sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

• The United Arab Emirates on Apr 28 2008
• Islamic Republic of Iran on Mar 1 2010
File sizes
The following file sizes have been seen:
• 1,153,536 bytes
• 991,232 bytes
• 975,872 bytes
1.3. Build dates
The build date PE header information of the malware uses fake date information for its files;
hence we cannot precisely identify the target system’s infection time. Nonetheless, the
SQLite related part of mssecmgr.ocx contains some build time info (more about the
components later):
“Unidentified build, Aug 31 2011 23:15:32 31...........Aug 31 2011
23:15:32”
The following string shows SQLite version information, found in the memory dumps:
2010-01-05 15:30:36 28d0d7710761114a44a1a3a425a6883c661f06e7 NULL
It relates to SQLITE_VERSION "3.6.22" (part of the source code)
Also, there is a reference “1.2.3”, and we think that this refers to zlib version number
possibly used in SQLite tables.
Some tables of the malware contain timestamps, possibly some of these do not relate to
actual running times, but instead some dates when the attackers developed or constructed
attack flows. An example is audcache.dat that contains timestamps like the ones below. We
are not sure about the timestamps’ function and about the table structure. There are other
binary strings that might be timestamps, but their values vary too much to be accurate.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 6