Flash Player 11[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Flash Player 11.exe
Size 8.1MB
Sample260801-k8psqsxtew
SHA256 dc2318c4cf04beaafe47033321e68f34e48f6ed8dddd91f35b49c100727b2675
MD5 f03524dc13f27f22db6c167239adbb6e
SHA1 d1f6dc722115b06e0c038c0c220fd449f4faf68f
SHA512 c1df446b630ac14662e7c2f928b7b17dd0c484501fd54f930bfcf7b26b6b8a35bad93281667bce8022920e3234693b8ae9f0b417249f28d6d2fe714c840c183d
SSDEEP 196608:1au624cr273uOqhN9iQRgjnC5NNXowzdqYasdOJ:Iu624cauRiQknCz6fJ
TLSH
T15086CF63FAE180B6C05225B1453B672FB8FC6774473459C76BD02899BA713D18A3A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Flash Player 11.exe

File Explorer

Flash Player 11.exe

.exe 8.1MB

Flash Player 11.exe

IMPHASH 701319ac01e0d6216090668cc4e97d4c
SHA256 dc2318c4cf04beaafe47033321e68f34e48f6ed8dddd91f35b49c100727b2675
MD5 f03524dc13f27f22db6c167239adbb6e
SHA1 d1f6dc722115b06e0c038c0c220fd449f4faf68f
SHA512 c1df446b630ac14662e7c2f928b7b17dd0c484501fd54f930bfcf7b26b6b8a35bad93281667bce8022920e3234693b8ae9f0b417249f28d6d2fe714c840c183d
SSDEEP 196608:1au624cr273uOqhN9iQRgjnC5NNXowzdqYasdOJ:Iu624cauRiQknCz6fJ
TLSH
T15086CF63FAE180B6C05225B1453B672FB8FC6774473459C76BD02899BA713D18A3A38F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2a:43:ff:e8:7c:cd:5a:57:10:9a:bc:f4:00:1b:9c:7c:58:8b:3a:7d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Aug 12, 2012

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 15, 2010 - Dec 14, 2012

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

6035515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FlashPlayer.pdb

oleaut32

SysFreeString

kernel32

GetCommandLineA GetStartupInfoW GetFileAttributesA CreateFileA WriteFile DeleteFileW GetCommandLineW SetEnvironmentVariableA CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP GetModuleFileNameA CreateFileW GetFileSize SetFilePointer ReadFile CloseHandle GetVersionExW GetModuleHandleA GetSystemInfo SwitchToThread TlsGetValue TlsSetValue GetCurrentThreadId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement InterlockedIncrement InterlockedExchange WriteConsoleA GetStringTypeW GetStringTypeA GetLocaleInfoA InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc LCMapStringA IsValidCodePage GetOEMCP HeapCreate GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsDebuggerPresent TerminateProcess GetStdHandle GetSystemTimeAsFileTime UnhandledExceptionFilter ExitProcess RtlUnwind GetStartupInfoA IsProcessorFeaturePresent GetProcessAffinityMask HeapSize HeapFree GetProcessHeap HeapAlloc EnumSystemLocalesW GetUserDefaultLCID GetTimeFormatW GetDateFormatW CompareStringW GetCurrencyFormatW GetNumberFormatW TlsFree TlsAlloc VirtualProtect InterlockedCompareExchange Sleep VirtualFree ReleaseMutex GetCPInfo GetACP IsDBCSLeadByte CreateProcessA GetTempPathA FindNextFileW GetModuleFileNameW GetTempFileNameW GetSystemDirectoryW ExpandEnvironmentStringsA WideCharToMultiByte MultiByteToWideChar FindClose GetTempPathW CreateProcessW GetTempFileNameA CreateDirectoryA DeleteFileA GetVersionExA GetLastError CreateMutexA FindFirstFileW SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetFileInformationByHandle GetVolumeInformationW MoveFileExW GetCurrentDirectoryW SetCurrentDirectoryW RemoveDirectoryW GetFullPathNameW ExpandEnvironmentStringsW OutputDebugStringA CreateDirectoryW LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleW GetCurrentProcess LoadLibraryW GetFileAttributesW VirtualQuery ExitThread GetUserDefaultLangID GetUserDefaultUILanguage VerifyVersionInfoW VerSetConditionMask GlobalFree CreateThread LockResource LoadResource FindResourceExA FindResourceExW GlobalAlloc GlobalUnlock GlobalLock QueryPerformanceCounter QueryPerformanceFrequency GlobalSize QueueUserAPC OpenThread SleepEx SetUnhandledExceptionFilter GetCurrentProcessId GetProcessTimes RaiseException WaitForSingleObject FlushInstructionCache SetLastError TerminateThread CreateEventW SetEvent ResetEvent GetTickCount SetThreadPriority GetTimeZoneInformation GetSystemTime SystemTimeToFileTime GetLocaleInfoW LCMapStringW GetSystemDirectoryA lstrcpyA lstrlenA MapViewOfFile UnmapViewOfFile WaitForMultipleObjects CompareFileTime LocalFree GetEnvironmentVariableW VirtualAlloc CreateFileMappingA ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask GetCurrentThread CreateEventA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer InterlockedExchangeAdd lstrlenW GetVersion DeviceIoControl CreateSemaphoreA

