The input sample is signed with a certificate issued by 'CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA' (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1 see report for more information)

Reads terminal service related keys (often RDP related)Īdversaries may target user email to collect sensitive information from a target.įound a potential E-Mail address in binary/memoryĪdversaries may communicate using a custom command and control protocol instead of using existing ] to encapsulate commands.Ĭontains indicators of bot communication commandsįound string 'GetBitmapBits' (Source:, API is part of module: GDI32.DLL)įound string 'GetObjectA' (Source:, API is part of module: GDI32.DLL)įound string 'SetBitmapBits' (Source:, API is part of module: GDI32.DLL)įound string 'RtlMoveMemory' (Source:, API is part of module: NTDLL.DLL)įound string 'GetTickCount' (Source:, API is part of module: KERNELBASE.DLL)įound string 'SendMessageA' (Source:, API is part of module: USER32.DLL)įound string 'LoadLibraryA' (Source:, API is part of module: KERNE元2.DLL)įound string 'LoadCursorA' (Source:, API is part of module: USER32.DLL)įound string 'GetThreadLocale' (Source:, API is part of module: KERNELBASE.DLL)įound string 'SetCursor' (Source:, API is part of module: USER32.DLL)įound string 'GetDiskFreeSpaceExA' (Source:, API is part of module: KERNELBASE.DLL)įound string 'DeleteFileA' (Source:, API is part of module: KERNELBASE.DLL)įound string 'GetTempPathA' (Source:, API is part of module: KERNE元2.DLL)įound string 'SetWindowPos' (Source:, API is part of module: USER32.DLL)įound string 'GetVersionExA' (Source:, API is part of module: KERNELBASE.DLL)įound string 'SetLayeredWindowAttributes' (Source:, API is part of module: USER32.DLL)įound string 'SetWindowLongA' (Source:, API is part of module: USER32.DLL)įound string 'GetWindowLongA' (Source:, API is part of module: USER32.DLL)įound string 'CreateEventA' (Source:, API is part of module: KERNELBASE.DLL)įound string 'WaitForMultipleObjects' (Source:, API is part of module: KERNE元2.DLL) Remote desktop is a common feature in operating systems. The input sample is signed with a certificate

Process injection is a method of executing arbitrary code in the address space of a separate live process.įound a string that may be used as part of an injection methodĬode signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Cdn1 ustream tv swf viewer