f073a08e37ec3d8da7cddf1ecd31c01b61c12b5b1e21495798ff722865b29355

Sharing

Copy URL Twitter E-mail

General

Target

f073a08e37ec3d8da7cddf1ecd31c01b61c12b5b1e21495798ff722865b29355
Size

346KB
MD5

595126e88b41a9fe945a3afc177a8620
SHA1

bb5cd377d69e6aeef57471e33dcf148a3e9aab79
SHA256

f073a08e37ec3d8da7cddf1ecd31c01b61c12b5b1e21495798ff722865b29355
SHA512

d6f4a5348f07beb14a6552853a55ed38a01580f5a241063757964a6cf0d17e2b4aeea9372bc628744793f42551c7e5791f191cbb83e22949378eb482a511588a
SSDEEP

6144:ClIMtNriy3/2JyDufiWjHLVFw+dTKErrEeiT/BOMVHCecXBPf:Iv2JyafBLVO+dTKErrBI/BBdiBX

Score

N/A

Malware Config

Signatures

Files

f073a08e37ec3d8da7cddf1ecd31c01b61c12b5b1e21495798ff722865b29355
.exe windows x86

a5cd89afd387c394c15c5d4eee79c740

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:11:c9:16:51:54:68:a0:16:fe:d0:d0:14:88:e5:4b:d6:59:eb:e2
Signer

Actual PE Digest

ea:11:c9:16:51:54:68:a0:16:fe:d0:d0:14:88:e5:4b:d6:59:eb:e2

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/12/2013, 01:41
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
ConvertStringSidToSidW
CreateRestrictedToken
ConvertSidToStringSidW
EqualSid
GetSidIdentifierAuthority
EqualPrefixSid
LookupAccountSidW
OpenThreadToken
RegOpenCurrentUser
SetThreadToken
RegQueryValueExW
RevertToSelf
LookupAccountNameW

kernel32

LoadLibraryW
lstrcmpiW
SetEvent
ReleaseSemaphore
SetFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
FindResourceExW
GetLocaleInfoW
SetLastError
LocalAlloc
WideCharToMultiByte
Sleep
MultiByteToWideChar
MulDiv
FindResourceW
LoadLibraryExW
lstrlenW
FormatMessageW
GetExitCodeThread
WaitForMultipleObjects
CreateThread
CreateFileW
GetCommandLineW
InterlockedExchange
ExpandEnvironmentStringsW
GetEnvironmentVariableW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
FindFirstFileW
GetSystemDirectoryW
lstrcmpA
FileTimeToSystemTime
GetFileAttributesExW
CreateFileMappingW
SetEnvironmentVariableW
GetLocalTime
SetFilePointer
GetTickCount
HeapSetInformation
CompareStringW
CreateDirectoryW
RaiseException
MapViewOfFile
WaitForSingleObject
GetCurrentThreadId
DeleteFileW
WriteFile
GetVersionExA
UnmapViewOfFile
GetVersionExW
GetExitCodeProcess
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
HeapAlloc
GetProcessHeap
HeapFree
EnumResourceNamesW
EnumResourceLanguagesW
GetFileSizeEx
MapViewOfFileEx
EnumUILanguagesW
GetComputerNameW
GetCurrentThread
SystemTimeToFileTime
DebugBreak
SearchPathW
GetSystemDefaultUILanguage
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
GetVersion
LocalFree
GetNativeSystemInfo
GetFileAttributesW
GetModuleHandleW
GetProcAddress
GetUserDefaultUILanguage
FindClose
FreeLibrary
InterlockedDecrement
DeleteCriticalSection
CreateEventW
GetLastError
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
GlobalFree
CloseHandle
CreateProcessW

gdi32

SetBkColor
CreateFontIndirectW
GetTextMetricsW
DeleteDC
GetDeviceCaps
GetObjectW
IntersectClipRect
RestoreDC
SaveDC
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
CreateSolidBrush
SetTextColor
SetBkMode
ExtTextOutW
DeleteObject

