338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59

Sharing

Copy URL Twitter E-mail

General

Target
338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59
Size 1023KB
Sample260826-j2lbasvdnd
SHA256 338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59
MD5 b60ec150f2cd30bae5f87af52f120ad2
SHA1 47e7b9c15f181bb1a8448426d9a9e7cbde943949
SHA512 c0c93e3c39e1f71365445bf31f16f7b64017243b564f1c15da00509616d14df2cc0a8beb01edd8b00e450db43c81df5a189b57ae69cb05f02af47106a2450214
SSDEEP 24576:2mJCQBi5e7V7c2KIUuMUL74F86gmcxVTuIW2+ramO50EmqOBYA/Py:2YGqTuuMnFn1cxVTuVrrQ5+BjPy
TLSH
T117253306EF04503AE4DB90B5E97CD72FDE6C0932B57D9216ABA16E08397BF834446933
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$_88_

Untrusted Codesign Signers 6 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/$TEMP/SPStub.exe
unpack002/$PLUGINSDIR/inetc.dll
unpack001/$TEMP/ToolbarHelper.exe
unpack001/$_214_/$_214_/$_219_
unpack001/$_69_
unpack001/$_89_

File Explorer

338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59

.exe 1023KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$TEMP/SPStub.exe

.exe 67KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc.dll

.dll 29KB
$TEMP/ToolbarHelper.exe

.exe 84KB
$_214_/$_214_/$_219_

.dll 623KB
$_69_

.exe 84KB
$_88_

.dll 1.8MB
$_89_

.exe 84KB

338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59
MD5 b60ec150f2cd30bae5f87af52f120ad2
SHA1 47e7b9c15f181bb1a8448426d9a9e7cbde943949
SHA512 c0c93e3c39e1f71365445bf31f16f7b64017243b564f1c15da00509616d14df2cc0a8beb01edd8b00e450db43c81df5a189b57ae69cb05f02af47106a2450214
SSDEEP 24576:2mJCQBi5e7V7c2KIUuMUL74F86gmcxVTuIW2+ramO50EmqOBYA/Py:2YGqTuuMnFn1cxVTuVrrQ5+BjPy
TLSH
T117253306EF04503AE4DB90B5E97CD72FDE6C0932B57D9216ABA16E08397BF834446933
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/SPStub.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 077343d918a7fa4d693ae1e5c535999f371999533d16873cde5db679e105ddc5
MD5 ea5c1d73fb6840b69e5034ace95684af
SHA1 954c6bc07e97c488d4a1ccb6a810b320e5edcc64
SHA512 d737b4db8bb1daa695c66c18b4175db5419c5b4aaac460d20f91d575cb210360489e75e947d80bff0791109102a768a65a5312fd77400dfecfe2d9c27067442b
SSDEEP 1536:/dZEszWriITJGrvopX1VF7CXjl7y0CjUErcPIL9AJHgCg/7:8szWOITsEL50jl7y0CjXcPIpb7
TLSH
T12463C0875630C837F8D20B315AB5D612BFBBD6645CF4574B9320094E3EA1AC15B1D3A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b7:bf:05:61:32:c1:22:f2:b3:29:a4:ee:19:08:a6:67:df:9b:00:9f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Chains

Nov 7, 2012

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Serial Number

37:36:da:15:af:64:76:32:cc:e6:1c:d4:1b:65:77:dd

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2010 - Mar 29, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

Major OS version

Entry point

13333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 2c2db6b7ca5781a34c30c42c18ec1ece1284b8d500fd0251fa383fd7b1eeb6e0
MD5 5ccde6cbe28a74c393f2b7b6f5cc7458
SHA1 f49a9731b0c94418430c2d82970164b21acb4bfd
SHA512 f2a24ec74409f006c9c99ea5ebe7e33de6ae8f49d8f90b05d1f56de9c0ae17a31b3217a71ccf2dc33ebb4305db19cad2e296f32f12273cd9bcbb2603d536100c
SSDEEP 192:sBer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SySXe:sK7Xws4FVWig86/5eCBqSySXe
TLSH
T1A3323A3657A0D2F2E6A1827408A639336BBA761412B50D1BDFF74481FC157C63E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 917ae9b9adb269abd5543f5bf5676bac
SHA256 7a438bffdcade504d71ca822cbd852d4f99f9a257493031e7340eec0d0d44172
MD5 8326b29343614f3db9d8e3da200bde36
SHA1 c4fdab266af7f1c0eef0e77c77ed8ba38bcac667
SHA512 a24ff4dc59e0f5889ce0d3a2a1130e17edbf161ffae8d247b7d929a6b9ffdcc08cfae19141014dc51d2430048dda5cdfdac64268789c4dd4bb39a5b277ef56e2
SSDEEP 768:WOG8sUAUnt88CFJDhmajMA7IILh6bCg/a:RGSAi8N456gCg/a
TLSH
T1C8D219410BB51573F7A94E307079AE224A767EA42E70E48F41B349DD1C69363BE3872B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

