Opera_26[.]0[.]1656[.]60_Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Opera_26.0.1656.60_Setup.exe
Size 31.0MB
Sample260815-we6pya1xes
SHA256 292ab9b24cb9a0cd51df0a75e433f86b41a9f59f28ffadf7b2e675c98412afc5
MD5 11420a2a99b639f8bb83f2f7bbb29e36
SHA1 a488b5ababc4571b2535a924a83e05ccbec54a29
SHA512 809918a4f8a1c0992949637292263a4cdc57b6e613e6c12f0a671cf59b04423dfa4101398536bbdfd3c2c2d51a54682ef428c7a3887fe4748276efc816ab5809
SSDEEP 786432:GSrcmvDLfel+ewmK5VrgCGC0pOfeROhrTGpxNDt:3rcmv/ec93OCNfeR3NDt
TLSH
T194673350B7D80125F8F36BB1AEB9266045BE7C625B3AD2DF53D4081C59B0AE1E770B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Opera_26.0.1656.60_Setup.exe

File Explorer

Opera_26.0.1656.60_Setup.exe

.exe 31.0MB

Opera_26.0.1656.60_Setup.exe

IMPHASH 5633cb43258cc1768a7463647f3e0bdd
SHA256 292ab9b24cb9a0cd51df0a75e433f86b41a9f59f28ffadf7b2e675c98412afc5
MD5 11420a2a99b639f8bb83f2f7bbb29e36
SHA1 a488b5ababc4571b2535a924a83e05ccbec54a29
SHA512 809918a4f8a1c0992949637292263a4cdc57b6e613e6c12f0a671cf59b04423dfa4101398536bbdfd3c2c2d51a54682ef428c7a3887fe4748276efc816ab5809
SSDEEP 786432:GSrcmvDLfel+ewmK5VrgCGC0pOfeROhrTGpxNDt:3rcmv/ec93OCNfeR3NDt
TLSH
T194673350B7D80125F8F36BB1AEB9266045BE7C625B3AD2DF53D4081C59B0AE1E770B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

opera

PE Signature issue

Digest

d1:87:a5:ef:aa:4b:45:c3:d5:e0:52:84:fb:50:bd:59:78:b6:85:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

Chains

Dec 16, 2014

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

Serial Number

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2014 - Apr 6, 2017

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2012 - Jun 6, 2022

Minor OS version

Major OS version

Entry point

572429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildbot\slave\w\LAR6\desktop-2013-4\chromium\src\out\Release\installer.exe.pdb

comctl32

ord413 ord410 InitCommonControlsEx

gdiplus

GdipAlloc GdipCreateBitmapFromStream GdiplusShutdown GdipDisposeImage GdipFree GdipCreateHBITMAPFromBitmap GdiplusStartup GdipCloneImage

secur32

GetUserNameExW

crypt32

CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CryptQueryObject

wintrust

WinVerifyTrust

wininet

InternetConnectW InternetReadFile InternetCrackUrlW InternetOpenW HttpSendRequestW InternetSetStatusCallbackW HttpQueryInfoW HttpOpenRequestW InternetErrorDlg InternetQueryDataAvailable HttpAddRequestHeadersW InternetSetOptionW InternetCloseHandle

msimg32

AlphaBlend

psapi

GetProcessImageFileNameW GetProcessMemoryInfo GetMappedFileNameA

winmm

timeBeginPeriod timeEndPeriod timeGetTime

shlwapi

SHGetValueA SHStrDupW SHDeleteKeyW

advapi32

GetSecurityDescriptorSacl RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW CreateProcessAsUserW RegCloseKey RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA BuildExplicitAccessWithNameW GetNamedSecurityInfoW SetNamedSecurityInfoW FreeSid SetEntriesInAclW SetSecurityInfo AllocateAndInitializeSid GetSecurityInfo RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW OpenProcessToken BuildTrusteeWithSidW RegGetKeySecurity AdjustTokenPrivileges CheckTokenMembership LookupPrivilegeValueW DuplicateToken AccessCheck GetExplicitEntriesFromAclW GetUserNameW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW GetTokenInformation

