USBChargerPlus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

USBChargerPlus.exe
Size

18.9MB
MD5

5499b15ce29051558bbc39ba4882e379
SHA1

7bfe68955cb209e56b44be0f3596983beb805616
SHA256

108ac56490baa66337e792da69cfb18f76be7478d7add949c6af2271feb7a343
SHA512

a7e5a012dbda5ced6e8ee039457351dca90fd80dea4d83b3ea90af2ff420b17989c0891cdb6f58f78ac0e9abf361ec54482e62ded477b8a9758ce231666c178a
SSDEEP

196608:OCgmjuLUlqRx6++5UnqN6o344OUqCxacYEeTx:ImeOqRxl+5eo34qqfcYhx

Score

1^/10

Malware Config

Signatures

Files

USBChargerPlus.exe
.exe windows:5 windows x86 arch:x86

e6f219f4c70015ef43a9f26b2e8ab7ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:08:d9:bc:13:07:26:de:26:ee:4e:f2:8e:13:30:84
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

31/07/2012, 00:00

Not After

03/08/2015, 23:59

Subject

CN=ASUSTeK Computer Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Quality Testing Department,O=ASUSTeK Computer Inc.,L=Taipei / Peitou,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Project\USBChargerPlus\TFS\USBChargePlus_tfs\Pdb\USBChargerPlus.pdb

Imports

mfc100u

ord8277
ord11081
ord3402
ord10937
ord13380
ord8112
ord11163
ord6247
ord10045
ord8393
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord1512
ord1519
ord4388
ord4425
ord4396
ord4408
ord4404
ord4400
ord4430
ord4421
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord14067
ord3992
ord2665
ord13382
ord7109
ord13388
ord6156
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord2952
ord2951
ord2852
ord11159
ord5143
ord9333
ord8347
ord381
ord948
ord3397
ord11982
ord2184
ord5799
ord2185
ord5855
ord5801
ord4290
ord5862
ord3985
ord8599
ord3446
ord6344
ord7624
ord7548
ord11784
ord12610
ord14060
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord13570
ord13567
ord13572
ord13569
ord13571
ord13568
ord3416
ord5261
ord11228
ord11236
ord7391
ord9498
ord11240
ord14059
ord14132
ord14149
ord14145
ord14147
ord14148
ord14146
ord2417
ord7385
ord2884
ord2887
ord1300
ord12606
ord5556
ord2756
ord2980
ord2981
ord3627
ord10412
ord10058
ord8179
ord11123
ord13047
ord7973
ord3261
ord5641
ord9525
ord4909
ord286
ord5828
ord8509
ord6661
ord1296
ord2878
ord11021
ord11801
ord7524
ord923
ord11031
ord6036
ord345
ord3495
ord6243
ord4150
ord4151
ord12867
ord337
ord11997
ord3174
ord7357
ord290
ord11940
ord4356
ord2614
ord5264
ord285
ord2629
ord1310
ord7929
ord7932
ord2064
ord11209
ord11845
ord4642
ord4923
ord5115
ord8483
ord4901
ord5118
ord4645
ord4794
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9328
ord8346
ord6140
ord890
ord1292
ord7176
ord1895
ord296
ord7619
ord1312
ord1450
ord4360
ord13181
ord902
ord1905
ord2188
ord4359
ord3482
ord2068
ord12413
ord10409
ord4606
ord7903
ord3754
ord5900
ord11936
ord12940
ord2418
ord8264
ord11210
ord5468
ord5802
ord897
ord11933
ord12930
ord8036
ord12933
ord11999
ord12007
ord11786
ord11870
ord11511
ord11493
ord12628
ord12157
ord5826
ord12548
ord12944
ord4139
ord1266
ord3763
ord2844
ord8273
ord6117
ord6870
ord12182
ord12871
ord4355
ord7006
ord5229
ord3428
ord6318
ord265
ord266
ord13391
ord12948
ord917
ord3746
ord2746
ord4744
ord5558
ord1934
ord1298
ord4086
ord1987
ord6869
ord3978
ord4805
ord12951
ord6711
ord788
ord1212
ord10081
ord12186
ord4802
ord374
ord13854
ord945
ord2089

msvcr100

wcsrchr
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_purecall
toupper
swscanf
wctob
_wcsdup
_wcslwr
wcstok
_wcsnicmp
strtol
_wcsicmp
sprintf_s
fwrite
fread
strtok_s
atoi
fseek
swprintf_s
wcsncpy
_vswprintf_c_l
_wcsupr_s
printf
memcpy
free
wcstol
__CxxFrameHandler3
memmove
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
malloc
_waccess
wcsncpy_s
wcsstr
strstr
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
memset
_vsnwprintf
ftell
rewind
_snwprintf
fputws
fflush
fputs
fclose
wcscpy_s
_wfopen