25:cc:a5:24:8b:f6:3f:d7:e8:f0:66:8a:50:51:b3:bc:7c:15:da:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Chains

Oct 25, 2012

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Serial Number

37:36:da:15:af:64:76:32:cc:e6:1c:d4:1b:65:77:dd

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 17, 2010 - Mar 29, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

Major OS version

Entry point

15169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcschr _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul memset wcsstr wcstol

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError CreateFileW GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpOpenRequestW HttpAddRequestHeadersW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$TEMP/ToolbarHelper.exe

IMPHASH 7b25d62fac6a93a74552bdc3dd699b98
SHA256 506946980ae3833a4108ea78504acc1e708b804e60cf6751757f20b69410002c
MD5 943f313974a830d4634c73beb8103f5e
SHA1 c58417722c0b741ea8d55d06914e692180900885
SHA512 7ec39c2f831f5ee45d69563ad306b5515f8795edfc06ffdb5a055c999e1c877a1935d43f40d065c69709a6abd33115d2dd857d166c88afe55708f9c3863c1843
SSDEEP 768:pTtvwGU8Sllhu26ujhzEA21SD+f7g/BGnpG/qWDNKFcp+LsWjcdtn87q2BTnepF9:5Ul7BjSws1QChcp+LsWjcd5dhpFuuH/
TLSH
T184835A0377E08076D4B64A715CB4CA625E3FBD229EB49C5777C4024E1E722D0AE26B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

77:f2:3d:cc:93:55:ab:6d:73:01:69:23:5b:cc:8c:e8:25:b7:8e:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Apr 4, 2013

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

5695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Conduit\RnD\Client\IE\Dev\6.12\6.12.0\ToolbarHelper\Release\ToolbarHelper.pdb

$_214_/$_214_/$_219_

IMPHASH 90e03e8777b94714012c80a85d64013c
SHA256 f22e58cdfe94d4a5fbbf2795a743b167ed9923e289e14654631e0077dd306c1d
MD5 6796f6e449f90a543dc3345538acc46f
SHA1 97bccd25561f44e9b13f05f6eef083c9ce9ba529
SHA512 f4402027bf1d40f550aab809b17f3bb8543ae76694d1a0ca429c6e1a0e2eacd835b81c4d8f13debed5c80e51c4214991ec8dba8f3a5731b8e5c8ff88e047685a
SSDEEP 12288:UCSztmLUkx5XDYSOmt+DbcA5fzQI9UsbmdcUyQTSrM9H/F99CcknD:BSzwLrXsEkDbcARzQI4d9TSrwF9UXD
TLSH
T119D47C203AE1947AE1BE1631D9A9A27CE5F6F5704870990B67E64B3D1F78503CA24F33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c8:67:06:bd:dd:30:be:07:b7:0a:17:03:74:44:05:a8

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

314447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Conduit\RnD\Client\IE\Dev\5.4\SingleComponent\Alert\Release\Alert.pdb

