mailpv[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mailpv.exe
Size 110KB
Sample260913-allsfshr5w
SHA256 26a3395a4115355e897a7daf04551eba5e62da661d8dbae7c99205a2e74d24ba
MD5 782dd6152ab52361eba2bafd67771fa0
SHA1 5c5ff30a24a3858a8e9bd531dfef885d0b2a00c7
SHA512 a6d22daa93cf5eb2e57684bc0e3e0c177e4a4fe0cf9e072cab188a99178892eff92241ad6d94b20da487d88ce65f2a3ffc4d6a4dc293bf375d94fbc6b0449f53
SSDEEP 3072:1WSVGdlouHiwfXjObBBDTn991ix689w2KQik:1Wrdl9fzOzTna689V
TLSH
T186B36C4371E04472E5EE0A3035A66F729EF6B9321A358A0BD7B058477DF06E1ED2538B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

revoked_codesign

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
sample	MailPassView

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
mailpv.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
mailpv.exe

File Explorer

mailpv.exe

.exe 110KB

mailpv.exe

IMPHASH 54db291fe92057b8dcd2eca2f82f7be8
SHA256 26a3395a4115355e897a7daf04551eba5e62da661d8dbae7c99205a2e74d24ba
MD5 782dd6152ab52361eba2bafd67771fa0
SHA1 5c5ff30a24a3858a8e9bd531dfef885d0b2a00c7
SHA512 a6d22daa93cf5eb2e57684bc0e3e0c177e4a4fe0cf9e072cab188a99178892eff92241ad6d94b20da487d88ce65f2a3ffc4d6a4dc293bf375d94fbc6b0449f53
SSDEEP 3072:1WSVGdlouHiwfXjObBBDTn991ix689w2KQik:1Wrdl9fzOzTna689V
TLSH
T186B36C4371E04472E5EE0A3035A66F729EF6B9321A358A0BD7B058477DF06E1ED2538B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft MailPassView

Password recovery tool for various email clients
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1d:df:68:53:3a:4a:8f:29:c0:84:64:80:ef:dd:f3:0d:7b:59:8a:73:b6:a6:53:77:1f:6a:84:69:b1:5c:d7:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Jun 26, 2016

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

8c:8b:24:84:e3:e5:d1:15:8a:b3:8f:f2:e0:82:2c:77:63:a1:5b:43

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Jun 26, 2016

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2014 - Sep 12, 2019

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 30, 2016

Timespan

Mar 30, 2016 - Jun 30, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

72500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Projects\VS2005\mailpv\Release\mailpv.pdb

msvcrt

memmove wcschr wcslen wcsncmp _itoa _strlwr strncmp _mbsnbicmp _snprintf _mbsrchr __dllonexit _onexit _c_exit _exit _XcptFilter _cexit _strnicmp _acmdln __getmainargs _initterm _memicmp malloc strrchr _stricmp free modf memcmp strtoul ??3@YAXPAX@Z ??2@YAPAXI@Z memcpy sprintf _mbsicmp atoi _strcmpi strlen strcmp exit _adjust_fdiv wcsstr log _mbscmp strchr _purecall strncat abs strcat _ultoa strcpy memset __p__commode __p__fmode __set_app_type _controlfp _except_handler3 __setusermatherr

comctl32

CreateToolbarEx ImageList_Create ImageList_AddMasked ImageList_SetImageCount ord17 ImageList_ReplaceIcon ord6

rpcrt4

UuidFromStringA

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA GetModuleHandleA ExitProcess GetCurrentProcessId ReadProcessMemory GetCurrentProcess GetStdHandle GetPrivateProfileIntA EnumResourceNamesA WritePrivateProfileStringA GetComputerNameA GetFileSize CreateFileA GlobalUnlock GlobalLock GetTempPathA GlobalAlloc CloseHandle FindResourceA LoadResource EnumResourceTypesA SizeofResource LockResource DeleteFileA OpenProcess GetStartupInfoA GetPrivateProfileStringA MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsA LocalFree WriteFile GetPrivateProfileSectionA FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA FindFirstFileA FindNextFileA SetFilePointer GetLastError LoadLibraryExA GetFileAttributesA GetTempFileNameA FindClose FormatMessageA GetWindowsDirectoryA ReadFile GetVersionExA

user32

GetClassNameA TrackPopupMenu PostMessageA GetFocus DispatchMessageA DrawTextExA IsDialogMessageA GetMessageA TranslateMessage RegisterWindowMessageA PostQuitMessage GetWindowTextA GetMenuItemInfoA EnumChildWindows DestroyMenu GetDlgCtrlID DialogBoxParamA ShowWindow SetCursor LoadCursorA ChildWindowFromPoint GetSysColorBrush EndDialog GetDlgItem CreateWindowExA InvalidateRect SetDlgItemInt BeginPaint GetClientRect GetWindow SetDlgItemTextA DrawFrameControl GetDlgItemTextA SendDlgItemMessageA SetWindowTextA GetWindowRect GetSystemMetrics GetDlgItemInt DeferWindowPos EndPaint DefWindowProcA TranslateAcceleratorA MessageBoxA GetWindowPlacement RegisterClassA UpdateWindow SetMenu LoadAcceleratorsA SetWindowPos SendMessageA LoadIconA GetWindowLongA SetWindowLongA SetFocus BeginDeferWindowPos EndDeferWindowPos CheckMenuItem GetMenuItemCount SetClipboardData GetMenuStringA EnableWindow DestroyWindow GetCursorPos LoadImageA GetSysColor MapWindowPoints GetMenu CloseClipboard GetParent OpenClipboard GetDC EmptyClipboard MoveWindow GetSubMenu EnableMenuItem ReleaseDC LoadMenuA LoadStringA CreateDialogParamA ModifyMenuA

gdi32

GetDeviceCaps SetTextColor CreateFontIndirectA SetBkMode DeleteObject GetTextExtentPoint32A SetBkColor SelectObject

comdlg32

GetOpenFileNameA GetSaveFileNameA FindTextA

advapi32

RegEnumKeyA RegEnumKeyExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA GetUserNameA RegCloseKey

shell32

SHGetPathFromIDListA SHGetMalloc SHBrowseForFolderA ShellExecuteA

ole32

CoInitialize CoTaskMemFree CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

mailpv.exe

PE Signature issue

PE Signature issue

msvcrt

comctl32

rpcrt4

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic