95bfc120ecdd20cb02bd513997e763e0N

Sharing

Copy URL Twitter E-mail

General

Target

95bfc120ecdd20cb02bd513997e763e0N
Size

2.5MB
MD5

95bfc120ecdd20cb02bd513997e763e0
SHA1

f2c924fb645c123ede8e61bc5cf34526cf0e8390
SHA256

6aeb45dda3c7373d350aa211097752fdb327c70d9cc87cb7cce7e76498c71fc8
SHA512

6d9a5d140df76ccf45d0e28144f46ee5df0bb1e94b9ed6c6ce02082a5bb08432325461308b53743ee0d500bc701779188aa133b1bed52bbe240269a67ce4b02a
SSDEEP

49152:DFKxPvthizW04RKsMOVJ/Vn+YTbQ/BmW4rN7y:DFKxNhizW04R1MOVJ/hK

Score

1^/10

Malware Config

Signatures

Files

95bfc120ecdd20cb02bd513997e763e0N
.exe windows:5 windows x86 arch:x86

97f5c5cdc5e80758b7adff3a733244ad

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:34:38:82:7c:8e:19:49:62:78:0c:8f:15:f9:da:ef:13:ab:9c:96
Signer

Actual PE Digest

4b:34:38:82:7c:8e:19:49:62:78:0c:8f:15:f9:da:ef:13:ab:9c:96

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

T:\src\piper\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\components\win_frontend\ipc_console.pdb

Imports

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
ConvertSidToStringSidW
GetLengthSid
GetSecurityInfo
CopySid
GetUserNameW
GetTokenInformation
OpenProcessToken
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenCurrentUser
RegQueryValueExW
RegNotifyChangeKeyValue
GetSidSubAuthority
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
IsValidSid

kernel32

TerminateProcess
GetModuleFileNameA
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
CloseHandle
DebugBreak
GetTempPathA
GlobalAlloc
LocalFree
ResetEvent
SetEvent
WaitForMultipleObjects
CreateThread
Sleep
GetVersionExW
InterlockedCompareExchange
GetSystemTimeAsFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
QueryPerformanceCounter
FindFirstFileW
FindNextFileW
GetFullPathNameW
DeleteFileW
RemoveDirectoryW
GetSystemTime
LockResource
FindResourceExW
FindClose
MulDiv
SetProcessWorkingSetSize
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateFileW
GetTickCount
WriteFile
ExitThread
LoadLibraryW
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeW
CancelIo
ReadFile
GetOverlappedResult
FlushInstructionCache
SetLastError
InterlockedExchange
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WideCharToMultiByte
HeapSetInformation
GetStartupInfoW
ExitProcess
VirtualProtect
VirtualQuery
RtlUnwind
GetCPInfo
LCMapStringW
GetStdHandle
HeapCreate
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
SetFilePointer
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetThreadLocale
CopyFileW
SetFileAttributesW
GetTempPathW
GetFileSizeEx
CreateDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
CreateMutexW
WaitForSingleObject
GetCurrentProcess
CreateProcessW
GlobalFree
GlobalLock
GlobalUnlock
SetThreadPriority
ResumeThread
OpenThread
FormatMessageA
GetModuleHandleA
AllocConsole
LoadLibraryA
GetLongPathNameW
GetTempFileNameW
MoveFileW
GetFileAttributesExW
GetDiskFreeSpaceExW
GetDriveTypeW
GetUserDefaultUILanguage
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileExW
GetFileInformationByHandle
PeekNamedPipe
GetDriveTypeA
FindFirstFileExA
GetFullPathNameA
GetCommandLineW
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
ProcessIdToSessionId
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
FindResourceW
LoadResource
GetFileSize
SizeofResource
RaiseException
lstrcmpiW
lstrlenW
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetLastError
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MultiByteToWideChar

