PrivDogSetup_3[.]0[.]96[.]0[.]exe

Resubmissions

09/09/2024, 02:31

240909-czyehsxcqr 8

09/09/2024, 02:29

240909-cypqzszemb 8

Sharing

Copy URL Twitter E-mail

General

Target

PrivDogSetup_3.0.96.0.exe
Size

17.8MB
MD5

f4a6fbddf0bb6ff5f230a6a38c5db405
SHA1

612c272eb71958b6bd35227f8afc946770ad8845
SHA256

1ffa3a1e27763fb92aef70eb987e7f3f7bf6d4b9d20d9871cc95faf27922f4d3
SHA512

a88232a95236db5ecb9a5d1f3459f79b26a0d78b0913bfcdf46d535f55ba77d3387eecdcd4038c73396abee40c4a40ce3b8c8345e0f7ac906e7595cd0c9d8811
SSDEEP

393216:S/KENbCJvsQAvaI6yuJAeoGNaR8tGLCzvoB/FHWmUSTeVRuDpDM2vY/:SCENG5sBVuJZamELkvoB/kTSqUNDM2Y

Score

1^/10

Malware Config

Signatures

Files

PrivDogSetup_3.0.96.0.exe
.exe windows:5 windows x86 arch:x86

695d210e6a3822c5aab1e1a5c8b3845c

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:17:90:b1:a4:d7:3a:51:43:b0:a3:2a:89:4b:1a:ec
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

21/11/2014, 00:00

Not After

21/11/2015, 23:59

Subject

CN=Adtrustmedia\, LLC,O=Adtrustmedia\, LLC,POSTALCODE=07042,STREET=41 Watchung Plaza \\#330,L=Montclair,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:6c:4e:b9:fa:67:1a:9f:43:91:59:4b:05:4b:43:89:85:d7:39:3e
Signer

Actual PE Digest

71:6c:4e:b9:fa:67:1a:9f:43:91:59:4b:05:4b:43:89:85:d7:39:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ComodoTrustedADs\trunk\IE\tags\3.0.70.0\MSISetup\Bootstrapper\Release static\PrivDogSetup.pdb

Imports

msi

ord88
ord141
ord169

kernel32

TlsGetValue
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetTempPathW
CreateFileW
WriteFile
CloseHandle
GetStringTypeW
MultiByteToWideChar
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
GetLastError
HeapFree
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
Sleep
HeapSize
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WideCharToMultiByte
LCMapStringW

user32

MessageBoxW

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17.5MB - Virtual size: 17.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

695d210e6a3822c5aab1e1a5c8b3845c

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

13:17:90:b1:a4:d7:3a:51:43:b0:a3:2a:89:4b:1a:ecCertificate

Extended Key Usages

Key Usages

71:6c:4e:b9:fa:67:1a:9f:43:91:59:4b:05:4b:43:89:85:d7:39:3eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

user32

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 17.5MB - Virtual size: 17.5MB

.rsrc Size: 200KB - Virtual size: 199KB

.reloc Size: 30KB - Virtual size: 30KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

13:17:90:b1:a4:d7:3a:51:43:b0:a3:2a:89:4b:1a:ec
Certificate

71:6c:4e:b9:fa:67:1a:9f:43:91:59:4b:05:4b:43:89:85:d7:39:3e
Signer

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 17.5MB - Virtual size: 17.5MB

.rsrc
Size: 200KB - Virtual size: 199KB

.reloc
Size: 30KB - Virtual size: 30KB