1b5059b735c0d710b728c80c2e7fb94283f7415b07e87d1c70ea6bad69e24a99[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

1b5059b735c0d710b728c80c2e7fb94283f7415b07e87d1c70ea6bad69e24a99.exe
Size

235KB
MD5

d7a2573dde21482a28afb38718f2313f
SHA1

b17a59997aa1a3c88234694a7cfa15c77ebf4237
SHA256

1b5059b735c0d710b728c80c2e7fb94283f7415b07e87d1c70ea6bad69e24a99
SHA512

c218d55e86491a6a9cf6d777d2d21b7773f0c0a0217cd31f85f1dee4709cc5ac8970cf99e3b92dd11c081709c29fe432e7bd24b5c400913580840499098b0de4
SSDEEP

6144:MKP3AAe679MuCGA04izCqmseHPWditiXIKfftNoj:MK4ZIMuf4iCBvn84K96j

Score

1^/10

Malware Config

Signatures

Files

1b5059b735c0d710b728c80c2e7fb94283f7415b07e87d1c70ea6bad69e24a99.exe
.exe windows:4 windows x86 arch:x86

0e593ac12d661f8ad7f0180465be632d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

18-05-2010 00:00

Not After

16-02-2011 23:59

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:08:0c:57:3b:9d:5b:ae:e7:23:9f:78:e5:d2:62:2a:ae:ce:7d:cf
Signer

Actual PE Digest

d5:08:0c:57:3b:9d:5b:ae:e7:23:9f:78:e5:d2:62:2a:ae:ce:7d:cf

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
GetProcessHeaps
IsBadWritePtr
lstrlenW
GetEnvironmentStringsW
DisconnectNamedPipe
FatalAppExitW
FatalAppExitA
GetLogicalDriveStringsW
InitializeCriticalSection
GetDiskFreeSpaceW
TlsAlloc
LoadLibraryA
GetSystemDirectoryA
BeginUpdateResourceW
SetUnhandledExceptionFilter
GetModuleHandleW
CopyFileExA
GetVolumeInformationW
GetLongPathNameA
SetCalendarInfoA
FindResourceW
ReplaceFileA
GetDateFormatW
GetEnvironmentVariableA
GetNumberFormatW
GetTempFileNameW
FindAtomW
GetVolumeInformationA
GetLogicalDrives
LocalFree
GetProcessHeap
GetACP
GetCurrentDirectoryA
MulDiv
GetUserDefaultLangID
GetLastError
GetLongPathNameW
EnumTimeFormatsA
EnumCalendarInfoW
CreateNamedPipeW
HeapCreate
GetLocaleInfoA
GetSystemDefaultLangID
FileTimeToSystemTime
LoadLibraryW
GetShortPathNameW
GetUserDefaultLCID
GetWindowsDirectoryA
GetThreadPriority
GetThreadLocale
GetTickCount
RemoveDirectoryW
GetTempFileNameA
GlobalAlloc
lstrcpynA
lstrcmpiW
GetTimeFormatA
lstrcmp
ReadDirectoryChangesW
OpenMutexW
GetFileAttributesW
GetShortPathNameA
CompareFileTime
EnumCalendarInfoA
EnumDateFormatsW
GetComputerNameA
GlobalGetAtomNameW
lstrcpyW
GetCurrentProcess
IsBadStringPtrA
OpenFile
GetLogicalDriveStringsA
GetVersionExA
MoveFileW
SystemTimeToFileTime
GetCalendarInfoA
GetProcAddress
GetOEMCP
SleepEx
SetErrorMode
FreeLibrary
SetCurrentDirectoryW
lstrcpyA
GetCalendarInfoW
lstrcpyn
SetEvent
RaiseException
GetWindowsDirectoryW
ReplaceFileW
SetCalendarInfoW
BeginUpdateResourceA
DuplicateHandle
lstrcmpiA
lstrcat

