a97e03c1c50ca6da04f43475135951dd6e31dbeb6774728b2c2e1ba4a7e6472eN

Sharing

Copy URL Twitter E-mail

General

Target

a97e03c1c50ca6da04f43475135951dd6e31dbeb6774728b2c2e1ba4a7e6472eN
Size

1.1MB
MD5

e03418d17a3639b5f4a46279dcf20440
SHA1

91d38bd59f093a4680a7739481baa49d3bafe098
SHA256

a97e03c1c50ca6da04f43475135951dd6e31dbeb6774728b2c2e1ba4a7e6472e
SHA512

a8235ad9b29b9458f4abea45be992d5cc0e1b0ef590219a67f2a19ad5fc4c5405293a4c26e406bf28af3594e22ec47b0932a239bf0d910d5ba5ce05e09b88d28
SSDEEP

24576:Ga/ZMMi7e2gD0QnghKUWFQPMEELFCbSCE6y58VS2+XO2:f/iq2gdgZyiVWXO

Score

1^/10

Malware Config

Signatures

Files

a97e03c1c50ca6da04f43475135951dd6e31dbeb6774728b2c2e1ba4a7e6472eN
.exe windows:4 windows x64 arch:x64

3552c41a297aadfb87ef77c6a132bc43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2e:b2:60:db:c5:14:27:a7:31:cd:25:19:70:1a:e3:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/08/2015, 00:00

Not After

03/10/2018, 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7e:27:28:b8:a7:b7:89:7b:d9:9a:91:81:65:45:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/03/2016, 00:00

Not After

03/10/2018, 23:59

Subject

CN=RealVNC Ltd,O=RealVNC Ltd,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

11/04/2027, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8b:7d:35:03:0a:fc:b7:c7:38:35:03:7c:a0:42:01:ee:25:14:7e:81:d5:dc:73:d1:94:8d:97:f4:c3:f4:14:e6
Signer

Actual PE Digest

8b:7d:35:03:0a:fc:b7:c7:38:35:03:7c:a0:42:01:ee:25:14:7e:81:d5:dc:73:d1:94:8d:97:f4:c3:f4:14:e6

Digest Algorithm

sha256

PE Digest Matches

false

06:89:12:d1:3e:fd:01:95:1f:64:bf:02:5d:bd:3b:c2:1b:55:4f:f6
Signer

Actual PE Digest

06:89:12:d1:3e:fd:01:95:1f:64:bf:02:5d:bd:3b:c2:1b:55:4f:f6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\VNC_6.0.1\label\win\bld64\RelWithDebInfo\vncpasswd.pdb

Imports

netapi32

NetApiBufferFree
NetServerGetInfo
DsRoleGetPrimaryDomainInformation
NetUserGetInfo
NetUserGetLocalGroups
NetUserGetGroups
NetGetAnyDCName
DsRoleFreeMemory

kernel32

GetUserDefaultLCID
GetFileType
ReadConsoleW
AllocConsole
FreeConsole
WriteConsoleW
GetVersionExW
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
GetProcAddress
GetCurrentProcess
FormatMessageW
LocalAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
FileTimeToSystemTime
QueryPerformanceFrequency
Sleep
SetEndOfFile
SetFilePointer
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileAttributesW
GetFileAttributesExW
DeleteFileW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
GetComputerNameW
WaitForMultipleObjects
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
GetTimeZoneInformation
FindClose
FindFirstFileW
FindNextFileW
CreateProcessW
DuplicateHandle
SetHandleInformation
GetExitCodeProcess
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleA
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLocaleInfoW
RtlCaptureContext
RaiseException
RtlPcToFileHeader
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
HeapReAlloc
DebugBreak
GetModuleFileNameA
CreateFileW
ReadFile
SetHandleCount
GetStartupInfoA
FatalAppExitA
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
GetCurrentThread
FlsAlloc
WriteFile
LoadLibraryA
GetConsoleCP
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
GetTickCount
RtlVirtualUnwind
LCMapStringA
LCMapStringW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
EnumSystemLocalesA
IsValidLocale
CreateFileA
CompareStringA
CompareStringW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
ResetEvent
WideCharToMultiByte
MultiByteToWideChar
SearchPathW
GetModuleFileNameW
GetCurrentProcessId
SetStdHandle
OutputDebugStringW
GetCommandLineW
GetConsoleMode
CreateEventW
WaitForSingleObject
SetConsoleCtrlHandler
SetEvent
SetConsoleMode
GetStdHandle
SetLastError
CloseHandle
ExpandEnvironmentStringsW
GetLastError
LocalFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsDebuggerPresent

user32

MsgWaitForMultipleObjects
PeekMessageW

shell32

ShellExecuteW
SHFileOperationW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString

advapi32

CreateProcessAsUserW
SetNamedSecurityInfoW
InitializeAcl
SetEntriesInAclW
GetAclInformation
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
CopySid
GetSidIdentifierAuthority
EqualSid
RegDeleteKeyW
GetSecurityInfo
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
SetSecurityInfo
RegNotifyChangeKeyValue
RegCloseKey
IsValidSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupAccountNameW
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetSecurityDescriptorControl
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorOwner
GetLengthSid

Sections

.text
Size: 820KB - Virtual size: 820KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ݔ
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3552c41a297aadfb87ef77c6a132bc43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2e:b2:60:db:c5:14:27:a7:31:cd:25:19:70:1a:e3:c0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

08:7e:27:28:b8:a7:b7:89:7b:d9:9a:91:81:65:45:e1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13Certificate

Extended Key Usages

Key Usages

8b:7d:35:03:0a:fc:b7:c7:38:35:03:7c:a0:42:01:ee:25:14:7e:81:d5:dc:73:d1:94:8d:97:f4:c3:f4:14:e6Signer

06:89:12:d1:3e:fd:01:95:1f:64:bf:02:5d:bd:3b:c2:1b:55:4f:f6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netapi32

kernel32

user32

shell32

ole32

oleaut32

advapi32

Sections

.text Size: 820KB - Virtual size: 820KB

.rdata Size: 227KB - Virtual size: 226KB

.data Size: 11KB - Virtual size: 23KB

.pdata Size: 63KB - Virtual size: 62KB

.rsrc Size: 2KB - Virtual size: 2KB

ݔ Size: 5KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2e:b2:60:db:c5:14:27:a7:31:cd:25:19:70:1a:e3:c0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

08:7e:27:28:b8:a7:b7:89:7b:d9:9a:91:81:65:45:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

8b:7d:35:03:0a:fc:b7:c7:38:35:03:7c:a0:42:01:ee:25:14:7e:81:d5:dc:73:d1:94:8d:97:f4:c3:f4:14:e6
Signer

06:89:12:d1:3e:fd:01:95:1f:64:bf:02:5d:bd:3b:c2:1b:55:4f:f6
Signer

.text
Size: 820KB - Virtual size: 820KB

.rdata
Size: 227KB - Virtual size: 226KB

.data
Size: 11KB - Virtual size: 23KB

.pdata
Size: 63KB - Virtual size: 62KB

.rsrc
Size: 2KB - Virtual size: 2KB

ݔ
Size: 5KB - Virtual size: 4KB