AToZManuals[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AToZManuals.exe
Size 371KB
Sample260622-3jf4eaht9v
SHA256 dcebe82dfccf0dd71ff442b1b581f5f3f040db1afbc19d1476cafda81f0c5dd4
MD5 0ccd926d0ec64bcaa18ea08fbfe8ae1b
SHA1 42888d29c30e6107a6d3ea439d6b62399b26f128
SHA512 272e677d0c562876613adf2944e72a5b26ee1a6f17d51ccd4bf8181e957fda712cbde6f180f52a086295a67180eb562d066a4cbd22d672595232080657977ecc
SSDEEP 6144:1bUTp1QHfJPp5VksEFM+zsT8qEJEbrPBj3AEsx/vCdWYDbHIae+0U/aM4tp5iFw/:1IAHfVp0sCJ2azx/asspeuSLp5ief3
TLSH
T137841200DFA86153DBB10DB055A6D622CEB59C10E059073B137CFE4AFDB3AA262F9716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll

File Explorer

AToZManuals.exe

.exe 371KB
$PLUGINSDIR/AtoZManauls_msi_bg-copy_1501852810543_1528830768010.bmp

226KB
$PLUGINSDIR/AtoZManauls_msi_bg-copy_1501852825863.bmp

226KB
$PLUGINSDIR/Error---Oops_1436200241491.bmp

2KB
$PLUGINSDIR/Install_ENG_1436200260055.bmp

5KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/english_cancel_mip_1482425559536.bmp

5KB
$PLUGINSDIR/nsDialogs.dll

.dll 182KB
TooltabExtension.dll

.dll 266KB

AToZManuals.exe

IMPHASH 7ed0d71376e55d58ab36dc7d3ffda898
SHA256 dcebe82dfccf0dd71ff442b1b581f5f3f040db1afbc19d1476cafda81f0c5dd4
MD5 0ccd926d0ec64bcaa18ea08fbfe8ae1b
SHA1 42888d29c30e6107a6d3ea439d6b62399b26f128
SHA512 272e677d0c562876613adf2944e72a5b26ee1a6f17d51ccd4bf8181e957fda712cbde6f180f52a086295a67180eb562d066a4cbd22d672595232080657977ecc
SSDEEP 6144:1bUTp1QHfJPp5VksEFM+zsT8qEJEbrPBj3AEsx/vCdWYDbHIae+0U/aM4tp5iFw/:1IAHfVp0sCJ2azx/asspeuSLp5ief3
TLSH
T137841200DFA86153DBB10DB055A6D622CEB59C10E059073B137CFE4AFDB3AA262F9716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

19:b4:64:f4:be:61:88:9c:87:d1:1a:c4:7e:63:fc:34:17:e6:e8:31:50:9b:92:14:c6:4d:fb:c8:7a:31:6a:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

Chains

Jun 12, 2018

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

88:c0:82:84:88:5a:90:2e:b8:d7:47:9b:7e:ca:a8:1c:10:60:f3:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

Chains

Jun 12, 2018

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

Serial Number

27:16:37:e1:fa:a6:83:91:b6:4c:c6:31:60:fe:7a:9f

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 1, 2018 - Jun 20, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Mindspark Interactive Network\, Inc.,O=Mindspark Interactive Network\, Inc.,L=Yonkers,ST=New York,C=US

Serial Number

53:dd:df:c5:c6:af:71:72:81:1c:e5:b9:e0:f6:81:cc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 1, 2018 - Jun 20, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW SetFileAttributesW ExpandEnvironmentStringsW LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW SetErrorMode GetCommandLineW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
TLSH
T1AC326C05536081F2F5909578942BBB271B3D1115A7BA8F87DFE38483BD282E6AE3D613
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH eef4bd1f74b6ec737c3745f000355f0f
SHA256 d84d810b8f8819f4a34d5e033b72951eadda1bbb5ed0b8c76874b6c25001caa9
MD5 b9a5a272154fc0dd652ef9c59c5d63a0
SHA1 a5c72fd5e6080ce7ee8377240f5ced5e908a80af
SHA512 1a641c3acb32145431ad51dcbc7bcb5da532ac0fc68ea5b24f588611648dd5cae2bd197c09d5783a03bdcdac73e9ca7b07d646e6fe56903439355cc1fd4007dd
SSDEEP 3072:NEF3K1gSVKhZXpsYOebeCqilqlu7LF6CnsYjXGx52J6RWYbzgt6R1YyAbyLpl:KfOGe5ilUkVjXGs6oizgsPYBmf
TLSH
T193045B1133E0907AF6B31B3475B596224FBABD316AB5C04F675246692DB0B80EE39337
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

