1df1d02eee0d28cf6f471419cd1eaa32420c43ebea8d71de991f80094d72eb77

Sharing

Copy URL

Twitter E-mail

General

Target

1df1d02eee0d28cf6f471419cd1eaa32420c43ebea8d71de991f80094d72eb77
Size

842KB
MD5

5eca886ed5e9fb3cb47fc8ea918de530
SHA1

9374a009f88f5d5f3ec96f8b94be3346633b2bc3
SHA256

1df1d02eee0d28cf6f471419cd1eaa32420c43ebea8d71de991f80094d72eb77
SHA512

b71a20553476113cd9b8fa8ac7d0b4985ba2364eccfb9a1dc0ff984639b8b08017e751eff0e0c698cf63f893b5b4110683e94c0123077fd461cb37ddb59447b1
SSDEEP

12288:NAtUewT/2FmZ8vkPGHihL8yjas0jTjDqKJpNai8u4IHGeaaHLPeu3oX:P8vkgihL8yja7v9JpNF8BIHGedHL21X

Score

N/A

Malware Config

Signatures

Files

1df1d02eee0d28cf6f471419cd1eaa32420c43ebea8d71de991f80094d72eb77
.exe windows x86

4ccdafc9e7398fb3558960f428284336

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-03-2013 00:00

Not After

10-03-2016 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f9:92:1b:a3:fe:43:71:c5:0c:0b:b4:ec:91:1e:27:50:76:55:e8:24
Signer

Actual PE Digest

f9:92:1b:a3:fe:43:71:c5:0c:0b:b4:ec:91:1e:27:50:76:55:e8:24

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

26-12-2013 10:43
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
InterlockedIncrement
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetCurrentProcessId
GetTickCount
GetDriveTypeW
LoadLibraryW
GetWindowsDirectoryW
GetFileSize
TlsFree
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
ProcessIdToSessionId
FindClose
FindFirstFileW
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
ResumeThread
GlobalMemoryStatus
SystemTimeToFileTime
FileTimeToSystemTime
SetEnvironmentVariableW
OpenProcess
WritePrivateProfileSectionW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
QueryDosDeviceW
WideCharToMultiByte
AreFileApisANSI
ReadProcessMemory
Module32NextW
Module32FirstW
Process32NextW
Process32FirstW
GetPrivateProfileIntW
FindNextFileW
InterlockedCompareExchange
CreateDirectoryW
lstrlenA
DebugBreak
OutputDebugStringW
TlsSetValue
TlsGetValue
GetLongPathNameW
GetTempPathW
lstrcmpW
GetACP
GetExitCodeProcess
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ExpandEnvironmentStringsW
GetCommandLineW
CreateMutexW
TerminateProcess
MoveFileExW
GetPrivateProfileSectionW
GetTimeZoneInformation
SetFilePointer
DeviceIoControl
GetHandleInformation
CreateEventA
GetFileType
DuplicateHandle
DosDateTimeToFileTime
SetFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
LocalAlloc
UnlockFileEx
LockFileEx
GetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
GetPrivateProfileStringW
SetFilePointerEx
lstrcmpA
GetLocalTime
FormatMessageW
GetSystemTime
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetVersion
GetModuleHandleW
GetProcAddress
CreateMutexA
GetLastError
ReleaseMutex
RaiseException
CreateThread
CreateNamedPipeW
ConnectNamedPipe
EnterCriticalSection
LeaveCriticalSection
WriteFile
SetEvent
Sleep
WaitNamedPipeW
CreateFileW
ReadFile
InitializeCriticalSection
OutputDebugStringA
CloseHandle
DisconnectNamedPipe
WaitForSingleObject
TerminateThread
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapReAlloc
VirtualAlloc
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentThread
SetLastError
TlsAlloc
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WritePrivateProfileStringW
CreateProcessW
lstrlenW
InterlockedDecrement
GetFileAttributesExW
DeleteFileW
MoveFileW
CopyFileW
GetFileSizeEx
GetVersionExW
DeleteCriticalSection

user32

DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
SetTimer
MessageBoxW
SendMessageTimeoutW
FindWindowExW
LoadStringW
FindWindowW
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
LoadIconW
wvsprintfW
WaitForInputIdle
EnumThreadWindows
CharLowerBuffW
CharLowerW
ShowWindow
GetWindowRect
BringWindowToTop
SetForegroundWindow
SwitchToThisWindow
SetWindowPos
SystemParametersInfoW
GetSystemMetrics
WindowFromPoint

advapi32

InitializeSecurityDescriptor
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
IsValidSid
EqualSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
AllocateAndInitializeSid
SetEntriesInAclW
RegQueryValueExA
SetSecurityDescriptorDacl
FreeSid

shell32

ShellExecuteW
SHChangeNotify
ShellExecuteExW
Shell_NotifyIconW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString
VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathAddBackslashW
StrCmpNIW
SHDeleteKeyW
SHDeleteValueW
StrCmpNW
SHSetValueW
StrStrIW
PathAppendW
StrStrIA
PathFileExistsW
SHGetValueW

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

crypt32

CryptMsgOpenToDecode
CryptMsgUpdate
CertCloseStore
CryptMsgClose
CertGetNameStringW
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

Sections

.text
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ccdafc9e7398fb3558960f428284336

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f9:92:1b:a3:fe:43:71:c5:0c:0b:b4:ec:91:1e:27:50:76:55:e8:24Signer

Signature Validations

Verification

26-12-2013 10:43 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

version

crypt32

wintrust

Sections

.text Size: 456KB - Virtual size: 456KB

.rdata Size: 81KB - Virtual size: 80KB

.data Size: 7KB - Virtual size: 17KB

.rsrc Size: 296KB - Virtual size: 296KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f9:92:1b:a3:fe:43:71:c5:0c:0b:b4:ec:91:1e:27:50:76:55:e8:24
Signer

26-12-2013 10:43
Valid: false

.text
Size: 456KB - Virtual size: 456KB

.rdata
Size: 81KB - Virtual size: 80KB

.data
Size: 7KB - Virtual size: 17KB

.rsrc
Size: 296KB - Virtual size: 296KB