General

Malware Config

Signatures

Files

• tmp

  .exe windows x86

  a2811931084b6dcda3f7edcb0d2009ac

  
  

  Code Sign

  04:00:00:00:00:01:2f:4e:e1:52:d7

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6e:48:2b:f8:48:a6:0c:84:94:77:f7:47:1b:54:23:10

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  20-11-2013 00:00

  Not After

  20-12-2015 23:59

  Subject

  CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Burntisland,ST=Midlothian,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

  Certificate

  Issuer

  CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

  Not Before

  17-11-2006 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  23-08-2013 00:00

  Not After

  23-09-2024 00:00

  Subject

  CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  f4:76:32:e1:4d:ee:62:74:2f:76:dd:40:37:33:f6:e4:a7:31:62:84

  Signer

  Actual PE Digest

  f4:76:32:e1:4d:ee:62:74:2f:76:dd:40:37:33:f6:e4:a7:31:62:84

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Burntisland,ST=Midlothian,C=GB

  30-01-2015 21:43

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  timeGetTime

  comctl32

  InitCommonControlsEx

  wininet

  InternetQueryOptionA

  InternetCloseHandle

  InternetOpenA

  HttpSendRequestA

  InternetErrorDlg

  HttpOpenRequestA

  InternetReadFile

  InternetCrackUrlA

  InternetConnectA

  InternetOpenUrlA

  HttpQueryInfoA

  winhttp

  WinHttpGetProxyForUrl

  WinHttpOpen

  WinHttpCloseHandle

  WinHttpGetIEProxyConfigForCurrentUser

  kernel32

  CompareStringA

  GetStringTypeW

  GetStringTypeA

  CreateFileA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  SetStdHandle

  GetLocaleInfoA

  LCMapStringW

  LCMapStringA

  GetCurrentProcessId

  MoveFileExA

  FreeLibrary

  GetCurrentProcess

  Sleep

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  GetVersion

  WaitForSingleObject

  SetEvent

  TerminateThread

  CreateEventA

  GetLastError

  CloseHandle

  lstrlenA

  FormatMessageA

  LocalAlloc

  CreateMutexA

  CompareStringW

  LocalFree

  CreateThread

  SetCurrentDirectoryA

  GetCurrentDirectoryA

  GlobalFree

  DeleteFileA

  GetExitCodeProcess

  CreateProcessA

  GetShortPathNameA

  GetVersionExA

  GetTickCount

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  HeapSize

  SetFilePointer

  GetOEMCP

  GetACP

  GetCPInfo

  ReadFile

  RtlUnwind

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  CreatePipe

  InitializeCriticalSection

  GetStartupInfoA

  GetFileType

  SetHandleCount

  InterlockedDecrement

  SetLastError

  InterlockedIncrement

  TlsFree

  ReleaseMutex

  FindNextFileA

  InterlockedExchange

  RaiseException

  HeapFree

  HeapAlloc

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  FindFirstFileA

  SetEndOfFile

  FindClose

  MoveFileA

  ExitProcess

  DuplicateHandle

  GetTimeFormatA

  GetDateFormatA

  GetDriveTypeA

  GetFullPathNameA

  GetTimeZoneInformation

  GetSystemTimeAsFileTime

  ExitThread

  GetCurrentThreadId

  MultiByteToWideChar

  EnterCriticalSection

  LeaveCriticalSection

  WideCharToMultiByte

  SetEnvironmentVariableA

  GetFileAttributesA

  CreateDirectoryA

  RemoveDirectoryA

  GetCommandLineA

  GetProcessHeap

  HeapReAlloc

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapDestroy

  HeapCreate

  VirtualFree

  DeleteCriticalSection

  VirtualAlloc

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  TlsGetValue

  TlsAlloc

  TlsSetValue

  user32

  SetTimer

  GetWindowRect

  KillTimer

  SetWindowPos

  GetDesktopWindow

  DestroyWindow

  GetMessageA

  PostThreadMessageA

  MonitorFromPoint

  LoadIconA

  SendMessageA

  GetMonitorInfoA

  TranslateMessage

  SetWindowLongA

  GetWindowLongA

  CreateWindowExA

  PeekMessageA

  DefWindowProcA

  GetCursorPos

  ShowWindow

  DispatchMessageA

  SystemParametersInfoA

  LoadCursorA

  ValidateRect

  RegisterClassA

  advapi32

  GetUserNameA

  Sections

  .text

  Size: 172KB - Virtual size: 168KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 48KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