30f4efb3598948b5932433d25d5536cc2af1a25463813efe18e0b01c93abaf40

Sharing

Copy URL Twitter E-mail

General

Target

30f4efb3598948b5932433d25d5536cc2af1a25463813efe18e0b01c93abaf40
Size

373KB
MD5

83f145b3b5073a73cec9957fe3ea0701
SHA1

ec0dbb48170821f83ebadc495f0a31684850b5a2
SHA256

30f4efb3598948b5932433d25d5536cc2af1a25463813efe18e0b01c93abaf40
SHA512

c58d3310a008feea5783f6d0c99e7cb8db911ec78a67d0edb6acc7a553cef0a17e1f7e234404f92fed362c02698d9d93565ab7dc2e2d241736d19893a633d7b4
SSDEEP

6144:ieC+glHa+zfCZGZdYKmpJFbmf1IoG4Gca2mMBQcCn8:i39j6A5GcNzin8

Score

N/A

Malware Config

Signatures

Files

30f4efb3598948b5932433d25d5536cc2af1a25463813efe18e0b01c93abaf40
.dll windows x86

1a36b4cc7ac0f134db0a4a3dbef3d488

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/08/2010, 00:00

Not After

12/08/2013, 23:59

Subject

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

db:97:9d:c4:da:5c:d4:34:7e:9a:51:0d:d7:98:51:ef:49:df:b4:1f
Signer

Actual PE Digest

db:97:9d:c4:da:5c:d4:34:7e:9a:51:0d:d7:98:51:ef:49:df:b4:1f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

17/10/2012, 07:14
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetLocalTime
ExitProcess
TerminateProcess
GetCurrentProcess
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
GetProcAddress
InitializeCriticalSection
FatalAppExitA
SetConsoleCtrlHandler
GetTimeZoneInformation
IsBadWritePtr
RtlUnwind
InterlockedDecrement
InterlockedIncrement
CloseHandle
ReadFile
FlushFileBuffers
SetStdHandle
SetFilePointer
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sleep
LCMapStringA
LCMapStringW
CreateFileA
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetEndOfFile
GetLocaleInfoW
HeapAlloc
HeapReAlloc
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetCommandLineA
QueryPerformanceCounter
GetStdHandle
GetFileType
GetVersion
GetLastError
GetCurrentThreadId
VirtualAlloc
GetTickCount

user32

GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA

gdi32

GetObjectA
BitBlt
GetBitmapBits
SelectObject
DeleteDC
CreateDCA
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
CreateCompatibleDC

advapi32

ReportEventA
DeregisterEventSource
RegisterEventSourceA

Exports

Exports

RandomPseudoBytes
base64_decode
base64_encode
hash
hmac
symmetric_decrypt
symmetric_encrypt

Sections

.text
Size: 240KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a36b4cc7ac0f134db0a4a3dbef3d488

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4aCertificate

Extended Key Usages

Key Usages

db:97:9d:c4:da:5c:d4:34:7e:9a:51:0d:d7:98:51:ef:49:df:b4:1fSigner

Signature Validations

Verification

17/10/2012, 07:14 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 236KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 52KB - Virtual size: 58KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 19KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

db:97:9d:c4:da:5c:d4:34:7e:9a:51:0d:d7:98:51:ef:49:df:b4:1f
Signer

17/10/2012, 07:14
Valid: false

.text
Size: 240KB - Virtual size: 236KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 52KB - Virtual size: 58KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 19KB