winmm

timeGetTime

user32

GetCapture ReleaseCapture GetIconInfo CopyRect CharLowerBuffA SetWindowTextW SetWindowRgn CreateDialogParamW DialogBoxParamW EnableWindow EndDialog SetLayeredWindowAttributes GetSysColor SystemParametersInfoW EnumChildWindows GetClassNameW SetCapture GetMonitorInfoA RegisterWindowMessageW DrawFocusRect GetDC ReleaseDC SetDlgItemTextW IsWindow GetDlgItem PostMessageA SetTimer KillTimer PostThreadMessageA DestroyWindow DefWindowProcA GetWindowLongA SendMessageA FindWindowW MonitorFromRect GetWindowTextW InflateRect GetAsyncKeyState IsWindowUnicode GetSystemMetrics IsChild SetWindowLongW CreateWindowExA DrawIconEx DispatchMessageW GetMessageA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetLastInputInfo SendMessageW PeekMessageA GetDesktopWindow ShowWindow FindWindowExW PostMessageW GetWindowRect GetClientRect SetForegroundWindow SetFocus TrackPopupMenu GetMenuItemCount InsertMenuItemW CreatePopupMenu DestroyMenu FindWindowExA LoadImageW DestroyIcon SetWindowsHookExA CallNextHookEx UnhookWindowsHookEx GetClassInfoW RegisterClassW GetWindowRgn SetWindowLongA CallWindowProcA GetParent BeginPaint EndPaint SetParent MoveWindow IsWindowVisible CreateWindowExW GetWindowLongW DefWindowProcW CallWindowProcW FillRect LoadCursorA SetCursor GetCursorPos ClientToScreen ScreenToClient OffsetRect PtInRect DrawTextW InvalidateRect SetWindowPos wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

urlmon

URLDownloadToFileW ObtainUserAgentString

kernel32

GetExitCodeThread CreateThread GetModuleFileNameW GetModuleHandleW GetTickCount FreeLibrary GetProcAddress LoadLibraryW GetCurrentThreadId TerminateThread CreateMutexW GetLastError ReleaseMutex CloseHandle InitializeCriticalSectionAndSpinCount GetLocaleInfoA CreateFileA ReadFile FindClose InterlockedExchange SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetStringTypeW GetStringTypeA LCMapStringA CreateFileW GetFileSize VirtualAlloc LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo FindFirstFileW CopyFileW RemoveDirectoryW MoveFileExW FindNextFileW QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount GetModuleFileNameA GetStdHandle ExitProcess HeapSize SetLastError InterlockedIncrement TlsFree GetFileType GetConsoleMode GetConsoleCP MoveFileW HeapReAlloc HeapAlloc GetCommandLineA ResumeThread ExitThread RaiseException IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind GetProcessHeap HeapFree GetLocalTime WriteFile CreateDirectoryW SystemTimeToFileTime SetFilePointer DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime TlsSetValue TlsGetValue TlsAlloc Sleep GlobalAlloc GlobalLock LoadLibraryA GlobalUnlock GetSystemTimeAsFileTime SizeofResource SetThreadPriority GetCurrentThread GetLongPathNameW GetModuleHandleA MultiByteToWideChar WideCharToMultiByte OutputDebugStringW LockResource LoadResource FindResourceW LocalFree LocalAlloc OpenProcess GetCurrentProcessId GetCurrentProcess GetVersionExA DeleteFileW SetFileAttributesW GetFileAttributesW TerminateProcess MulDiv lstrcpyW InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetComputerNameW GlobalFree

gdi32

CreateRectRgn GetBkMode GetBkColor GetPixel SetPixel PlgBlt SelectPalette RealizePalette GdiFlush OffsetRgn GetObjectA CombineRgn SetLayout GetDeviceCaps CreateFontIndirectW GetWindowOrgEx SetWindowOrgEx MoveToEx LineTo FrameRgn GetTextColor GetLayout SetTextColor SetBkColor CreateCompatibleDC CreateCompatibleBitmap ExcludeClipRect Rectangle BitBlt DeleteDC CreateSolidBrush CreatePen SelectObject RoundRect DeleteObject SetBkMode GetStockObject

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW Shell_NotifyIconW

ole32

IIDFromString CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoCreateGuid StringFromGUID2 CoInitialize CoUninitialize CLSIDFromString

oleaut32

VariantClear VariantInit SysAllocString SysFreeString SysStringLen VarBstrCmp SysAllocStringByteLen SysStringByteLen OleLoadPicture

psapi

GetProcessMemoryInfo

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent ord17

wininet

InternetCrackUrlW InternetOpenW InternetSetOptionW InternetOpenUrlW InternetCloseHandle InternetReadFile InternetCanonicalizeUrlA

crypt32

CryptQueryObject CertCloseStore CryptMsgClose CertFreeCertificateContext CertGetNameStringW CertGetNameStringA CertFindCertificateInStore CryptMsgGetParam

advapi32

RegDeleteValueW GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorA SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegCreateKeyW RegEnumValueW RegEnumKeyExW SetSecurityDescriptorSacl RegOpenKeyW RegEnumKeyW RegDeleteKeyW

