SpyInstall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SpyInstall.exe
Size

19KB
MD5

92b863c8779c783fecca4dce30156880
SHA1

dc660f5d6c17a1de1b355189fe76e18de2db9e2b
SHA256

52172f30bab8b71e1aad5392f8138ceb82c0fd3239e1152791c00cce4d655954
SHA512

f1c02f3666fe1eddda7dea33b1ed8ae0ad05d3bbeae18a8c34aa2cb2b1076a9bbdc8820a1460cc99d1e9d317935a5571e567fcfde8d03b86ad8288f47c5f721f
SSDEEP

384:JTVRJHQ8PgwtAUiSQA/rvhWUHeMU5QVc4OUA:dVPHQ8YwtP/Q+GQVc4S

Score

1^/10

Malware Config

Signatures

Files

SpyInstall.exe
.exe windows:5 windows x86 arch:x86

cfb0618c8fa2b4c8a3dcdc8274a47b4f

Code Sign

7f:86:b4:4c:3e:fb:81:fa:c8:c8:b6:70:58:05:4f:6a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/09/2014, 00:00

Not After

02/10/2017, 23:59

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,OU=IT,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:a2:e6:13:a8:18:50:42:2d:02:b4:1c:d4:4a:03:f7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/01/2016, 00:00

Not After

02/10/2017, 23:59

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,OU=IT,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:34:41:09:98:8e:05:61:17:fd:86:78:1e:08:f7:d3:21:1a:3b:d7:17:72:cc:3f:81:e1:62:15:6b:15:7c:c6
Signer

Actual PE Digest

63:34:41:09:98:8e:05:61:17:fd:86:78:1e:08:f7:d3:21:1a:3b:d7:17:72:cc:3f:81:e1:62:15:6b:15:7c:c6

Digest Algorithm

sha256

PE Digest Matches

true

de:4b:eb:e9:2e:73:06:3c:f9:85:59:22:50:54:d2:76:bf:bc:c2:c3
Signer

Actual PE Digest

de:4b:eb:e9:2e:73:06:3c:f9:85:59:22:50:54:d2:76:bf:bc:c2:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\svn_code\00_Source\Output\Release\SpyInstall.pdb

Imports

kernel32

OutputDebugStringW
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryA
GetCurrentThreadId
LoadLibraryW
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentProcessId

user32

wsprintfW

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey

msvcr90

_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
_initterm
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_wtoi
wcsstr
wcscpy_s
memset
__p__commode
__CxxFrameHandler3

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfb0618c8fa2b4c8a3dcdc8274a47b4f

Code Sign

7f:86:b4:4c:3e:fb:81:fa:c8:c8:b6:70:58:05:4f:6aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0d:a2:e6:13:a8:18:50:42:2d:02:b4:1c:d4:4a:03:f7Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

63:34:41:09:98:8e:05:61:17:fd:86:78:1e:08:f7:d3:21:1a:3b:d7:17:72:cc:3f:81:e1:62:15:6b:15:7c:c6Signer

de:4b:eb:e9:2e:73:06:3c:f9:85:59:22:50:54:d2:76:bf:bc:c2:c3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

msvcr90

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 944B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1024B - Virtual size: 590B

7f:86:b4:4c:3e:fb:81:fa:c8:c8:b6:70:58:05:4f:6a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0d:a2:e6:13:a8:18:50:42:2d:02:b4:1c:d4:4a:03:f7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

63:34:41:09:98:8e:05:61:17:fd:86:78:1e:08:f7:d3:21:1a:3b:d7:17:72:cc:3f:81:e1:62:15:6b:15:7c:c6
Signer

de:4b:eb:e9:2e:73:06:3c:f9:85:59:22:50:54:d2:76:bf:bc:c2:c3
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 944B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1024B - Virtual size: 590B