5c12cbf5f347d39e995f62296b317bd2a8d6b6a30061ce97e7694fa32db9e425

Sharing

Copy URL Twitter E-mail

General

Target

5c12cbf5f347d39e995f62296b317bd2a8d6b6a30061ce97e7694fa32db9e425
Size

432KB
MD5

93f1f5cc2d8792bfb476ee1a27c734cc
SHA1

c4e80e5a4410957857b9fde3276418fd675bc03f
SHA256

5c12cbf5f347d39e995f62296b317bd2a8d6b6a30061ce97e7694fa32db9e425
SHA512

ec261cd55893826ab31d11ec51eb241202c73a1a272f16ed9cb3f4ba28e860cd6f1534764fa38ec0fd30b5948b200de587efc07fec720b672b4b543eaaab900a
SSDEEP

12288:rybaxCxPa0wmDgQgZip/HcGcS6/ac6dGP/JGMmkxW60rv+WWUDDn143Y:Ca6aTQR/8GPFVdGP/JGMmkxW60rv+WWo

Score

N/A

Malware Config

Signatures

Files

5c12cbf5f347d39e995f62296b317bd2a8d6b6a30061ce97e7694fa32db9e425
.dll windows x86

87d558a79f8902ea8449001e20b0606c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/11/2011, 00:00

Not After

13/11/2014, 23:59

Subject

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d3:fc:ed:38:ea:c5:0e:d6:6f:37:bc:d0:72:3b:9a:0d:55:39:a8:06
Signer

Actual PE Digest

d3:fc:ed:38:ea:c5:0e:d6:6f:37:bc:d0:72:3b:9a:0d:55:39:a8:06

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,OU=Digital ID Class 3 - Java Object Signing,O=Google Inc,L=Mountain View,ST=California,C=US

30/08/2012, 02:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
InterlockedExchangeAdd
DuplicateHandle
GetCurrentProcess
SetLastError
ReadFile
WriteFile
GetLastError
OpenProcess
GetCurrentProcessId
PeekNamedPipe
DisconnectNamedPipe
FlushFileBuffers
ConnectNamedPipe
SetNamedPipeHandleState
GetNamedPipeHandleStateW
CreateNamedPipeW
CreateFileW
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
SystemTimeToFileTime
ResumeThread
WaitForSingleObject
GetCurrentThreadId
ExitProcess
TerminateProcess
GetSystemTime
CreateEventW
SetEvent
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetFileInformationByHandle
GetProcAddress
GetModuleHandleW
GetCommandLineA
ExitThread
CreateThread
RaiseException
LCMapStringW
GetCPInfo
RtlUnwind
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
SetHandleCount
GetStartupInfoW
GetConsoleCP
GetConsoleMode
FreeLibrary
LoadLibraryW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetStringTypeW
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
WriteConsoleW
CreateFileA
CompareStringW
SetEnvironmentVariableA
GetTimeZoneInformation
SetEndOfFile
GetProcessHeap
CreateFileMappingW
MapViewOfFileEx
UnmapViewOfFile
VirtualFree
VirtualAlloc
FindNextFileW
FindClose

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime
timeEndPeriod

Exports

Exports

PPP_GetInterface
PPP_InitializeModule
PPP_ShutdownModule

Sections

.text
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87d558a79f8902ea8449001e20b0606c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70Certificate

Extended Key Usages

Key Usages

d3:fc:ed:38:ea:c5:0e:d6:6f:37:bc:d0:72:3b:9a:0d:55:39:a8:06Signer

Signature Validations

Verification

30/08/2012, 02:58 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winmm

Exports

Exports

Sections

.text Size: 311KB - Virtual size: 310KB

.rdata Size: 85KB - Virtual size: 85KB

.data Size: 8KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 20KB - Virtual size: 20KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

09:e2:8b:26:db:59:3e:c4:e7:32:86:b6:64:99:c3:70
Certificate

d3:fc:ed:38:ea:c5:0e:d6:6f:37:bc:d0:72:3b:9a:0d:55:39:a8:06
Signer

30/08/2012, 02:58
Valid: false

.text
Size: 311KB - Virtual size: 310KB

.rdata
Size: 85KB - Virtual size: 85KB

.data
Size: 8KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 20KB - Virtual size: 20KB