kernel32

EnterCriticalSection
GetLocalTime
LeaveCriticalSection
DeleteCriticalSection
GetTickCount
GetSystemPowerStatus
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InitializeCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
GlobalLock
GlobalUnlock
FindResourceW
SizeofResource
LoadResource
LockResource
WriteFile
FreeResource
FlushFileBuffers
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
GetVersion
GetVersionExW
DeleteFileW
OpenMutexW
CreateMutexW
CreateDirectoryW
WaitForSingleObject
GetExitCodeProcess
GetSystemWow64DirectoryW
MulDiv
CreateFileW
DeviceIoControl
GetLastError
GetCurrentProcess
FreeLibrary
Sleep
LoadLibraryW
GetProcAddress
CloseHandle
GetPrivateProfileStringW
GetUserDefaultUILanguage
GetModuleHandleW
GetModuleFileNameW

user32

LoadMenuW
LoadIconW
FlashWindowEx
SetForegroundWindow
ShowWindow
FindWindowW
DefWindowProcW
GetCursorPos
PostQuitMessage
SetTimer
UnregisterDeviceNotification
DispatchMessageW
TranslateMessage
GetMessageW
RegisterDeviceNotificationW
ModifyMenuW
RegisterClassExW
RegisterWindowMessageW
LoadBitmapW
SendMessageW
PostMessageW
IsIconic
GetClientRect
InvalidateRect
EnableWindow
GetSystemMetrics
GetParent
PtInRect
GetWindowRect
UpdateWindow
GetCapture
GetDisplayConfigBufferSizes
GetSubMenu
QueryDisplayConfig
wsprintfW
CreateWindowExW
GetSysColor
DrawIcon
GetDC
AdjustWindowRect
SystemParametersInfoW
SetWindowPos
GetWindowLongW
SetWindowLongW
IsWindow
KillTimer
RedrawWindow
FillRect
OffsetRect
CharUpperBuffW
GetKeyState
GrayStringW
DrawTextExW
TabbedTextOutW
DrawFocusRect
TrackMouseEvent
SetCursor
LoadCursorW
DrawTextW
ReleaseCapture
SetCapture

gdi32

CreateBitmap
GetPixel
BitBlt
CreateCompatibleDC
GetObjectW
GetDeviceCaps
CreateRectRgn
SetRectRgn
CombineRgn
CreateDIBSection
GetViewportOrgEx
SetViewportOrgEx
GetStockObject
CreateSolidBrush
Rectangle
CreateFontIndirectW
CreateDCW
CreateFontW
Escape
ExtTextOutW
RectVisible
PtVisible
TextOutW
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
GetBkColor
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject

shell32

ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathRemoveFileSpecW

ole32

CreateStreamOnHGlobal

oleaut32

SysStringLen
SysAllocString
SysFreeString

gdiplus

GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipDeleteBrush
GdipSetSolidFillColor
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDrawString
GdipDrawImageRect
GdipCloneBrush
GdipCloneImage
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetSmoothingMode
GdipDrawImageRectI
GdipDrawImageRectRect
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageType
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Stolx
?_Xlength_error@std@@YAXPBD@Z

setupapi

CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_IDW
SetupDiGetDeviceInstanceIdW
CM_Get_Parent
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
CM_Get_Child
CM_Get_Sibling
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
CM_Locate_DevNodeW

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.7MB - Virtual size: 18.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6f219f4c70015ef43a9f26b2e8ab7ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

7d:08:d9:bc:13:07:26:de:26:ee:4e:f2:8e:13:30:84Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc100u

msvcr100

kernel32

user32

gdi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

msvcp100

setupapi

Sections

.text Size: 107KB - Virtual size: 107KB

.rdata Size: 51KB - Virtual size: 50KB

.data Size: 1KB - Virtual size: 5KB

.rsrc Size: 18.7MB - Virtual size: 18.7MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

7d:08:d9:bc:13:07:26:de:26:ee:4e:f2:8e:13:30:84
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 107KB - Virtual size: 107KB

.rdata
Size: 51KB - Virtual size: 50KB

.data
Size: 1KB - Virtual size: 5KB

.rsrc
Size: 18.7MB - Virtual size: 18.7MB