a39edc66bf47b0c033f3ffd3bcfa829db92fff64ed384d616f2cdabca148bc1cN[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a39edc66bf47b0c033f3ffd3bcfa829db92fff64ed384d616f2cdabca148bc1cN.exe
Size

142KB
MD5

e2590a6dab2cfcbd311713a6448760c0
SHA1

f443355f83d9b8499af30afe542196f01d206fc3
SHA256

a39edc66bf47b0c033f3ffd3bcfa829db92fff64ed384d616f2cdabca148bc1c
SHA512

3cdce5490aad095324c107db3b6d02f50ec281ab4a712c2fb5f8fa9a7aed2a5fb35a387df86fbbe0d3cdadeb5120e4a0853839e26074ff09ea47832afdf695db
SSDEEP

3072:jzwLjtSIi8MN/7Zjkh5IlmBA2lQBV+UdE+rECWp7hK3lEM:jS0n8a/qAKOBV+UdvrEFp7hKuM

Score

1^/10

Malware Config

Signatures

Files

a39edc66bf47b0c033f3ffd3bcfa829db92fff64ed384d616f2cdabca148bc1cN.exe
.dll windows:6 windows x86 arch:x86

16cfa198e44dfce3c5ad03895857845f

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28-01-1999 13:00

Not After

27-01-2017 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18-03-2009 11:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21-12-2009 09:32

Not After

22-12-2020 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:00:00:00:00:01:2f:73:8c:af:ed
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

20-04-2011 14:45

Not After

20-04-2014 14:45

Subject

CN=Travis Lee Robinson,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22-01-2004 10:00

Not After

27-01-2017 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fe:62:c2:36:be:e7:17:86:3a:8c:b9:59:e9:d3:da:41:e8:b5:ab:ac
Signer

Actual PE Digest

fe:62:c2:36:be:e7:17:86:3a:8c:b9:59:e9:d3:da:41:e8:b5:ab:ac

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb

Imports

msvcrt

memmove
_stricmp
realloc
_iob
fprintf
mbstowcs
_getch
_beginthread
_endthread
wcstombs
sscanf
_strlwr
strncmp
_wcsnicmp
_wcsicmp
printf
fopen
fgetws
wcsstr
fclose
fputws
fgets
fputs
_strdup
sprintf
_vsnprintf
strncpy
strerror
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
getenv
atoi
strstr
_snprintf
memcpy
memset
malloc
free

setupapi

SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiOpenDevRegKey
SetupOpenInfFileA
SetupDiGetDeviceRegistryPropertyA
SetupDiRemoveDevice
CM_Get_DevNode_Status
SetupDiSetDeviceRegistryPropertyA
SetupFindNextLine
SetupCloseInfFile
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupGetStringFieldA
SetupFindFirstLineA
SetupDiGetDeviceInstallParamsA

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetVersion
InterlockedIncrement
LocalFree
GetFullPathNameA
GetStdHandle
FindResourceA
SizeofResource
LoadResource
LockResource
WriteFile
GetModuleHandleA
GetCurrentProcess
SetEnvironmentVariableA
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
CreateSemaphoreA
GetVersionExA
OutputDebugStringA
FormatMessageA
WaitForSingleObject
CreateFileA
GetOverlappedResult
CloseHandle
ResetEvent
DeviceIoControl
GetLastError
CreateEventA

advapi32

RegEnumKeyExA
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
FreeSid

user32

DrawEdge
SetTimer
GetParent
DestroyWindow
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
RegisterClassExA
LoadCursorA
LoadIconA
GetClassInfoExA
FillRect
GetSysColorBrush
EnableWindow
SetWindowTextA
GetWindowLongA
SetWindowLongA
RedrawWindow
InvalidateRect
DefWindowProcA
PostMessageA
CreateWindowExA
GetSysColor
GetSystemMetrics
GetClientRect
OffsetRect
InflateRect
GetDlgItem
GetWindowTextLengthA
SendMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
MessageBoxA

gdi32

BitBlt
CreateSolidBrush
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC

Exports

Exports

usb_bulk_read
usb_bulk_setup_async
usb_bulk_write
usb_cancel_async
usb_claim_interface
usb_clear_halt
usb_close
usb_control_msg
usb_device
usb_find_busses
usb_find_devices
usb_free_async
usb_get_busses
usb_get_descriptor
usb_get_descriptor_by_endpoint
usb_get_string
usb_get_string_simple
usb_get_version
usb_init
usb_install_driver_np
usb_install_driver_np_rundll
usb_install_needs_restart_np
usb_install_npA
usb_install_npW
usb_install_np_rundll
usb_install_service_np
usb_install_service_np_rundll
usb_interrupt_read
usb_interrupt_setup_async
usb_interrupt_write
usb_isochronous_setup_async
usb_open
usb_reap_async
usb_reap_async_nocancel
usb_release_interface
usb_reset
usb_reset_ex
usb_resetep
usb_set_altinterface
usb_set_configuration
usb_set_debug
usb_strerror
usb_submit_async
usb_touch_inf_file_np
usb_touch_inf_file_np_rundll
usb_uninstall_service_np
usb_uninstall_service_np_rundll

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16cfa198e44dfce3c5ad03895857845f

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:2f:73:8c:af:edCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

fe:62:c2:36:be:e7:17:86:3a:8c:b9:59:e9:d3:da:41:e8:b5:ab:acSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

setupapi

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 4KB - Virtual size: 3KB

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

01:00:00:00:00:01:2f:73:8c:af:ed
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

fe:62:c2:36:be:e7:17:86:3a:8c:b9:59:e9:d3:da:41:e8:b5:ab:ac
Signer

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 4KB - Virtual size: 3KB