ord38
ord42
ord138
ord112
ord137
ord104
ord131
ord133
ord111
ord147
ord67
ord66
ord120
ord121
ord139
ord181
ord75
ord74
ord162
ord52
ord53
ord59
ord40
ord49
ord43
ord41
ord58
ord119
ord134
ord135
ord116
ord115
ord129
ord136
ord108
ord132
ord130
ord126
ord124
ord101
ord98
ord107
ord127
ord110
ord161
ord149
ord148
ord150
ord73
ord69
ord71
ord68
ord65
ord21
ord18
ord20
ord17
ord29
ord27
ord30
ord25
ord28
ord167
ord168
ord170
ord157

kernel32

GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
CloseHandle
CreateFileA
ReadFile
SetFilePointer
WriteFile
GetLastError
GetTempPathA
GetTempFileNameA
FreeLibrary
LoadLibraryA
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventA
GetCurrentThreadId
WaitForMultipleObjects
lstrcmpW
CreateSemaphoreA
CreateThread
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
GetTickCount
GetVersionExA
GetModuleHandleA
GetProcAddress
Sleep
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls

ole32

CoInitialize
CoTaskMemAlloc
CLSIDFromString
CoFreeUnusedLibraries
CoTaskMemFree
CoCreateInstance
CoUninitialize

msvcr120

__clean_type_info_names_internal
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memset
__CxxFrameHandler3
__dllonexit
_calloc_crt
memcmp
memcpy
strstr
??_V@YAXPEAX@Z
_vsnwprintf
strcmp
calloc
free
malloc
abs
_purecall
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
__C_specific_handler
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
_lock
_unlock
_onexit

winmm

timeEndPeriod
timeBeginPeriod
timeKillEvent
timeSetEvent

user32

GetQueueStatus
PostThreadMessageA
PeekMessageA
DispatchMessageA
RegisterWindowMessageA
MsgWaitForMultipleObjects

Exports

Exports

gst_plugin_desc

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f254db7a12a8709ce37d352381804db1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

2b:5e:f2:b7:72:28:2b:e7:e1:c8:31:c4:9e:7c:51:36:85:97:a2:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

glib-lite

gstreamer-lite

kernel32

ole32

msvcr120

winmm

user32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 1KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

2b:5e:f2:b7:72:28:2b:e7:e1:c8:31:c4:9e:7c:51:36:85:97:a2:80
Signer

.text
Size: 120KB - Virtual size: 120KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 1KB - Virtual size: 1KB