user32

TranslateAcceleratorW TranslateMessage DispatchMessageW SetDlgItemTextW SetDlgItemTextA SetFocus GetWindowTextLengthW EnableWindow GetDlgItemTextW GetWindowTextLengthA GetDlgItemTextA ShowWindow UpdateWindow GetMenu GetMessageW RemoveMenu InsertMenuW InsertMenuA InvalidateRect LoadStringW DialogBoxParamW EndDialog GetDlgItem LoadStringA SetWindowTextA GetWindowTextA PostQuitMessage UnregisterClassA GetWindow GetWindowRect GetDC ReleaseDC SetWindowPos LoadAcceleratorsW GetMenuStringA EnableMenuItem DefWindowProcW DestroyWindow GetSubMenu GetMenuItemInfoW RegisterWindowMessageA PostMessageA GetDoubleClickTime WaitForInputIdle GetForegroundWindow InflateRect GetSystemMetrics SetRect PtInRect SystemParametersInfoW SendInput SetPropW GetPropW DestroyIcon GetCursor SetCursor SetWindowLongW SetRectEmpty GetKeyState PostMessageW GetMonitorInfoW MonitorFromWindow ClientToScreen FillRect CreateIconIndirect SendMessageW SendMessageTimeoutW GetParent SetWindowTextW LoadIconW GetDesktopWindow DialogBoxIndirectParamW RedrawWindow GetClientRect ScreenToClient MessageBoxA KillTimer SetTimer GetQueueStatus PeekMessageW GetWindowLongW CheckMenuItem GetFocus CopyRect GetWindowInfo LoadCursorW MessageBoxW GetCursorPos EnumWindows GetCapture CallWindowProcW SetCapture GetMessageTime ReleaseCapture TrackMouseEvent SetCursorPos RegisterClipboardFormatW CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetClipboardData EmptyClipboard MoveWindow MapWindowPoints GetActiveWindow FlashWindowEx SetMenu GetSystemMenu IsZoomed GetWindowPlacement SetWindowPlacement IsWindowVisible ShowWindowAsync GetClassInfoExW IsIconic IsWindow EnumDisplaySettingsW EndPaint BeginPaint GetWindowTextW RegisterClassExW CreateWindowExW DeleteMenu LoadMenuW RegisterClipboardFormatA GetClipboardFormatNameA InsertMenuItemW CreateMenu EnumDisplayDevicesW DrawMenuBar SetMenuItemInfoW SetMenuInfo DestroyMenu TrackPopupMenu CreatePopupMenu OffsetRect ShowCaret CreateCaret DestroyCaret SetCaretPos DdeUninitialize DdeFreeStringHandle DdeDisconnect DdeClientTransaction DdeConnect DdeCreateStringHandleA DdeInitializeW MapVirtualKeyW GetKeyboardLayout EnumDisplayDevicesA UpdateLayeredWindow GetWindowThreadProcessId GetMenuStringW