4e:09:e1:fc:15:e1:c1:96:46:d9:5c:53:1e:ac:3e:c5:85:61:50:1b:3b:09:8d:98:0c:f6:9c:50:5b:ec:14:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Chains

Apr 19, 2018

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

13:cf:ed:a9:a9:05:a7:a7:b7:b3:b5:bd:1e:fe:1b:54:9e:aa:66:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Chains

Apr 19, 2018

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Serial Number

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 20, 2015 - Jun 18, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Serial Number

1c:27:e3:62:ed:4e:b2:48:a7:de:49:78:e8:74:a0:5a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 4, 2016 - Jan 3, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

91826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\TeamCity\BuildAgent1\work\ce988ff4d0171be8\IEtooltab\Build\Release.x86\nsDialogs.pdb

psapi

GetProcessImageFileNameW

wininet

HttpSendRequestW HttpQueryInfoW HttpSendRequestExW InternetReadFile InternetWriteFile HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW

comctl32

ord17

uxtheme

SetWindowTheme

crypt32

CryptStringToBinaryW

kernel32

lstrlenW lstrcmpW lstrcmpiW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW ReadFile WriteFile GetLastError LoadLibraryW GetProcAddress CreateFileW GetFileSize lstrcatW GetTickCount SetFilePointer SleepEx CloseHandle DeleteFileW MulDiv HeapAlloc GetProcessHeap HeapFree InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateEventW SetEvent WaitForSingleObject CreateThread TerminateThread EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetCurrentThreadId GetCurrentProcess FlushInstructionCache SetLastError RaiseException LocalAlloc LocalFree HeapReAlloc Sleep CreateFileA GetModuleFileNameW lstrlenA GetUserDefaultLangID GetModuleHandleW MultiByteToWideChar FileTimeToSystemTime CreateProcessW ExpandEnvironmentStringsW GetCurrentProcessId FreeLibrary OutputDebugStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess GetVersionExW LoadLibraryA GetCommandLineW UnmapViewOfFile DuplicateHandle CreateFileMappingW MapViewOfFile GetExitCodeThread CopyFileW GetExitCodeProcess IsValidCodePage GetOEMCP GetACP GetCPInfo ExitProcess HeapSize GetStringTypeW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA ExitThread DecodePointer EncodePointer InitializeCriticalSection InterlockedDecrement InterlockedIncrement InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent WideCharToMultiByte InterlockedPushEntrySList InterlockedCompareExchange GlobalAlloc lstrcpynW GlobalFree lstrcpyW SetHandleCount TlsGetValue TlsSetValue TlsFree HeapCreate HeapDestroy GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime RtlUnwind GetConsoleCP GetConsoleMode LCMapStringW SetStdHandle WriteConsoleW FlushFileBuffers GetSystemTime TlsAlloc

user32

IsIconic SetFocus SystemParametersInfoW AttachThreadInput GetWindowThreadProcessId SetForegroundWindow GetForegroundWindow EnumWindows GetClassNameW wsprintfA CharLowerW ScreenToClient GetPropW SetCursor RemovePropW DrawFocusRect DrawTextW BringWindowToTop SetParent MapWindowPoints ReleaseDC GetDC MapDialogRect CharPrevW CallWindowProcW wvsprintfW PostQuitMessage UnhookWindowsHookEx CallNextHookEx SetWindowsHookExW CreateWindowExW DefWindowProcW LoadCursorW GetClassInfoExW RegisterClassExW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow LoadIconW MsgWaitForMultipleObjects SetPropW PeekMessageW CreateDialogParamW SetDlgItemTextW DestroyWindow KillTimer UpdateWindow RedrawWindow SetWindowLongW GetWindowLongW SetTimer SendDlgItemMessageW SetWindowPos GetWindowRect GetClientRect InvalidateRect SetWindowTextW GetWindowTextW GetDlgItem IsWindow GetParent MessageBoxW ShowWindow PostMessageW CharNextW SendMessageW wsprintfW FindWindowExW UnregisterClassA

