9b3d7e391ac928335503d7efbf71d5d0a4a92505ebf00cd44d5fb311907d8e29

Sharing

Copy URL Twitter E-mail

General

Target

9b3d7e391ac928335503d7efbf71d5d0a4a92505ebf00cd44d5fb311907d8e29
Size

123KB
MD5

04b7b76b94393d1e65d46bd2119d6aba
SHA1

7d9c6f84b4bea6d18f4535b301b0b4961788a9a5
SHA256

9b3d7e391ac928335503d7efbf71d5d0a4a92505ebf00cd44d5fb311907d8e29
SHA512

34c689b93a0c2054693406af8df3c08943a81d2d4642fcfb97a77fe6cba98c3ee751b16643cef0b1a29f7a1d8ad8b67ed52f6365d1f98de21f2db79b86843682
SSDEEP

1536:5kVxsCr5jJxsHf4JoEqlqC6gvBo+uCKEFXvxdqHsvgXCRj+j4YjQoXMTKYrkUw:chjLsHgaEq2OBo+uCX5ybXCRjvYjjKK

Score

N/A

Malware Config

Signatures

Files

9b3d7e391ac928335503d7efbf71d5d0a4a92505ebf00cd44d5fb311907d8e29
.exe windows x86

4227c4557a171e5e5c5c3d2d81fd32cb

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/11/2011, 00:00

Not After

13/11/2014, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:97:87:45:ae:8f:80:44:5c:06:2c:59:97:d0:73:68:b3:b5:47:86
Signer

Actual PE Digest

30:97:87:45:ae:8f:80:44:5c:06:2c:59:97:d0:73:68:b3:b5:47:86

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

28/06/2012, 09:28
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
GetCurrentThreadId
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
HeapFree
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
FindResourceA
LockResource
LoadLibraryA
GetProcAddress
TerminateProcess
GetCurrentProcess
LoadResource
FreeResource
InterlockedIncrement
TlsGetValue
TlsAlloc
EncodePointer
HeapDestroy
HeapCreate
GetModuleFileNameW
GetStdHandle
WriteFile
HeapAlloc
GetLastError
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
ExitProcess
DecodePointer
GetStringTypeW

user32

CloseClipboard
DestroyAcceleratorTable
GetSystemMenu
SetActiveWindow
GetMenuItemID
IsZoomed
GetSubMenu
GetFocus
IsClipboardFormatAvailable
GetParent
SetParent
FindWindowW
SetFocus
ModifyMenuW
GetMenu
SetRect
CreateAcceleratorTableA
ReleaseDC
EmptyClipboard
GetMenuState
LoadAcceleratorsA
SetMenu
GetActiveWindow
GetMenuItemCount
RemoveMenu
SetMenuDefaultItem
InsertMenuW
OpenClipboard
AdjustWindowRectEx
MessageBoxW
LoadImageA
SetClipboardData
FindWindowA
CopyRect
GrayStringA

gdi32

SetViewportExtEx
GetBitmapBits
SetBitmapBits
SetViewportOrgEx
CreateDIBSection
GetDIBits
ResetDCA
CreateRectRgnIndirect
RectInRegion
Rectangle
SetDIBits
ScaleViewportExtEx
GetBkColor
RectVisible
CreateDIBitmap
GetStockObject
OffsetViewportOrgEx
GetTextColor
RestoreDC

advapi32

RegDeleteValueW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
RegEnumKeyExW
RegOpenKeyA
FreeSid
RegEnumValueW
AllocateAndInitializeSid
LookupPrivilegeValueW
SetSecurityDescriptorDacl
RegDeleteKeyW
InitializeSecurityDescriptor
RegQueryInfoKeyW
EqualSid
RegEnumKeyW
GetTokenInformation
OpenThreadToken
OpenProcessToken

shell32

ShellAboutA
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExW
Shell_NotifyIconW
SHGetDesktopFolder

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4227c4557a171e5e5c5c3d2d81fd32cb

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70Certificate

Extended Key Usages

Key Usages

30:97:87:45:ae:8f:80:44:5c:06:2c:59:97:d0:73:68:b3:b5:47:86Signer

Signature Validations

Verification

28/06/2012, 09:28 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 52KB - Virtual size: 52KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

30:97:87:45:ae:8f:80:44:5c:06:2c:59:97:d0:73:68:b3:b5:47:86
Signer

28/06/2012, 09:28
Valid: false

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 52KB - Virtual size: 52KB