user32

SetWindowPos
LoadCursorW
DestroyMenu
CreatePopupMenu
TrackPopupMenu
TrackPopupMenuEx
GetShellWindow
GetDC
ReleaseDC
AppendMenuW
SetMenuItemBitmaps
SendMessageW
UnregisterClassA
MoveWindow
GetWindowRect
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
ShowWindow
IsWindowVisible
CharNextW
IsWindowEnabled
SetCapture
SetWindowRgn
GetClassInfoExW
SetRect
TrackMouseEvent
GetKeyState
ReleaseCapture
UpdateLayeredWindow
OffsetRect
SetCursor
IntersectRect
MessageBoxA
wvsprintfW
wsprintfW
MessageBoxW
IsWindow
DispatchMessageW
DefWindowProcW
CreateWindowExW
SetWindowLongW
PeekMessageW
GetWindowLongW
RegisterClassExW
TranslateMessage
KillTimer
PostMessageW
PostQuitMessage
GetMessageW
SetTimer
DestroyWindow
GetMonitorInfoW
SetWindowTextW
GetCursorPos
EndDialog
GetDlgItem
SetCursorPos
GetForegroundWindow
SetFocus
DialogBoxParamW
MonitorFromPoint
ScreenToClient
ClientToScreen

ole32

CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

oleaut32

SysFreeString
SysStringLen
SysAllocString
VarUI4FromStr

gdi32

EnumEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
GetCurrentObject
GetFontUnicodeRanges
GetTextMetricsW
GetOutlineTextMetricsW
GetObjectA
AddFontMemResourceEx
DeleteEnhMetaFile
CreateFontIndirectW
CreateRectRgn
BitBlt
CreateCompatibleDC
DeleteDC
CombineRgn
ExtCreateRegion
GetDIBits
CreateDCW
GetObjectW
DeleteObject
RemoveFontMemResourceEx
SelectObject
GetDeviceCaps
CreateDIBSection

gdiplus

GdipCreateFromHDC
GdipGraphicsClear
GdiplusStartup
GdipCloneImage
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdipRestoreGraphics
GdiplusShutdown
GdipBitmapGetPixel
GdipGetImagePixelFormat
GdipDrawImageRectRectI
GdipPrivateAddFontFile
GdipDrawImageI
GdipSetClipGraphics
GdipCloneFontFamily
GdipCreateRegion
GdipDeleteRegion
GdipSetEmpty
GdipCombineRegionRect
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetImageAttributesRemapTable
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteFont
GdipCreateBitmapFromStream
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawDriverString
GdipFillRectangleI
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipCreateTextureIAI
GdipSetTextureWrapMode
GdipCreatePen1
GdipDeletePen
GdipGetPenWidth
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipDrawLine
GdipFillRectangle
GdipDrawImageRectRect
GdipSetClipRect
GdipSetClipRegion
GdipResetClip
GdipSaveGraphics
GdipCreateTextureIA
GdipGetFamilyName
GdipSaveImageToStream

winmm

timeGetTime

crypt32

CryptFindOIDInfo

shell32

SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW

shlwapi

PathCanonicalizeW
PathCombineW
PathFileExistsW
StrDupW
PathFindExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsDirectoryW
PathIsRelativeW

secur32

CompleteAuthToken
FreeCredentialsHandle
AcquireCredentialsHandleA
InitializeSecurityContextA
DeleteSecurityContext
QueryCredentialsAttributesW
FreeContextBuffer
QueryContextAttributesW
DecryptMessage
EncryptMessage
ApplyControlToken
AcquireCredentialsHandleW

usp10

ScriptItemize
ScriptBreak
ScriptShape
ScriptStringFree
ScriptStringOut
ScriptStringAnalyse
ScriptCPtoX
ScriptLayout
ScriptPlace
ScriptFreeCache

ws2_32

getsockopt
socket
getsockname
getpeername
bind
connect
setsockopt
send
sendto
recv
recvfrom
listen
WSACloseEvent
closesocket
ioctlsocket
WSAEnumNetworkEvents
WSAGetLastError
WSAWaitForMultipleEvents
WSAEventSelect
WSAStartup
WSACleanup
WSACreateEvent
getaddrinfo
freeaddrinfo
WSAResetEvent
WSASetEvent
accept
WSCEnumProtocols

wininet

InternetQueryOptionW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97f5c5cdc5e80758b7adff3a733244ad

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8dCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4b:34:38:82:7c:8e:19:49:62:78:0c:8f:15:f9:da:ef:13:ab:9c:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

winmm

crypt32

shell32

shlwapi

secur32

usp10

ws2_32

wininet

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 358KB - Virtual size: 358KB

.data Size: 108KB - Virtual size: 119KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 161KB - Virtual size: 161KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4b:34:38:82:7c:8e:19:49:62:78:0c:8f:15:f9:da:ef:13:ab:9c:96
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 358KB - Virtual size: 358KB

.data
Size: 108KB - Virtual size: 119KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 161KB - Virtual size: 161KB