gdi32

CreateCompatibleBitmap GetTextExtentPoint32W GetObjectW BitBlt GetStockObject SetBkMode SelectObject CreateCompatibleDC DeleteObject SetTextColor GetDeviceCaps DeleteDC

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

advapi32

OpenProcessToken CloseServiceHandle QueryServiceStatus OpenServiceW EqualSid OpenSCManagerW AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountNameW RegCloseKey RegOpenKeyExW RegQueryValueExW GetTokenInformation

shell32

SHGetPathFromIDListW ShellExecuteW ShellExecuteExW SHBrowseForFolderW

ole32

CoCreateInstance CLSIDFromString CoInitialize CoUninitialize CoTaskMemFree

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

shlwapi

StrChrW PathRemoveFileSpecW StrRChrW PathFindFileNameW

TooltabExtension.dll

IMPHASH 3d424b1bd1476aabb6b566babbc4007f
SHA256 e71eca3ba443107880ea99520422489c4efc238b846681b6e3a5d3c9e61071bf
MD5 767737f00455032d893a223b78621f2d
SHA1 a22a70ddaece246c19ded3a402b5a14819a9c87c
SHA512 f39d8e58f27d24de8af531158218144ff597aa418e55e643ec590cc71e11c542c8586a2bb833fd32731488b1cf45d6da605365d6b78be2b2031f3ef09d73dac6
SSDEEP 6144:MYY0eApBPhCDVmiVWTjoDjVwL+81u2+wOisbm:McBJksJjoDjKC85O16
TLSH
T13B449E1177E0C437C2AF06349E53E7A429BAF9718E61C28B7BA49F1E1F716D0C92471A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Digest

4b:33:24:56:2e:35:c0:7d:86:04:9e:be:99:4a:f0:6e:77:15:c5:78:a2:29:d7:63:07:da:1c:ac:61:f9:60:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Chains

Apr 19, 2018

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

15:a2:cf:d8:ff:92:3a:92:8c:17:6d:59:16:cb:c1:fd:cc:24:5b:26

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Chains

Apr 19, 2018

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Serial Number

43:8d:42:91:e4:3c:2d:ff:ee:aa:ae:e5:b6:c0:70:b5

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 20, 2015 - Jun 18, 2018

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Mindspark Interactive Network,O=Mindspark Interactive Network,L=Yonkers,ST=New York,C=US

Serial Number

1c:27:e3:62:ed:4e:b2:48:a7:de:49:78:e8:74:a0:5a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 4, 2016 - Jan 3, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

95037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\TeamCity\BuildAgent1\work\ce988ff4d0171be8\IEtooltab\Build\Release.x86\TooltabExtension.pdb