user32

SetWindowPos
IsWindow
InsertMenuItemA
WinHelpW
EndDialog
CreateDialogIndirectParamA
SendDlgItemMessageW
wvsprintfW
GetCaretPos
MessageBeep
ShowWindow
ActivateKeyboardLayout
OpenClipboard
GetClassInfoExW
GetMessageW
EndMenu
ShowCursor
GetTopWindow
LoadImageA
SetDlgItemInt
ShowCaret
DialogBoxParamA
CharLowerW
DestroyIcon
PostMessageW
FindWindowA
mouse_event
DialogBoxParamW
SetForegroundWindow
CreateDialogIndirectParamW
CharNextA
GetMenuItemInfoW

shell32

DuplicateIcon
ShellExecuteExA
StrStrIW
SHBrowseForFolder
SHGetDiskFreeSpaceExA
SHGetFolderPathA
StrChrW
StrRChrIW
StrStrW
FreeIconList
SHGetDiskFreeSpaceA
ExtractAssociatedIconA
SHCreateDirectoryExW

ole32

CoDosDateTimeToFileTime
BindMoniker
CoGetClassObject
CreateFileMoniker
CoGetCurrentProcess
CoUninitialize

oleaut32

VarUI1FromDisp
SafeArrayCopy
VarBstrFromUI1
VarSub
VarImp
SafeArrayGetElement
RegisterActiveObject

opengl32

glRasterPos2iv
glRenderMode
glTexCoord1sv
glGetPointerv
GlmfInitPlayback
glPixelMapuiv
glColor3bv

ws2_32

WSAGetLastError
WSASend
setsockopt
gethostbyname

urlmon

CoInternetGetProtocolFlags
GetClassFileOrMime
CopyStgMedium
URLOpenStreamA
CoInternetParseUrl
CoInternetCompareUrl
CompareSecurityIds
URLDownloadToFileA
WriteHitLogging
HlinkSimpleNavigateToMoniker
GetComponentIDFromCLSSPEC
FindMediaTypeClass
CoInternetGetSession
SetSoftwareUpdateAdvertisementState
RegisterBindStatusCallback

odbctrac

TraceSQLError
TraceSQLGetData

wsock32

WSAAsyncGetHostByAddr
GetTypeByNameA
WEP
rcmd
inet_network
WSASetBlockingHook

Sections

.Ddbsq
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.N
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eVupHG
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Mc
Size: 3KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tSlRk
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oIO
Size: 9KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EBPEyh
Size: 512B - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bDw
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yOSLB
Size: 4KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e593ac12d661f8ad7f0180465be632d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

d5:08:0c:57:3b:9d:5b:ae:e7:23:9f:78:e5:d2:62:2a:ae:ce:7d:cfSigner

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

opengl32

ws2_32

urlmon

odbctrac

wsock32

Sections

.Ddbsq Size: 4KB - Virtual size: 4KB

.N Size: 12KB - Virtual size: 12KB

.eVupHG Size: 91KB - Virtual size: 91KB

.Mc Size: 3KB - Virtual size: 89KB

.tSlRk Size: 5KB - Virtual size: 19KB

.oIO Size: 9KB - Virtual size: 259KB

.EBPEyh Size: 512B - Virtual size: 50KB

.bDw Size: 91KB - Virtual size: 91KB

.yOSLB Size: 4KB - Virtual size: 116KB

.rsrc Size: 7KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

d5:08:0c:57:3b:9d:5b:ae:e7:23:9f:78:e5:d2:62:2a:ae:ce:7d:cf
Signer

.Ddbsq
Size: 4KB - Virtual size: 4KB

.N
Size: 12KB - Virtual size: 12KB

.eVupHG
Size: 91KB - Virtual size: 91KB

.Mc
Size: 3KB - Virtual size: 89KB

.tSlRk
Size: 5KB - Virtual size: 19KB

.oIO
Size: 9KB - Virtual size: 259KB

.EBPEyh
Size: 512B - Virtual size: 50KB

.bDw
Size: 91KB - Virtual size: 91KB

.yOSLB
Size: 4KB - Virtual size: 116KB

.rsrc
Size: 7KB - Virtual size: 7KB