$_69_

IMPHASH 7b25d62fac6a93a74552bdc3dd699b98
SHA256 506946980ae3833a4108ea78504acc1e708b804e60cf6751757f20b69410002c
MD5 943f313974a830d4634c73beb8103f5e
SHA1 c58417722c0b741ea8d55d06914e692180900885
SHA512 7ec39c2f831f5ee45d69563ad306b5515f8795edfc06ffdb5a055c999e1c877a1935d43f40d065c69709a6abd33115d2dd857d166c88afe55708f9c3863c1843
SSDEEP 768:pTtvwGU8Sllhu26ujhzEA21SD+f7g/BGnpG/qWDNKFcp+LsWjcdtn87q2BTnepF9:5Ul7BjSws1QChcp+LsWjcd5dhpFuuH/
TLSH
T184835A0377E08076D4B64A715CB4CA625E3FBD229EB49C5777C4024E1E722D0AE26B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

77:f2:3d:cc:93:55:ab:6d:73:01:69:23:5b:cc:8c:e8:25:b7:8e:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Apr 4, 2013

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

5695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Conduit\RnD\Client\IE\Dev\6.12\6.12.0\ToolbarHelper\Release\ToolbarHelper.pdb

$_88_

SHA256 8d13ef8869ddc60294df3b25666f98d6ad420448847c527dd1bc9409b6beae52
MD5 93e1926049461010e98e4b956b578a80
SHA1 bac61b39598c41e4ba4f1901d68d4d13d278e1cc
SHA512 583b19864c9d5cdf8d5e58bf4059dc46991fdffb81cd6812db2602bb44bee1d6d74fcc86aaf97f8929f7e561ab3c5461acd837106d362793f5fe178a4e5def63
SSDEEP 24576:M+cd8wqFZUc1QDW2n54DN9fD93+7GKzSmCOsH+m+B6TFQj68HUYKbFq2FzioXf:MBqEcyCGoBmG95Qj6oUYKbHWef
TLSH
T1B195D711F606C666DEA101F1E97DAA3F502F9A4E43B819C3D3B91D243D618D3AB39D0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2883135

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

817KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

474KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

299KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_89_

IMPHASH 7b25d62fac6a93a74552bdc3dd699b98
SHA256 506946980ae3833a4108ea78504acc1e708b804e60cf6751757f20b69410002c
MD5 943f313974a830d4634c73beb8103f5e
SHA1 c58417722c0b741ea8d55d06914e692180900885
SHA512 7ec39c2f831f5ee45d69563ad306b5515f8795edfc06ffdb5a055c999e1c877a1935d43f40d065c69709a6abd33115d2dd857d166c88afe55708f9c3863c1843
SSDEEP 768:pTtvwGU8Sllhu26ujhzEA21SD+f7g/BGnpG/qWDNKFcp+LsWjcdtn87q2BTnepF9:5Ul7BjSws1QChcp+LsWjcd5dhpFuuH/
TLSH
T184835A0377E08076D4B64A715CB4CA625E3FBD229EB49C5777C4024E1E722D0AE26B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

77:f2:3d:cc:93:55:ab:6d:73:01:69:23:5b:cc:8c:e8:25:b7:8e:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Apr 4, 2013

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

5695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Conduit\RnD\Client\IE\Dev\6.12\6.12.0\ToolbarHelper\Release\ToolbarHelper.pdb

Sharing

General

Malware Config

Signatures

File Explorer

338f6892bbea43b137fc805b8b3ff3940398d625b04871d2b1166eac60f46d59

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$TEMP/SPStub.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

PE Signature issue

msvcrt

kernel32

user32

wininet

comctl32

generic

$TEMP/ToolbarHelper.exe

PE Signature issue

kernel32

shell32

generic

$_214_/$_214_/$_219_

PE Signature issue

winmm

user32

version

urlmon

kernel32

gdi32

shell32

ole32

oleaut32

psapi

shlwapi

comctl32

wininet

crypt32

advapi32

generic

$_69_

PE Signature issue

kernel32

shell32

generic