kernel32

TlsFree CompareFileTime GetPrivateProfileStringW ExpandEnvironmentStringsW SizeofResource FindResourceExW LocalFree FormatMessageW GetProcessTimes GetPrivateProfileStructW GetExitCodeProcess WritePrivateProfileStructW FreeLibrary lstrcmpiW LoadLibraryExW CreateIoCompletionPort GetExitCodeThread TerminateThread GetSystemInfo PostQueuedCompletionStatus ResetEvent GetSystemDirectoryW GetQueuedCompletionStatus GetThreadLocale SetThreadLocale GetTickCount CopyFileW CreateFileW WideCharToMultiByte FlushInstructionCache GetCurrentProcess lstrlenW GetModuleFileNameW FindResourceW LoadResource LockResource GlobalAlloc GlobalFree GlobalHandle SetLastError RaiseException GetCurrentThreadId CreateEventA OpenEventA WriteConsoleW TlsSetValue GetStringTypeW LCMapStringW GetConsoleMode GetConsoleCP RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo InterlockedDecrement InterlockedIncrement GetStdHandle ExitProcess HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA VirtualQuery VirtualProtect DecodePointer EncodePointer CreateThread ExitThread FlushFileBuffers TlsAlloc TlsGetValue VerSetConditionMask VerifyVersionInfoW GetModuleHandleW GetProcAddress InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrlenA MultiByteToWideChar lstrcmpW MulDiv GlobalLock SetStdHandle GlobalUnlock SetEvent WaitForMultipleObjects WaitForSingleObject ReleaseMutex CreateMutexW CreateEventW GetLastError EnterCriticalSection LeaveCriticalSection SetFilePointer Sleep ReadFile RemoveDirectoryW FindClose FindNextFileW DeleteFileW lstrcpyW FindFirstFileW lstrcatW CreateProcessW WriteFile LoadLibraryW CloseHandle WaitForMultipleObjectsEx HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange

user32

MoveWindow ScreenToClient ClientToScreen ReleaseCapture FillRect CreateAcceleratorTableW DestroyWindow CreateWindowExW GetClassInfoExW RedrawWindow SetWindowPos CharNextW GetClientRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable UnhookWinEvent PostThreadMessageW SetWinEventHook GetForegroundWindow IsWindow GetClassNameW GetSysColor SendMessageW GetWindowLongW SetWindowLongW DefWindowProcW LoadCursorW RegisterClassExW GetWindowThreadProcessId FindWindowExW IsWindowVisible GetParent PeekMessageW CreateDialogIndirectParamW CallMsgFilterW MsgWaitForMultipleObjectsEx SetCapture PostMessageW MessageBoxW CharNextA DialogBoxParamW UpdateLayeredWindow KillTimer SetParent SetTimer ShowWindow PostQuitMessage GetDlgItem DispatchMessageW TranslateMessage GetMessageW EndDialog SendDlgItemMessageW MapDialogRect SetWindowContextHelpId RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetFocus SetFocus GetWindow UnregisterClassA

gdi32

StretchBlt CreateDIBSection SetDIBColorTable CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps DeleteObject GetDIBColorTable

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize OleUninitialize CoTaskMemAlloc StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize CoGetCurrentProcess CoReleaseMarshalData CoTaskMemFree CoTaskMemRealloc CoMarshalInterThreadInterfaceInStream CoInitialize CoGetInterfaceAndReleaseStream CoSetProxyBlanket CoCreateGuid

oleaut32

VarUI4FromStr VarBstrCat SysAllocStringLen VariantInit LoadTypeLi VariantClear SysAllocString SysFreeString OleCreateFontIndirect SysStringLen LoadRegTypeLi

shlwapi

PathRemoveFileSpecW StrStrIW PathFileExistsW PathRenameExtensionW PathCanonicalizeW SHRegGetUSValueW PathFindFileNameW UrlGetPartW StrStrIA IsCharSpaceA PathCombineW PathAddBackslashW SHDeleteKeyW PathAppendW

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCloneImage GdipAlloc GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI

msimg32

TransparentBlt AlphaBlend

wininet

InternetConnectW HttpOpenRequestW InternetCloseHandle InternetQueryOptionA HttpSendRequestW InternetOpenW

oleacc

AccessibleObjectFromEvent

wintrust

WinVerifyTrust

crypt32

CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertCloseStore CryptMsgClose CertFreeCertificateContext

Name

.text

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AToZManuals.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AtoZManauls_msi_bg-copy_1501852810543_1528830768010.bmp

$PLUGINSDIR/AtoZManauls_msi_bg-copy_1501852825863.bmp

$PLUGINSDIR/Error---Oops_1436200241491.bmp

$PLUGINSDIR/Install_ENG_1436200260055.bmp

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/english_cancel_mip_1482425559536.bmp

$PLUGINSDIR/nsDialogs.dll

PE Signature issue

psapi

wininet

comctl32

uxtheme

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic

TooltabExtension.dll

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

wininet

oleacc

wintrust

crypt32

generic