gdi32

SelectObject BitBlt CreateDCA GetICMProfileA DeleteDC CreatePalette DeleteObject CreateCompatibleDC EnumFontFamiliesExW GetFontData StretchDIBits FillPath ExtCreatePen StrokePath CreateSolidBrush GetObjectW StartDocW LPtoDP GetStretchBltMode SetStretchBltMode StretchBlt GetWorldTransform SetGraphicsMode SetWorldTransform GetTextCharacterExtra DPtoLP EnumFontFamiliesA GetCurrentObject GetTextExtentPoint32W GetDeviceCaps GetSystemPaletteEntries GetStockObject EndDoc SetPixel CreatePen SetTextCharacterExtra GetBkColor SetBkColor SelectClipRgn GetTextColor GetBkMode GetTextAlign SetBkMode SetTextAlign CreateRectRgn GetClipRgn IntersectClipRect CreateFontIndirectA SetTextColor ExtTextOutW ExtTextOutA EnumFontFamiliesW GetTextExtentPoint32A GetTextMetricsW GdiFlush RestoreDC SelectClipPath PolyBezierTo LineTo MoveToEx EndPath BeginPath EndPage StartPage SaveDC SetPolyFillMode GetClipBox SelectPalette RealizePalette CreateFontIndirectW CreateDIBSection CreateBitmap

comdlg32

GetSaveFileNameW CommDlgExtendedError GetOpenFileNameA GetOpenFileNameW PrintDlgW

shell32

SHAppBarMessage SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetSettings SHGetFolderPathA DragAcceptFiles DragQueryFileA DragQueryFileW SHGetDiskFreeSpaceExW SHGetFolderPathW SHBrowseForFolderW

ws2_32

WSACleanup WSAStartup select ioctlsocket closesocket WSAAsyncSelect WSAGetLastError WSAIoctl socket WSASocketW inet_addr gethostbyname inet_ntoa htonl getservbyname htons gethostbyaddr ntohs getservbyport WSASetLastError gethostname setsockopt recv send getsockname WSACloseEvent recvfrom sendto bind WSAAddressToStringA WSACreateEvent WSAEventSelect WSAEnumNetworkEvents connect ntohl

mscms

TranslateBitmapBits CloseColorProfile CreateColorTransformW OpenColorProfileW DeleteColorTransform

wininet

InternetConnectA HttpQueryInfoA InternetReadFile InternetCloseHandle HttpOpenRequestA HttpSendRequestA InternetOpenA

crypt32

CertCloseStore CertCompareCertificate CertNameToStrW CryptDecodeObjectEx CertFindRDNAttr CertRDNValueToStrW CryptFindOIDInfo CertCompareCertificateName CertAddCertificateContextToStore CertEnumCertificatesInStore CertVerifyTimeValidity CertVerifyRevocation CertFreeCertificateContext CertFindCertificateInStore CertVerifySubjectCertificateContext CertCreateCertificateContext CryptGetMessageCertificates CryptVerifyMessageSignature CertAddStoreToCollection CertOpenStore

urlmon

CopyStgMedium

version

VerQueryValueW VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeKillEvent timeSetEvent timeGetTime waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutGetDevCapsW waveInGetDevCapsW waveOutGetNumDevs waveInGetNumDevs waveOutReset waveOutClose waveInStart waveInAddBuffer waveInStop waveOutOpen waveInClose waveInUnprepareHeader waveInReset waveInPrepareHeader waveInOpen waveOutGetPosition mixerGetID waveInGetDevCapsA waveOutGetDevCapsA waveOutMessage waveInMessage mixerClose mixerGetLineControlsA mixerGetLineInfoA mixerGetDevCapsA mixerOpen mixerGetControlDetailsA waveOutRestart waveOutPause waveInGetPosition mixerSetControlDetails

dsound

ord2 ord1 ord8

advapi32

RegOpenKeyA CryptAcquireContextW CryptGenRandom CryptReleaseContext RegOpenKeyExA RegOpenKeyExW RegCloseKey RegQueryValueExA RegSetValueExA RegCreateKeyExW RegSetValueExW RegQueryValueExW

ole32

PropVariantClear CreateBindCtx CoCreateInstance CoTaskMemFree CoInitializeEx CoInitialize CoUninitialize ReleaseStgMedium OleUninitialize OleSetClipboard OleFlushClipboard OleIsCurrentClipboard OleGetClipboard OleInitialize CoTaskMemAlloc MkParseDisplayName

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

271KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Flash Player 11.exe

PE Signature issue

oleaut32

kernel32

user32

gdi32

comdlg32

shell32

ws2_32

mscms

wininet

crypt32

urlmon

version

winmm

dsound

advapi32

ole32

generic