res_out[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

res_out.exe
Size

4.4MB
MD5

bf9ec01c25506a02c399ac19f154b9fd
SHA1

c2563bd4dde7108c68d2f0eab24ddad600132e0f
SHA256

2be849154e91a1aa43a1914c7253f08f0029854d309ab4e3d0e264a7424ee8cc
SHA512

038d347a9264a708600d0488e533b26149aa3f162d096a7f09ac57f0f86f5d65210794c3a5fe583abde36cda2b2191acfe1715b2fab7f30ee19b7e83ec1d9d91
SSDEEP

49152:ONLzXOKH6AqIHxAAAf7CpjZMZGIFjItJgtG3wBzP+F61w5USYNT1Q7sq4hrj8wNN:oLzXOKHD5xABKIxksBaQu8s4aIuftbO

Score

1^/10

Malware Config

Signatures

Files

res_out.exe
.exe windows:4 windows x86 arch:x86

e5a69a823fc0067d2a4d26921cce6479

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03-06-2014 09:16

Not After

03-09-2017 09:16

Subject

CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,OU=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,L=New Taipei City,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:92:3f:36:78:bc:4c:4c:57:cd:54:4f:ad:8b:ba:76:1f:3c:74:1e
Signer

Actual PE Digest

42:92:3f:36:78:bc:4c:4c:57:cd:54:4f:ad:8b:ba:76:1f:3c:74:1e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
FormatMessageA
LocalFree
WaitForSingleObject
GetVersionExA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetCurrentProcessId
LoadLibraryA
VirtualQuery
VirtualProtect
CreateFileA
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCPInfo
GetCurrentProcess
FlushFileBuffers
SetUnhandledExceptionFilter
SetFilePointer
IsBadWritePtr
VirtualAlloc
LCMapStringW
MultiByteToWideChar
LCMapStringA
VirtualFree
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTickCount
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
HeapSize
HeapReAlloc
SetPriorityClass
ReadFile
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
SetLastError
TlsFree
MoveFileA
GetLocalTime
GetTimeZoneInformation
WideCharToMultiByte
GetFileType
SetStdHandle
RaiseException
HeapAlloc
HeapFree
GetCommandLineA
GetStartupInfoA
TerminateProcess
ExitProcess
RtlUnwind
GetSystemInfo
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDriveTypeA
CompareFileTime
GetModuleFileNameA
lstrlenA
GetSystemTimeAsFileTime
DeleteFileA
CopyFileA
GetFileAttributesA
SetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GlobalMemoryStatus
SuspendThread
RemoveDirectoryA
CreateDirectoryA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceExA
ResumeThread
ExitThread
Sleep
GetCurrentThread
CreateEventA
CreateThread
SetThreadPriority
SetEvent
GetExitCodeThread
CloseHandle
WriteFile
GetLastError
GetEnvironmentStrings
GetFullPathNameA

user32

MonitorFromWindow
SetWindowTextA
TranslateMessage
GetMonitorInfoA
FindWindowA
EnableWindow
DefWindowProcA
GetMessageA
DispatchMessageA
GetDesktopWindow
GetWindowRect
ClientToScreen
SetCursorPos
GetCursorInfo
ShowCursor
SetCursor
DestroyCursor
PostQuitMessage
AdjustWindowRect
EnumDisplaySettingsA
ChangeDisplaySettingsA
SetWindowLongA
MoveWindow
PeekMessageA
SystemParametersInfoA
DestroyWindow
ShowWindow
ReleaseDC
GetDC
SetWindowPos
CreateWindowExA
GetWindowInfo
MessageBoxA
RegisterClassA
LoadCursorA
LoadIconA
SendMessageA
ScreenToClient
SetCapture
PostMessageA

gdi32

DescribePixelFormat
SwapBuffers
PatBlt
SetPixelFormat
ChoosePixelFormat
GetStockObject
SetDeviceGammaRamp

ole32

CoInitialize
CoUninitialize

glu32

gluErrorString
gluPerspective
gluBuild2DMipmaps

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 800KB - Virtual size: 798KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5a69a823fc0067d2a4d26921cce6479

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

42:92:3f:36:78:bc:4c:4c:57:cd:54:4f:ad:8b:ba:76:1f:3c:74:1eSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

glu32

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 320KB - Virtual size: 318KB

.data Size: 92KB - Virtual size: 673KB

.rsrc Size: 800KB - Virtual size: 798KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

11:21:58:04:48:63:e4:dc:19:cf:29:a8:56:68:b7:f4:58:42
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

42:92:3f:36:78:bc:4c:4c:57:cd:54:4f:ad:8b:ba:76:1f:3c:74:1e
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 320KB - Virtual size: 318KB

.data
Size: 92KB - Virtual size: 673KB

.rsrc
Size: 800KB - Virtual size: 798KB