d46794c08238494b82776a9a5f860e95d4d950de2384f27e7caa8365dbf5b4ae

Sharing

Copy URL Twitter E-mail

General

Target

d46794c08238494b82776a9a5f860e95d4d950de2384f27e7caa8365dbf5b4ae
Size

253KB
MD5

04541e256078499fb706efe05d0d9e56
SHA1

914741dbb26b29b46f2d0ba6df328152c17c4f6c
SHA256

d46794c08238494b82776a9a5f860e95d4d950de2384f27e7caa8365dbf5b4ae
SHA512

967aa6a78155e1f6f61605111f72d41f81d6ace15f70f4f3c89f55e68d1323670626ff3b362d95ae49bf524bf11fc655ff37706220d41284873735a4e5cb02e2
SSDEEP

6144:0nUyo1wtvJwuRVjrQnRZS8pRjnFYcxP2rferUj/V:0nZo1wPwuRZQRZlY4P2LeM9

Score

N/A

Malware Config

Signatures

Files

d46794c08238494b82776a9a5f860e95d4d950de2384f27e7caa8365dbf5b4ae
.exe windows x86

3f83defc9a1ea2dc0cef176b61e9bf6b

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/01/2010, 00:00

Not After

24/01/2012, 23:59

Subject

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f0:e8:3d:65:b0:9f:a3:08:73:12:77:6a:8e:77:e9:af:2c:4d:30
Signer

Actual PE Digest

1a:f0:e8:3d:65:b0:9f:a3:08:73:12:77:6a:8e:77:e9:af:2c:4d:30

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

07/05/2010, 16:02
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
TlsAlloc
CreateFileMappingA
GlobalGetAtomNameW
GetLongPathNameA
LoadLibraryA
lstrlenW
MulDiv
GetProcessHeap
GetModuleHandleW
VirtualAlloc

user32

SetWindowTextW
wsprintfA
SetCursorPos
ReleaseDC
ChildWindowFromPoint
ArrangeIconicWindows
CloseWindow
WinHelpA
SetWindowLongA
GetActiveWindow
RegisterWindowMessageA
WinHelpW
CharUpperA
TrackPopupMenuEx
GetCapture
ShowCursor
MessageBoxIndirectW
EnumDesktopsA
IsDlgButtonChecked
GetMenuItemCount
DefWindowProcA
EnumDesktopsW
InsertMenuW
GetDlgItemTextW
GetScrollPos
EnableWindow
GetClassInfoExA
GetMenuItemInfoW
GetDC
GetCaretPos
LoadIconW
ActivateKeyboardLayout
GetSysColor
LoadMenuW
CreateDesktopA
CascadeWindows
GetFocus
CreateDesktopW
DialogBoxParamA
DialogBoxParamW
SetCapture
SetDlgItemTextA
SendMessageW
DefDlgProcW
WaitForInputIdle

gdi32

GetGraphicsMode
DescribePixelFormat
CreateEnhMetaFileA
PaintRgn
GetTextMetricsA
GetTextFaceW
CloseFigure
ExcludeClipRect
LineTo
SetRectRgn
SetDCPenColor
GetMapMode
UnrealizeObject
GetSystemPaletteUse
GetLogColorSpaceA
Polyline
GetPath
PatBlt
SetICMMode

advapi32

RegEnumValueA
RegOpenKeyExA
RegQueryInfoKeyW
RegQueryValueA
RegRestoreKeyW
RegDeleteKeyA

oleaut32

VarI1FromDisp
VarUdateFromDate

opengl32

glRasterPos3dv
glGetLightfv
wglCreateLayerContext
glColor4ub
glTexCoord3dv
glPopAttrib
glAreTexturesResident
wglCreateContext
glRasterPos4iv
glTexCoord2d
glBegin

wininet

ShowClientAuthCerts
InternetSetOptionExA
IncrementUrlCacheHeaderData
FtpDeleteFileW
SetUrlCacheEntryInfoA

winmm

joyGetDevCapsA
mmioAscend
waveInStop
midiStreamStop
mciGetDeviceIDA
mciGetDeviceIDFromElementIDW

inetcomm

CreateNNTPTransport
MimeOleSetCompatMode
HrGetLastOpenFileDirectory
MimeOleGetExtContentType
EssContentHintDecodeEx
MimeOleGetInternat
MimeOleGetCodePageInfo
CreateSMTPTransport
MimeOleGetCertsFromThumbprints
MimeOleSetBodyPropA
MimeOleGetAllocator
MimeOleParseRfc822AddressW
MimeOleGetFileInfo

Sections

.KW
Size: 10KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.XDf
Size: 512B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.si
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tziiAv
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Dlwrbr
Size: 1024B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hqA
Size: 3KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.p
Size: 512B - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.YXQ
Size: 1024B - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.KbGRXU
Size: 1KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f83defc9a1ea2dc0cef176b61e9bf6b

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

1a:f0:e8:3d:65:b0:9f:a3:08:73:12:77:6a:8e:77:e9:af:2c:4d:30Signer

Signature Validations

Verification

07/05/2010, 16:02 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

oleaut32

opengl32

wininet

winmm

inetcomm

Sections

.KW Size: 10KB - Virtual size: 13KB

.XDf Size: 512B - Virtual size: 40KB

.si Size: 4KB - Virtual size: 3KB

.tziiAv Size: 2KB - Virtual size: 12KB

.Dlwrbr Size: 1024B - Virtual size: 21KB

.hqA Size: 3KB - Virtual size: 50KB

.p Size: 512B - Virtual size: 22KB

.YXQ Size: 1024B - Virtual size: 45KB

.KbGRXU Size: 1KB - Virtual size: 22KB

.rsrc Size: 221KB - Virtual size: 220KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

1a:f0:e8:3d:65:b0:9f:a3:08:73:12:77:6a:8e:77:e9:af:2c:4d:30
Signer

07/05/2010, 16:02
Valid: false

.KW
Size: 10KB - Virtual size: 13KB

.XDf
Size: 512B - Virtual size: 40KB

.si
Size: 4KB - Virtual size: 3KB

.tziiAv
Size: 2KB - Virtual size: 12KB

.Dlwrbr
Size: 1024B - Virtual size: 21KB

.hqA
Size: 3KB - Virtual size: 50KB

.p
Size: 512B - Virtual size: 22KB

.YXQ
Size: 1024B - Virtual size: 45KB

.KbGRXU
Size: 1KB - Virtual size: 22KB

.rsrc
Size: 221KB - Virtual size: 220KB