vnc-E4_4_3-x86_win32_viewer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

vnc-E4_4_3-x86_win32_viewer.exe
Size

1.9MB
MD5

b63e1c3aaa70376fd9af606e07811e8e
SHA1

c33e96e0565f2f916c25a89d37c4adb5b68635bf
SHA256

85f861042089d73365a45eff3c9390711eb8b1e147c568b837dd8daeab95ab29
SHA512

68c2c1b1d4a8b7dc10850f978bd0cf8cb46974e0dda04b93abb6ea000811d8dfea15e7723b9d15dc532c9c5ca82d62b68eb77aeb5210580c3868ac26f5d3db62
SSDEEP

24576:JOhpdBrDWLXLUPGbknFyyney0Ig2qSILF0Cd+6aYqwS/Zz66XDR9wgxHNr6:IhRAUm6GiXUqT/Zz/XDR9wgxHNr6

Score

1^/10

Malware Config

Signatures

Files

vnc-E4_4_3-x86_win32_viewer.exe
.exe windows:4 windows x86 arch:x86

ff9e20673b50ac89d21681d92b86188b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:86:d5:55:e6:df:75:f9:2c:50:35:ae:b7:e1:de:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/09/2007, 00:00

Not After

31/10/2010, 23:59

Subject

CN=RealVNC Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=RealVNC Limited,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:78:40:23:05:8a:b6:f1:5f:6a:9a:aa:a2:13:36:30:fb:cf:e3:05
Signer

Actual PE Digest

9e:78:40:23:05:8a:b6:f1:5f:6a:9a:aa:a2:13:36:30:fb:cf:e3:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\home\hudson\slave-root\workspace\e4_4_x\label\win\src\win\release\win32\vncviewer.pdb

Imports

ws2_32

getsockopt
ioctlsocket
accept
htonl
listen
bind
socket
WSAConnect
closesocket
getpeername
getsockname
htons
setsockopt
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSASetEvent
WSAEventSelect
WSAIoctl
inet_addr
gethostbyname
inet_ntoa
send
select
WSAGetLastError
WSASocketA
WSADuplicateSocketA
WSAStartup
recv

comctl32

CreatePropertySheetPageA
InitCommonControlsEx
ImageList_Draw
ImageList_Destroy
ImageList_Create
ord17
_TrackMouseEvent
ImageList_ReplaceIcon
PropertySheetA

imm32

ImmSetOpenStatus
ImmGetVirtualKey
ImmGetContext

kernel32

RtlUnwind
SetFilePointer
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
HeapReAlloc
DeleteFileA
MoveFileA
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
HeapSize
SetHandleCount
GetFileType
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetLocaleInfoA
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
SetHandleInformation
OutputDebugStringA
TerminateThread
GetCurrentThread
GetThreadTimes
CreateThread
ResumeThread
WaitForMultipleObjects
GetSystemTimeAsFileTime
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
GetComputerNameA
UnhandledExceptionFilter
ExitProcess
GetTempPathA
GetTempFileNameA
OpenProcess
CreateFileA
CreateProcessA
TerminateProcess
GetExitCodeProcess
ExpandEnvironmentStringsA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalMemoryStatus
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetOverlappedResult
CancelIo
GetVersion
CreateFileW
FindFirstFileW
FindNextFileW
FindNextFileA
ResetEvent
GlobalAlloc
GlobalFree
WaitForSingleObject
CreateEventA
SetEvent
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentThreadId
TlsGetValue
TlsSetValue
TlsFree
GetTimeFormatA
TlsAlloc
ReadFile
AllocConsole
GetLogicalDrives
GetFileAttributesA
FindFirstFileA
FindClose
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
SetErrorMode
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreatePipe
GetLastError
GetCurrentProcess
DuplicateHandle
WriteFile
CloseHandle
GetCurrentDirectoryA
GetModuleHandleA
GetModuleFileNameA
Sleep
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetDateFormatA
IsValidCodePage