user32

DefWindowProcW
CharNextW
DestroyWindow
PostQuitMessage
EnableMenuItem
DestroyMenu
GetWindowLongW
PostMessageW
SetWindowTextW
GetSystemMenu
MoveWindow
GetWindowRect
GetClientRect
UpdateWindow
ShowWindow
GetParent
GetDlgCtrlID
GetDlgItem
SetWindowPos
MapWindowPoints
SetForegroundWindow
GetWindow
GetSysColor
SetWindowLongW
EnumChildWindows
CreateDialogParamW
DialogBoxParamW
InvalidateRect
FillRect
DrawTextW
EndPaint
GetFocus
DrawIconEx
GetIconInfo
DrawFocusRect
DrawFrameControl
ReleaseDC
CallWindowProcW
PtInRect
BeginPaint
IsWindowEnabled
GetDC
SetRect
MsgWaitForMultipleObjects
DispatchMessageW
UnregisterClassA
SendMessageW
SystemParametersInfoW
PeekMessageW
GetSystemMetrics
TranslateMessage
GetMessageW
EndDialog
CreateWindowExW
SetFocus
EnableWindow
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
GetSysColorBrush
LoadIconW
InflateRect

msvcrt

__badioinfo
__pioinfo
_read
wcstombs
iswctype
wctomb
_fileno
realloc
bsearch
_wtol
wcstoul
wcsncmp
_purecall
localeconv
isxdigit
isleadbyte
_wcsnicmp
ungetc
__mb_cur_max
mbtowc
isdigit
memcpy
free
malloc
_controlfp
??1type_info@@UAE@XZ
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
calloc
_errno
__CxxFrameHandler
iswspace
wcsstr
wcsrchr
memmove
wcschr
_wcsicmp
_CxxThrowException
memset
_vsnwprintf

ole32

CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree

oleaut32

VariantChangeType
VariantClear
SysAllocString
VariantInit
SysStringLen
VarUI4FromStr
SysFreeString
SysStringByteLen

crypt32

CryptMsgGetParam
CryptDecodeObject
CryptQueryObject
CryptMsgClose

wintrust

WinVerifyTrust

shell32

ord680
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ShellExecuteW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ntdll

RtlUnwind

wininet

InternetSetCookieW
InternetGetCookieW

rpcrt4

UuidFromStringW
UuidToStringW
RpcStringFreeW
UuidCreate

comctl32

_TrackMouseEvent
ImageList_GetImageCount
ImageList_GetIcon

uxtheme

OpenThemeData
ord47

userenv

ExpandEnvironmentStringsForUserW

netapi32

NetUserGetLocalGroups
NetLocalGroupGetMembers
NetApiBufferFree

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a5cd89afd387c394c15c5d4eee79c740

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4cCertificate

Extended Key Usages

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

ea:11:c9:16:51:54:68:a0:16:fe:d0:d0:14:88:e5:4b:d6:59:eb:e2Signer

Signature Validations

Verification

04/12/2013, 01:41 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

crypt32

wintrust

shell32

version

ntdll

wininet

rpcrt4

comctl32

uxtheme

userenv

netapi32

Sections

.text Size: 215KB - Virtual size: 215KB

.data Size: 3KB - Virtual size: 13KB

.rsrc Size: 101KB - Virtual size: 101KB

.reloc Size: 24KB - Virtual size: 24KB

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

ea:11:c9:16:51:54:68:a0:16:fe:d0:d0:14:88:e5:4b:d6:59:eb:e2
Signer

04/12/2013, 01:41
Valid: false

.text
Size: 215KB - Virtual size: 215KB

.data
Size: 3KB - Virtual size: 13KB

.rsrc
Size: 101KB - Virtual size: 101KB

.reloc
Size: 24KB - Virtual size: 24KB