0315f61584b950fd9dfdf653892add1747d8bf4df3d68df1973fe0f317d7a513

Sharing

Copy URL Twitter E-mail

General

Target

0315f61584b950fd9dfdf653892add1747d8bf4df3d68df1973fe0f317d7a513
Size

261KB
MD5

57847583083b29073a52f821a0faa98b
SHA1

f708761649ef57f0586d6624d0045b3462eb7366
SHA256

0315f61584b950fd9dfdf653892add1747d8bf4df3d68df1973fe0f317d7a513
SHA512

2c9116a68b7d51ecaec3b27d13200f771f2cbfd401222b5f7eb2c58a203a214280b5ee7d3f41df6e35b3a61df4c08a0d039ec2c493a70d06d25a3e0900dd948e
SSDEEP

6144:qjmoL9SRLOmcSISgJv2fNKge1xi2Ex/YswOYedlJptMOYO2Lcv+A946:5+SxuSgJeIge1x8x/YVoJptM1O2+Tq6

Score

N/A

Malware Config

Signatures

Files

0315f61584b950fd9dfdf653892add1747d8bf4df3d68df1973fe0f317d7a513
.exe windows x86

c326a3739340136e922de8ec6dbe3521

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

17/02/2010, 00:00

Not After

05/03/2012, 23:59

Subject

CN=AVG Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:77:ea:78:69:ff:61:44:35:c8:51:5f:32:bb:16:4d:4b:32:03:25
Signer

Actual PE Digest

db:77:ea:78:69:ff:61:44:35:c8:51:5f:32:bb:16:4d:4b:32:03:25

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AVG Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies,L=Brno,ST=Jihomoravsky kraj,C=CZ

19/04/2010, 15:41
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

towlower
strncpy
_errno
strtod
_ecvt
_mbsrev
_strnicmp
time
localtime
_ultoa
_ltoa
strchr
wcscspn
wcsrchr
_wchdir
_chdir
wcstol
wcscat
wcsstr
wcschr
wcsncat
wcstok
_getcwd
_itow
_ltow
iswctype
_wcsnicmp
modf
floor
memmove
wcsncpy
sprintf
_splitpath
_snprintf
towupper
bsearch
_wtol
wcsncmp
_wsplitpath
wcspbrk
_heapmin
malloc
swprintf
free
_wtoi
wcscpy
wcscmp
_wcsicmp
swscanf
_snwprintf
wcslen
_wstat
_stat
_wfullpath
_fullpath
calloc

kernel32

GetPrivateProfileStringW
GetPrivateProfileStringA
GetSystemDirectoryW
WritePrivateProfileStringW
CreateFileW
OutputDebugStringW
GetSystemDirectoryA
CreateFileA
GetFileSize
MoveFileExA
LoadLibraryA
LocalAlloc
LocalLock
LocalUnlock
GetCurrentProcessId
GetProcessVersion
lstrlenW
GetCurrentThreadId
GetLastError
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleFileNameA
GetVersionExA
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetUserDefaultLCID
GetSystemDefaultLCID
FindClose
FindNextFileW
FindNextFileA
MoveFileA
DeleteFileA
GetTempPathA
GetTempFileNameA
GetDriveTypeW
SetErrorMode
GetWindowsDirectoryW
CloseHandle
GetCurrentDirectoryW
GetCurrentDirectoryA
FindFirstFileW
FindFirstFileA
GetCurrencyFormatA
GetNumberFormatA
GetTimeFormatA
GetDateFormatA
FreeResource
LockResource
LoadResource
FindResourceA
LocalFree
WritePrivateProfileStringA
GetModuleHandleA
VirtualAlloc
GetProcessHeap
GlobalAlloc
GetVersion

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
GetUserNameW
RegDeleteKeyW
RegDeleteKeyA
RegEnumKeyExW
RegEnumKeyExA
RegSetValueExW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExW

user32

wsprintfA
MessageBoxW
SetCursor
GetWindowTextLengthW
GetWindowTextLengthA
SetWindowTextW
SetWindowTextA
GetWindowTextW
GetWindowTextA
LoadStringW
SendMessageA
MessageBoxA
LoadCursorW
DialogBoxParamW
DialogBoxParamA
SetWindowLongA
EndDialog
GetWindowLongA
GetDlgCtrlID
SetFocus
IsWindowEnabled
EnableWindow
LoadCursorA
CharLowerW
ShowWindow
GetWindow
RegisterWindowMessageA
MoveWindow
ClientToScreen
GetClientRect
GetWindowRect
GetDesktopWindow
GetParent
SetWindowPos
DestroyWindow
CreateDialogParamW
CharToOemA
LoadStringA
SendMessageW
CharUpperW
GetDC
ReleaseDC

gdi32

GetTextExtentPointW

comdlg32

GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
GetSaveFileNameW

ws2_32

WSAGetServiceClassInfoW
WSAResetEvent
WSCDeinstallProvider
WSAEnumNameSpaceProvidersW
WPUCompleteOverlappedRequest
WSAAsyncGetHostByName
WSAInstallServiceClassW
WSACloseEvent
WSAAddressToStringW
WSAAsyncGetHostByAddr
WSASetEvent
gethostbyname
connect
WSACancelBlockingCall
send
closesocket
getsockopt

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c326a3739340136e922de8ec6dbe3521

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

db:77:ea:78:69:ff:61:44:35:c8:51:5f:32:bb:16:4d:4b:32:03:25Signer

Signature Validations

Verification

19/04/2010, 15:41 Valid: false

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

user32

gdi32

comdlg32

ws2_32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 230KB - Virtual size: 267KB

.rsrc Size: 3KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

db:77:ea:78:69:ff:61:44:35:c8:51:5f:32:bb:16:4d:4b:32:03:25
Signer

19/04/2010, 15:41
Valid: false

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 230KB - Virtual size: 267KB

.rsrc
Size: 3KB - Virtual size: 2KB