InsaniquariumSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

InsaniquariumSetup.exe
Size

9.7MB
MD5

78778ffe29da7f64e121edbf3068befa
SHA1

4d5942859fc6a9ea6b6b178918f8d93c65f47ede
SHA256

4ce0f4d7a09141249befeb1b008e232bb3c8657ded8630058ba0744fff879716
SHA512

39e4fecbe3e62f4e3a763694ba2ccfa103c285c7be17ea3852ca5edeee7cb4c9fac60b5a9a653b1bdd61c9a6c16341f67425bf85b8be03faac36fcb98e4ab789
SSDEEP

196608:T3kQZVlLx8scss9Oy7/6EahSBpAYpf5qmzv6g63dO3sXyWGIUi:TUWlFRj6/cSEadr363dO8XyWlUi

Score

1^/10

Malware Config

Signatures

Files

InsaniquariumSetup.exe
.exe windows:4 windows x86 arch:x86

7daf711b6d4ec8069d25b66a0c4a06e7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/09/2006, 00:00

Not After

21/09/2009, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

GetCurrentProcess
GetModuleHandleA
CopyFileA
LocalFree
GetDiskFreeSpaceA
MulDiv
ResetEvent
InterlockedDecrement
FindFirstFileW
FindClose
FindNextFileW
LoadLibraryExW
ExpandEnvironmentStringsW
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentProcessId
SetFileTime
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesA
IsValidCodePage
GetOEMCP
GetACP
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
SetStdHandle
GetFileType
SetHandleCount
GetStdHandle
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
GetStringTypeW
MultiByteToWideChar
GetExitCodeProcess
GetProcAddress
SetEvent
GetLastError
GetWindowsDirectoryA
FreeLibrary
CreateEventA
WaitForSingleObject
LoadLibraryA
GetVersionExA
DeleteFileA
Sleep
WideCharToMultiByte
GetSystemDirectoryA
QueryPerformanceCounter
LocalFileTimeToFileTime
CloseHandle
CreateFileA
DosDateTimeToFileTime
SetFileAttributesA
SetEnvironmentVariableA
lstrlenA
CreateDirectoryA
GetTickCount
GetStringTypeA
GetCPInfo
RemoveDirectoryA
LCMapStringW
LCMapStringA
HeapReAlloc
RtlUnwind
RaiseException
GetStartupInfoA
GetProcessHeap
GetCommandLineA
ExitProcess
CreateThread
ResumeThread
ExitThread
HeapFree
GetConsoleMode
GetConsoleCP
FindFirstFileA
FindNextFileA
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
SetFilePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ReadFile
WriteFile

user32

SetWindowPos
GetWindowTextA
LoadStringW
SendDlgItemMessageA
EndPaint
DrawIconEx
EndDialog
GetSysColorBrush
AdjustWindowRectEx
DialogBoxParamA
SetTimer
FillRect
DeferWindowPos
SetWindowTextW
MessageBoxW
GetDC
GetClientRect
IsDlgButtonChecked
BeginDeferWindowPos
EnableWindow
DrawFocusRect
GetWindowTextW
GetSystemMetrics
EndDeferWindowPos
SendMessageA
GetDesktopWindow
GetSysColor
DialogBoxParamW
DestroyIcon
CreateWindowExA
IsWindow
SetWindowTextA
GetClassNameW
DrawTextW
ReleaseDC
KillTimer
LoadImageA
BeginPaint
SendMessageW
GetClassNameA
DrawTextA
IsWindowUnicode
MapWindowPoints
GetDlgItem
EnumChildWindows
GetWindowLongA

gdi32

DeleteObject
CreateFontW
SetBkColor
SelectObject
SetTextColor
GetObjectA
GetTextExtentPoint32W
CreateSolidBrush
GetStockObject
GetTextMetricsA
DeleteDC
CreateCompatibleDC
CreateFontA
GetDeviceCaps
BitBlt
SetBkMode

advapi32

RegOpenKeyA
RegDeleteKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegCreateKeyExA

shell32

SHBrowseForFolderA
SHChangeNotify
SHGetPathFromIDListA
ShellExecuteExA
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteA
SHBrowseForFolderW

ole32

CoUninitialize
CoCreateGuid
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

Sections

.text
Size: 284KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7daf711b6d4ec8069d25b66a0c4a06e7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 284KB - Virtual size: 280KB

.rdata Size: 56KB - Virtual size: 53KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 32KB - Virtual size: 30KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

.text
Size: 284KB - Virtual size: 280KB

.rdata
Size: 56KB - Virtual size: 53KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 32KB - Virtual size: 30KB