General

Malware Config

Signatures

Files

• mamsi.def

  .dll regsvr32 windows x86

  821c9b8a15ae24ed76fef698cd97c226

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  16-07-2004 00:00

  Not After

  15-07-2014 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Not Before

  31-10-2007 00:00

  Not After

  24-11-2010 23:59

  Subject

  CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  69:2a:96:70:7d:fa:5f:a1:03:e6:6b:83:25:61:9c:c4:75:d2:7b:8b

  Signer

  Actual PE Digest

  69:2a:96:70:7d:fa:5f:a1:03:e6:6b:83:25:61:9c:c4:75:d2:7b:8b

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

  17-08-2010 03:33

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GlobalFree

  GlobalAlloc

  GetModuleHandleA

  VirtualProtect

  Exports

  Exports

  Chalcophanite

  Catalogistic

  Untraceried

  Emblazonment

  Waganda

  Ocelliferous

  Parasecretion

  DllUnregisterServer

  Senega

  Steadiment

  Sourbread

  Miniconjou

  Igniter

  Phenospermy

  Inheritress

  Congreve

  Iambographer

  Neoplasticism

  Kittysol

  Echeloot

  Immane

  DllRegisterServer

  Spiritualistically

  Restainable

  Mediolateral

  Nonumbilicate

  Heterochronistic

  Becrush

  Supercycle

  Haemogregarina

  Motivation

  Toffyman

  Hydrachna

  Corporosity

  Absinthismic

  Rial

  Circumnavigatory

  Fusate

  Unswarming

  Carolan

  Christianly

  Unendued

  Moonpenny

  Pondfish

  Transfigurement

  Esterification

  Typhlopid

  Gargol

  Pilosine

  Ichneumonidan

  Transmateriation

  Outlinear

  Sections

  .text

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 160B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7.4MB - Virtual size: 7.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