user32

GetForegroundWindow
CallNextHookEx
GetKeyboardState
ToUnicode
ToAscii
MsgWaitForMultipleObjects
GetProcessWindowStation
EnumDesktopsA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
GetClassNameA
GetWindowThreadProcessId
IsWindowVisible
EnumDisplaySettingsA
ChangeDisplaySettingsA
ReleaseDC
WaitForInputIdle
RegisterClipboardFormatA
OpenClipboard
EmptyClipboard
SetClipboardData
SetWindowsHookExA
wsprintfW
PeekMessageA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetParent
GetMessageTime
OffsetRect
GetWindowInfo
RegisterClassA
LoadBitmapA
IsWindowEnabled
SetFocus
EnableWindow
EndDialog
CreateDialogParamA
IsDialogMessageA
DialogBoxParamA
GetMessageA
TranslateMessage
LoadMenuA
GetSubMenu
SetMenuDefaultItem
UnhookWindowsHookEx
GetClipboardData
SetClipboardViewer
ChangeClipboardChain
mouse_event
CloseClipboard
PostQuitMessage
GetDlgItemInt
GetWindowTextA
PostMessageA
LoadCursorA
LoadIconA
RegisterClassExA
DefWindowProcA
AdjustWindowRect
GetAsyncKeyState
GetCursorPos
TrackPopupMenu
BeginPaint
EndPaint
CreateWindowExA
GetSystemMenu
DestroyMenu
ClientToScreen
ValidateRect
SetCapture
GetWindowRect
InvalidateRect
SystemParametersInfoA
ReleaseCapture
SetWindowTextA
SetRect
AdjustWindowRectEx
GetSystemMetrics
SetWindowPos
SetScrollInfo
ShowCursor
ScrollWindowEx
UnregisterClassA
DestroyWindow
GetClipboardOwner
GetDlgItem
GetWindowLongA
LoadImageA
SetCursor
SetWindowLongA
GetClientRect
FillRect
DrawTextA
SetTimer
KillTimer
GetMessagePos
ScreenToClient
PostThreadMessageA
DispatchMessageA
AppendMenuA
CheckMenuItem
RemoveMenu
InsertMenuA
GetUpdateRect
IsIconic
FindWindowA
SetForegroundWindow
SendMessageA
MessageBoxA
ShowWindow
UpdateWindow
MessageBeep
EnableMenuItem
GetDC
SendMessageTimeoutA

gdi32

CreateDIBSection
DeleteObject
SelectObject
SetBkColor
GetStockObject
CreateFontIndirectA
GetObjectA
CreateRectRgn
RealizePalette
SelectPalette
CreatePalette
SetPaletteEntries
GetRegionData
BitBlt
OffsetRgn
GetRandomRgn
StretchBlt
SetBrushOrgEx
SetStretchBltMode
SetTextColor
GetTextExtentPoint32A
GetCurrentObject
Rectangle
CreateBrushIndirect
CreatePen
DeleteDC
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
GetDIBits
SetDIBColorTable

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

advapi32

RegCreateKeyExA
ImpersonateLoggedOnUser
GetUserNameA
RevertToSelf
OpenProcessToken
CreateProcessAsUserA
RegOpenKeyExA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetTokenInformation
AllocateAndInitializeSid
FreeSid
IsValidSid
GetLengthSid
CopySid
EqualSid
RegQueryValueExA
RegCloseKey
RegNotifyChangeKeyValue
RegSetValueExA
RegEnumValueA
RegQueryInfoKeyA

shell32

SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
Shell_NotifyIconA

ole32

OleGetClipboard
OleSetClipboard
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
ReleaseStgMedium

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 616KB - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff9e20673b50ac89d21681d92b86188b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

70:86:d5:55:e6:df:75:f9:2c:50:35:ae:b7:e1:de:3fCertificate

Extended Key Usages

Key Usages

9e:78:40:23:05:8a:b6:f1:5f:6a:9a:aa:a2:13:36:30:fb:cf:e3:05Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

comctl32

imm32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

version

Sections

.text Size: 616KB - Virtual size: 612KB

.rdata Size: 160KB - Virtual size: 159KB

.data Size: 24KB - Virtual size: 47KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

70:86:d5:55:e6:df:75:f9:2c:50:35:ae:b7:e1:de:3f
Certificate

9e:78:40:23:05:8a:b6:f1:5f:6a:9a:aa:a2:13:36:30:fb:cf:e3:05
Signer

.text
Size: 616KB - Virtual size: 612KB

.rdata
Size: 160KB - Virtual size: 159KB

.data
Size: 24KB - Virtual size: 47KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB