SecuriteInfo[.]com[.]Win32[.]Malware-gen[.]63978713[.]exe

resource
SecuriteInfo.com.Win32.Malware-gen.63978713.exe
unpack001/$PLUGINSDIR/nsExec.dll

SecuriteInfo.com.Win32.Malware-gen.63978713.exe

IMPHASH c32ba42c73a2bc24d2788f7750d87edb
SHA256 ef69941b32be75da6500aa8a2c210bbc0470947c720a526f926f6a2c77141711
MD5 af1b15520943e464df62e584af3298af
SHA1 a967947675121b3a7af45eac34762943c4e95735
SHA512 5ece3924ce3295359c11a4051ad539bb9c116621148bb6e7d84a8d6d8dec7c4d60680f9eafbe0e68a21341937ae810ba9b78daf4d1005556fef4fc010473e413
SSDEEP 49152:LbNbtXqmPKjjI+df4eV4h3r9H/7sgewiPw0RyCi3Ftb//in:LbNbZvPKvIG4hxfwJbPiVF/e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13659

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Assumption.mil

SHA256 cfc4f0ebad464fb03505fa5fd41d58a124ae5180d16bf8db5a06bab05b64e5ca
MD5 7e19f32bdfb89baaa91557400e2eca24
SHA1 229bd1bfa46bc9b39ffa584bf1695bd00a50b242
SHA512 29e3e6696746f08ddef666afa86d5c6b11d7774b606c9380189f43efa430d3cd55d4963bd580d5846498d38fe94cf7e256d768f1e43db886ea59636e371da4bd
SSDEEP 6144:/b0F2++GISCmyAzC5VUaLY/Xy9HZDUc+Dk2gMt14Rro/aMhzU6zQa:YFCxmyymlLQy95DUcak2/4GaGY6Ua
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ended.mil

SHA256 9e81f5c2781fb83c69340c31efabdfbec94a2f72ab8dcac01e7a1fd4fa31116a
MD5 2ddefc57dfcb67bd6d26c2e3c1f805ca
SHA1 e8b896d7600719f006673bd2081c343bdb3e5409
SHA512 72ed6cce18da3abe67ab6afb10ae8319bcda45d9b42df6dfbcc77d86cb3aec3144a864f1431d7a3aad54c660a272d68d4dd4850c34bebdcd9e9b29961cd21820
SSDEEP 3072:lQpwmiQK2zyhFH0PIzyNJ+i8gwSaPGD7eLoCVj8QIh+VWN2BNkne0YK+z2xx3EmT:lQhHK2zyhaPRnrwSt7erYAWN2Byne0YG
MD5 SHA1 SHA512 SSDEEP

$TEMP/Excerpt.mil

SHA256 b094de2c7689000b64fc5bfd09aceb56dd3ae821f2261594dbc4ca3e4b0b002b
MD5 91b2cbec9043883fc8a03afd3948fe5d
SHA1 f1f3b74908f90c9e6cc4e135a3515e4478aceb92
SHA512 cc32f5c0918abd06d3cf98be57dd69304d07b7e945a0db188cae902d773d701e86fb380d71fb92adeb8450611ca5d92a2c5a6cd9b4935adbb2e9b08fba203812
SSDEEP 6144:ZEi/QYBGqNM8tASkA4RRw79bZKaKpKfnmIaZh:T/QpAASkAiwhbZxlfn6D
MD5 SHA1 SHA512 SSDEEP

$TEMP/George.mil

SHA256 1b3447b3d8e73726e51605f4dd7d17a9c4c42325cad701a042602b260c2c3ef6
MD5 9506151deb33294637dff8dbe39eb2ec
SHA1 c6e71b2aecb4f11056f76d42618b873a61f34fad
SHA512 73a1c5458a8520c91b83efe3f1b93dd393b796e393b9e3bd9e0b2bcabf13752ddb3663d55c0f2930ce4550320327e23be1478ba5668a5cfb36ab8aba5ce03a58
SSDEEP 6144:fI6W3nKcUFbaffBTCCEXBFp006FIvkFgdlfLpWx059VoFZqzd4QmI/ZfjG:fI6WXK1b4IZFMGvffLEx0bVsZwd8KjG
MD5 SHA1 SHA512 SSDEEP

$TEMP/Master.mil

SHA256 06fda8e05f4e0fbb91379542957242cea895073089b5b757aa5810252fc592d0
MD5 ceb0479b1fbef067f67cf70a9193be77
SHA1 1fd13f7b7ac693c6ba439f5fad2d3195b1a38827
SHA512 d1520eeb90e95e8e80bec41b5584e1f3b7adceef708eec567fe1453ffd2d1c2e3d14a18fbb9c044de65a9f3e0cbfa6cb22fbdb3ad91713af10be13b182124540
SSDEEP 3072:Y0CoLz6ieJ2X8h+5/72vHsbfwC1wGHvr1eZGLv80Dw9D8Ysjrp/polaz3rd:BS08h+csbJkMLFE9D8tBprd
MD5 SHA1 SHA512 SSDEEP

$TEMP/Prayers.mil

SHA256 afaf7cf5cf16c931cd3e9be1fab803ce212bfca5d4e4378fe8903f13171fe0e0
MD5 3714f6223c35a1d87dfb33c80e5f494f
SHA1 83f10d25ccb0a16e6be9dce8044f34d7b6a919ac
SHA512 3aa8b8e511a2505fd8733bc50402d836cf3a70d39f629256bb20bf14ae687802b11d6e90bb11dcdbb84b69ebd47315e7a7deeb2d08e327a826d3b90889da729e
SSDEEP 768:7cAOvDpFJsb+C8NZ/ruEDngtGS6ickdQb44:TAC5eMCg2kO9
MD5 SHA1 SHA512 SSDEEP

$TEMP/Really.mil

SHA256 930c364ec137ba561ab5cbc86e6c95da854afd18b7320b0bfa1ad308f7e0b12f
MD5 233c35f412815552195b7ca445984e68
SHA1 a70e375d8cc407865234e5fcb5bf33b473d1023f
SHA512 449330ca66137dbf41bb1cb64c5ea58b352beff2ecf285ea15990b941e260aff421fe532396bdce28f78ca64eb2dde86ffde264b2e7b12a758602d96435b6820
SSDEEP 12288:L5KRMYVumCYdZfHS0lRyK2sushHqmkrIBvIA/733+OB4lI:IxVEYjfBlkfsuser0vd/7ej6
MD5 SHA1 SHA512 SSDEEP

Arrives

SHA256 1b321be7f3213e914e3eaebf1a37a0c4a4a7c485429e235836c549b948fa68be
MD5 960237d0d655dd35fa375d979b4e322b
SHA1 8cf412866eec006becccffe6f513a29b23ce2383
SHA512 3a7dac0642b098ae5cbc21723f5b6ef929f5c119b0e4122f38bf2d9ba40681c0be406359e0e3c318868cd8e5afdc355f6146219fe0f63e2f0866638323895f68
SSDEEP 3072:sKenii0yD1LoanUveooL4x7KBgtEnsjAZNL1iBZ4l:s1vRBHPoonh
MD5 SHA1 SHA512 SSDEEP

By

SHA256 c2bf748381a547982d4b4d3d41aec3430519a4349dad78bff47b1c922c303018
MD5 3929ac882798ef6d766304c87f0ff48b
SHA1 ce8f2a433d7ca55ab9fc0452e9f18f120d17c129
SHA512 91884450056ff280e369429f64cd3b996313d5cebd70388434eddf5e6a96ed60f813998c9d93c117dcc2c3ef34de272b701e6644de6b2ce348d22f2d7bfc5487
SSDEEP 384:LAjesFUpNVU3/tel9lS6AzLsstExg/u2WuFRQNv17+vSVWVFTwWdGBkSY:ke4Ur2+9Bkk2TalOSVWV9+k
MD5 SHA1 SHA512 SSDEEP

Classics

SHA256 4e3a4b7c26f1e266a035337b540d16eb1d809723a703346981b7abbffea71a56
MD5 2f917b791a3a60141e2441b279285403
SHA1 cc4c809c72baa791559d98bf475db2db8eb2b040
SHA512 f8546003db05502c72d8a6c449168b092b12a14a04398c941df535d274319352985e156bf64fa9fb92814699ccb34fc9721a93de708d92eb0b5ed50f17ba412e
MD5 SHA1 SHA512

Corporate

SHA256 6e0a41aef668b9f5de728fd8430327ebb88189ae4faddf6f4312fb82791e4b76
MD5 368ad99766b7cda525e409774522d63c
SHA1 93a0b6755aeae537703580a383ea504e027c61d7
SHA512 8073480699ed7c4bfc672e09b53071b2d5573eb40be98ecdd3c99a364a034c8a762780996d50f2fa0a1a45eec66a4bd07012cdc8b159803140adafc2a7a926ae
SSDEEP 1536:YRB6j6rs84dvTcAXjKd1bS1wwQOchO+534IY1GsTrkerRIb:Uw6uId1bvhOYSQurhrRIb
MD5 SHA1 SHA512 SSDEEP

Evaluated

SHA256 17c5e6c04d9365aaf7953aaec43ef1535b6cea50c0abc2e16530ef246887b391
MD5 8dda4d5e8f88c4087ec2f756c0c360a6
SHA1 af73b1c9cce1f6308718e2f6aa943b7225e95628
SHA512 caeaedb6619681abea28885dd9d67431a3d47dd34035ca22e226a8b69a7bb25637606cfab5679cb906e407fa72f86a8aecd2beaa23766897c25b885d961f350d
SSDEEP 1536:g4pG+3DY0kkraxjJ4AHol9dlefIQu5aAwurPo:g23DjOH4IoVcfIHaAtrPo
MD5 SHA1 SHA512 SSDEEP

Forecasts

SHA256 0cc17ccf680f8ff78d53386b049c38b9c3c537be9cfec655b7bc26b3536c170a
MD5 17926e58356103a3028ee6cce7b3c896
SHA1 911cff0b35d39a3cde50b82cc3604ae587b2d0b3
SHA512 79507605c0dfa62b34a4f0a0cc48c09634b6670d4be0fec1c05a746807bf03507039540ca3d85e39ee02bbef315cd60aa77dfc582fcfc5a029fb90bba09a4852
SSDEEP 1536:3ebjpcU8VSCxAp1HElS4F1ZoLz3BuXTHdToONUv:/U8QCgh+qLzxc9TvNUv
MD5 SHA1 SHA512 SSDEEP

Hardwood

SHA256 6415124a444b1e60b814554e417c2dd3a69af4b7970196dc823a295a5119fe32
MD5 bd85b1ef617a869ea156569437c08034
SHA1 5c03280d5e63af07879fdea74f7d4cc443e28e81
SHA512 1f7b1d110ca722e1d15d994997b609896d34483c25f410959e71bd8882bf2786c476b7913eb2ba076752613489e17cc71a016a12494548a7fb7b5883181abf1f
SSDEEP 3072:6EfGxciSvbDb4wo36sVtT6H04k5h6m/Fyz:QxciSzn4w66snrZ/Fs
MD5 SHA1 SHA512 SSDEEP

Ist

SHA256 c54eb0f7663307d385fc9908e103373923f9fdb847e9dc9f014192b705dbff88
MD5 0d0738777cfbfb8b44c8e7949443b848
SHA1 22f6bd93a60f79875610fd4c92e0dedda7da7cbd
SHA512 279cddbc58487168871138bb1010bf8c362532ad22e7923403d4aa5f11ea127cbdb2351576d1cd9cdc3978cffc68d790f576327688187e63c123d226b6c72625
SSDEEP 1536:ghUHTlTMsqu60OonZY6aFNrKNjeiatvMp6EDF:QUhMsqu5OonZkFNrsjeiv
MD5 SHA1 SHA512 SSDEEP

Latitude

SHA256 a76ea8016977a4170a99537f5f83d610afc394f1b3741a42f37b90e84f00b299
MD5 60d79095baa941b3480a4da78660a595
SHA1 07ab853267b773f4f6d2dc3daaefebe51a2d698f
SHA512 b125bff55c7236e85a9e96f590439acd19a012c90acb9c6c4f5fa5002b7f6b6eff5d3fcdafb58ab3a415a4dd299c9399349637a29dbf79f9dd153cf061423ec5
SSDEEP 1536:h42r7snyuXG5egqzIU15AG73prFCtNwFqGqUqHHM/cZ+nVz1gNlySkcFs1d2:3rwnNX51zt2wQGq/hoVRgNkSXFn
MD5 SHA1 SHA512 SSDEEP

