SDT_v1[.]21[.]1b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SDT_v1.21.1b.exe
Size

9.8MB
MD5

07eb6b0a695537cce0b7ec9c621a5c90
SHA1

0259011b385d8eff9a4bc1d6af38eab584e5fbfe
SHA256

5190fb6e3c14ac0b28556e811ca392d0002fa29d100461fd24a2900ae8f36082
SHA512

69337830c1bf4c7866c0bde862073466c49ac1c7b1f0f761bacc5c1e447a2215cd8e9a0d80b44f0affa3c6bd15498f27cb1572bb122873214fb999fdaef64828
SSDEEP

196608:+tu49ZtYrocgyMmdqrYNiIpbC7JM5rphPpsAOR+WxlLby:09I2mZiIpbC7251W0WxFby

Score

1^/10

Malware Config

Signatures

Files

SDT_v1.21.1b.exe
.exe windows:5 windows x86 arch:x86

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/12/2010, 00:00

Not After

14/12/2012, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d9:27:46:28:15:f7:82:6b:63:b4:8a:e0:52:11:f5:3f:9a:e4:5c:e5
Signer

Actual PE Digest

d9:27:46:28:15:f7:82:6b:63:b4:8a:e0:52:11:f5:3f:9a:e4:5c:e5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FlashPlayer.pdb

Imports

crypt32

CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CryptFindOIDInfo
CertFreeCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCompareCertificate
CertVerifyTimeValidity
CertOpenStore
CertVerifyRevocation
CertCloseStore
CertAddStoreToCollection

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInStop
waveOutClose
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeSetEvent
waveOutGetPosition
timeGetTime
waveInAddBuffer
waveInStart
waveOutReset
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeKillEvent
timeEndPeriod
waveInOpen

oleaut32

SysFreeString

dsound

ord8

kernel32

GlobalFree
ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
CreateFileA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
TlsSetValue
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
GetModuleHandleA
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetStartupInfoW
GetCommandLineA
SwitchToThread
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
lstrlenW
GetVersion
DeviceIoControl
VirtualAlloc
VirtualFree
CreateSemaphoreA
TlsAlloc
TlsFree
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GlobalUnlock
GetProcessTimes
FreeLibrary
CreateProcessA
GetVersionExW
LCMapStringW
GetTickCount
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
LoadLibraryW
GetProcAddress
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
HeapReAlloc
HeapCreate
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
GetFileSizeEx

user32

GetDlgItemTextW
GetWindowTextLengthA
GetDlgItemTextA
InsertMenuW
InsertMenuA
GetWindowTextA
UnregisterClassA
LoadMenuW
DeleteMenu
GetWindowTextLengthW
GetWindowTextW
UpdateWindow
BeginPaint
EndPaint
IsIconic
GetMenu
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EnableWindow
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
GetCapture
EnumWindows
GetCursorPos
MessageBoxW
LoadStringA
GetWindowInfo
CopyRect
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
CreatePopupMenu
TrackPopupMenu
DrawMenuBar
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
ShowWindow
DialogBoxParamW
ScreenToClient
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
RegisterClipboardFormatW
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
FillRect
PostMessageW
SetRectEmpty
DestroyWindow
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
GetMonitorInfoW
SystemParametersInfoW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetDC
ReleaseDC
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
ClientToScreen
SendInput
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
EnumDisplayDevicesA
GetSystemMetrics
SetRect
OffsetRect
MonitorFromWindow
CreateWindowExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
DefWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
GetDoubleClickTime
PostMessageA
RegisterWindowMessageA
MessageBoxA
GetWindowPlacement

gdi32

GetBkMode
GetTextColor
SelectClipRgn
GetBkColor
SetTextAlign
CreatePen
GetTextExtentPoint32W
GetCurrentObject
CreateRectRgn
GetTextAlign
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
SelectObject
ExtTextOutW
GetDeviceCaps
SetBkMode
RealizePalette
SelectPalette
LPtoDP
StartDocW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetClipRgn
IntersectClipRect
BitBlt
CreateDIBSection
GetFontData
GetObjectW
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
EnumFontFamiliesExW
DPtoLP
LineTo
StartPage
EndPage
SetPolyFillMode
SaveDC
BeginPath
EndPath
SetTextColor
SetTextCharacterExtra
MoveToEx
ExtTextOutA
EnumFontFamiliesA
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
SetPixel
GetStockObject
CreateDCA
GetICMProfileA
EnumFontFamiliesW
DeleteObject
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
CreateFontIndirectA

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetFolderPathA
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize
PropVariantClear

ws2_32

inet_addr
WSACloseEvent
htons
getsockname
ntohs
send
recv
setsockopt
WSAStartup
gethostbyname
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
bind
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
gethostname
select
ntohl
htonl
WSASocketW

mscms

TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform

opengl32

wglGetProcAddress

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d9:27:46:28:15:f7:82:6b:63:b4:8a:e0:52:11:f5:3f:9a:e4:5c:e5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

urlmon

version

winmm

oleaut32

dsound

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

ws2_32

mscms

opengl32

Sections

.text Size: 5.7MB - Virtual size: 5.7MB

.rodata Size: 4KB - Virtual size: 4KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 199KB - Virtual size: 1.1MB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 313KB - Virtual size: 312KB

.reloc Size: 275KB - Virtual size: 274KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d9:27:46:28:15:f7:82:6b:63:b4:8a:e0:52:11:f5:3f:9a:e4:5c:e5
Signer

.text
Size: 5.7MB - Virtual size: 5.7MB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 199KB - Virtual size: 1.1MB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 313KB - Virtual size: 312KB

.reloc
Size: 275KB - Virtual size: 274KB