kernel32

LoadLibraryExA EncodePointer IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetFullPathNameW SetStdHandle GetFileType ExitProcess AreFileApisANSI RtlUnwind UnhandledExceptionFilter GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation WriteConsoleW ReadConsoleW LoadLibraryExW SetEnvironmentVariableA CreateFileW GetLastError CloseHandle GetCommandLineW GetEnvironmentVariableW CreateProcessW GetCurrentProcess InterlockedCompareExchange Sleep TerminateProcess GetProcAddress LoadLibraryA CreateEventW WaitForMultipleObjects GetCurrentProcessId GetModuleFileNameW VirtualAlloc GetModuleHandleA VirtualProtect WaitForSingleObject SetEvent GetExitCodeProcess GetProcessId OpenEventW LocalFree CreateMutexW DuplicateHandle ReleaseMutex OpenProcess ReadFile CreateMailslotW CancelIo WriteFile SetFilePointer SetFileTime GetDriveTypeW GetLogicalDrives DeviceIoControl GetModuleHandleW FindResourceW LoadResource GlobalLock GlobalAlloc SizeofResource GlobalUnlock GlobalFree LockResource GetCurrentThreadId LoadLibraryW MulDiv FindResourceExW AllocConsole OpenMutexW DeleteFileW OutputDebugStringA SetLastError GetTickCount FormatMessageA SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW GetFileAttributesW GetFileAttributesExW GetLogicalDriveStringsW GetLongPathNameW GetTempFileNameW QueryDosDeviceW SetFileAttributesW GetTempPathW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileW MoveFileExW ReplaceFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetStdHandle SetHandleInformation CreatePipe ResumeThread AssignProcessToJobObject QueryPerformanceCounter QueryPerformanceFrequency InterlockedExchange GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime IsDebuggerPresent ExpandEnvironmentStringsW UnregisterWaitEx RegisterWaitForSingleObject GetVersionExW GetNativeSystemInfo GetLocaleInfoW GetUserDefaultUILanguage ResetEvent RaiseException CreateThread GetCurrentThread FlushFileBuffers GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointerEx HeapSetInformation GetModuleHandleExA CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetSystemDirectoryW GetWindowsDirectoryW QueueUserWorkItem GetModuleHandleExW CreateToolhelp32Snapshot RtlCaptureContext SetUnhandledExceptionFilter InitializeCriticalSection ReleaseSemaphore InterlockedIncrement InterlockedDecrement OpenThread GetThreadContext VirtualQueryEx CreateSemaphoreW SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW DeleteFileA DebugActiveProcess DebugActiveProcessStop UnregisterWait ReadProcessMemory Thread32First Thread32Next Module32FirstW Module32NextW GetThreadPriority LocalAlloc GetPrivateProfileStringW GetPrivateProfileIntW HeapReAlloc HeapAlloc HeapFree GetProcessHeap HeapSize DecodePointer HeapCreate SwitchToThread GetSystemInfo VirtualFree VirtualQuery GetEnvironmentVariableA Module32First Module32Next lstrlenA CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateProcessA OutputDebugStringW ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult RemoveDirectoryW GetProcessTimes

gdi32

GetObjectW GetTextExtentExPointW CreateCompatibleBitmap CreateCompatibleDC SelectObject DeleteObject SetBkMode GetDeviceCaps SetTextColor BitBlt CreateBrushIndirect GetStockObject CreateFontW

ole32

PropVariantClear CoTaskMemFree CreateStreamOnHGlobal CoUninitialize CoSetProxyBlanket CoInitializeEx CoCreateInstance

oleaut32

VariantInit SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen VariantClear VariantChangeType VariantTimeToSystemTime

user32

GetDlgItem GetWindowLongW LoadIconW DestroyWindow HideCaret EnumThreadWindows IsWindowVisible IsWindowEnabled SetForegroundWindow DestroyIcon MessageBoxW UnhookWindowsHookEx SetWindowsHookExW ShowWindow GetSysColorBrush SetWindowPos GetSysColor ReleaseDC GetWindowTextW InvalidateRect GetDC BeginPaint SetFocus GetClientRect FillRect GetWindowRect ScreenToClient GetWindowTextLengthW SetWindowLongW IsDialogMessageW CharUpperW TranslateMessage DispatchMessageW PeekMessageW PostMessageW WaitMessage DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer CreateDialogParamW SendMessageW EnableWindow SetWindowTextW AllowSetForegroundWindow SendNotifyMessageW EndPaint CreateWindowExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

736KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

329KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Opera_26.0.1656.60_Setup.exe

PE Signature issue

comctl32

gdiplus

secur32

crypt32

wintrust

wininet

msimg32

psapi

winmm

shlwapi

advapi32

kernel32

gdi32

ole32

oleaut32

user32

userenv

generic