Ranging

SHA256 34dbb24d368fb66ab6185205386d8078763c487ccb1634fb2a69d2da5628d82a
MD5 bfe66e7fde7e37ae56d513e3c3baad87
SHA1 2b139267ea7793fae422815f15807fe1e7ee3282
SHA512 651406f09a96330073a4531aa77887d3ed6c8fac421266b0d579cf66ec2888376b9873bde68f1176b05ca630caeee522df0618fd3bbc5d85f1feab79c07620c6
SSDEEP 3072:vlsgIhs3kmTmwZDgGbDHVAc6jG31Izxsm:tsgIhy4sDVbDHV7A3im
MD5 SHA1 SHA512 SSDEEP

Still

SHA256 158006cd4b242cb3f31a305ac2e07c5a44e66f7df78c5e8429202a182119ff86
MD5 efd936149e35d293bbd5ac44f9c65e4e
SHA1 dfb8ac79c62581acd913885a6e99ff0e98160014
SHA512 da5fc6c42ae911d5ae331a419577a7d4eb8299ebf48e2cccb698e55139dacfbcaed70fc77add4c381dcc9c686c4bb3e5ac6c6a917996741a0c25923397d361f6
SSDEEP 1536:Kh50sYpwy8c1BY/6Qaa2W+GOq7owMa4IY1GsCPeFmHz1vNq89:KR1yciPWprowM3QR
MD5 SHA1 SHA512 SSDEEP

Tell

SHA256 f08e0c5d4175d5d5e6e0beff0010cf0fd9db6e1188b0ec4db9c5f6e34207fd41
MD5 448398e900447b48be9ee4709be4421d
SHA1 4c849d257d62405617440de03ea7d8b69c32c0e9
SHA512 1a17bc7f2c22735d1139fd3dbe21f88a81dcaf6bade79de56ef66f72c655a1cc38e6a964d60e4cb5e30c04bce7ae577a5064da7c12d1538fdc4053ceb4a953dd
SSDEEP 768:JgchN2gdbjlL0o4Ogjcg9Qkw7s3T3Xr63EYr8qcDP8WBosd0bHazf0TR:JcgbrnoZwknr63EYrDWyu0uw
MD5 SHA1 SHA512 SSDEEP

Tranny

SHA256 2c80a215bcb9f313affdedfab822fcb29ddf3a30171ebbc4a43a0dfbff5883c4
MD5 cd359a8f4c4e4d8522cd88b03ab94d07
SHA1 001e6f81f412118c4a29ddb511cd1c9f4565ff30
SHA512 44df3df53ec5e110a516e7e347feccdb8f9078150cf571fa73bf30fc5440420ab53b6736395eaf6da9ce6e43665e0a6630d4e69ae927b6fdb7b68fda35e24df7
SSDEEP 3072:DDYrVUhijUvlgTRMsKz50/0DIPEXbeTjDiNyz:DaVUaUviTRS505EXoiNyz
MD5 SHA1 SHA512 SSDEEP

$TEMP/Translation.mil

SHA256 21593da014197395eae707c8593f30058bac062c8c278ca34ef4945ea92dd7e2
MD5 a9826d2114c4fce768396c64679af31a
SHA1 fb8ed60e49ec8667f06d16f0ef43ef10e21c6c02
SHA512 7caa8a7694d03cc3f18e15c88621e999abc1462dacea315b4e3d2598f448b7812ce617f8b77bf3e0ef9231b98c5204baf9283d45a26d89bf5e6f523ed21cdbbc
SSDEEP 6144:3ipnTlTxg55i568hs773cxzJsrh5zdFAKhB9Q:yZlAiZ673CJ6zdFAv
MD5 SHA1 SHA512 SSDEEP

SecuriteInfo.com.Win32.Malware-gen.63978713.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Assumption.mil

$TEMP/Ended.mil

$TEMP/Excerpt.mil

$TEMP/George.mil

$TEMP/Master.mil

$TEMP/Prayers.mil

$TEMP/Really.mil

Arrives

By

Classics

Corporate

Evaluated

Forecasts

Hardwood

Ist

Latitude

Ranging

Still

Tell

Tranny

$TEMP/Translation.mil

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.Win32.Malware-gen.63978713.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Assumption.mil

$TEMP/Ended.mil

$TEMP/Excerpt.mil

$TEMP/George.mil

$TEMP/Master.mil

$TEMP/Prayers.mil

$TEMP/Really.mil

Arrives

By

Classics

Corporate

Evaluated

Forecasts

Hardwood

Ist

Latitude

Ranging

Still

Tell

Tranny

$TEMP/Translation.mil