General

Malware Config

Signatures

Files

• afba65fa31b33f87ac385759ef3e3412f4ed99aa63e30d50479591fd30143a53

  .dll regsvr32 windows x86

  
  

  Code Sign

  04:00:00:00:00:01:23:9e:0f:ac:b3

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  28-01-1999 13:00

  Not After

  27-01-2017 12:00

  Subject

  CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  04:00:00:00:00:01:20:19:c1:90:66

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  18-03-2009 11:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  01:00:00:00:00:01:25:b0:b4:cc:01

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

  Not Before

  21-12-2009 09:32

  Not After

  22-12-2020 09:32

  Subject

  CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:00:00:00:00:01:2b:f2:4a:45:3e

  Certificate

  Issuer

  CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

  Not Before

  28-10-2010 09:07

  Not After

  28-10-2013 09:07

  Subject

  CN=BullGuard Ltd.,OU=IT,O=BullGuard Ltd.,L=Heathrow,ST=Middlesex,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:00:00:00:00:01:23:9e:0f:af:24

  Certificate

  Issuer

  CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

  Not Before

  22-01-2004 10:00

  Not After

  27-01-2017 10:00

  Subject

  CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  50:b2:e4:35:81:23:1b:46:28:cd:1a:9b:75:96:30:df:60:1a:3a:f4

  Signer

  Actual PE Digest

  50:b2:e4:35:81:23:1b:46:28:cd:1a:9b:75:96:30:df:60:1a:3a:f4

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=BullGuard Ltd.,OU=IT,O=BullGuard Ltd.,L=Heathrow,ST=Middlesex,C=GB

  18-05-2011 09:34

  Valid: true

  Chain 1

  CN=BullGuard Ltd.,OU=IT,O=BullGuard Ltd.,L=Heathrow,ST=Middlesex,C=GB

  CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Exports

  Exports

  DllRegisterServer

  Sections

  .text

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 492KB - Virtual size: 554KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