04d4fa0f735284a6399d611fcf7a7648cd364a72a1ffc1a6635b26cf3176c660

Sharing

Copy URL Twitter E-mail

General

Target

04d4fa0f735284a6399d611fcf7a7648cd364a72a1ffc1a6635b26cf3176c660
Size

747KB
MD5

749b734cfc78201786a5dba418269561
SHA1

aea326af2d7aae7d77e0940871123d686250017d
SHA256

04d4fa0f735284a6399d611fcf7a7648cd364a72a1ffc1a6635b26cf3176c660
SHA512

7e0b31cc8ba0c1ef9bb2d2038f1fc8d62c4aa5a4282344894b4cfbe586220b4f696f0ff8f523f97b4c36ddf273e7d1f4c0f19f57d0f62cda2b1bfb07e9ccc877
SSDEEP

12288:qQIg9B5gYgqySKRErabiy+0PK5Fqw+SyrzapDD2z+lhQspJQAmDqjszvd3VgQTN:qQIg9B5Rg/pREWhKESyrrJEJ3szhh

Score

N/A

Malware Config

Signatures

Files

04d4fa0f735284a6399d611fcf7a7648cd364a72a1ffc1a6635b26cf3176c660
.exe windows x86

de534fe88655866fd24a7f5ef3badfdd

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/01/2012, 00:00

Not After

05/01/2015, 23:59

Subject

CN=AVG Technologies CZ\, s.r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies CZ\, s.r.o.,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:ad:88:78:94:1e:35:86:cf:49:65:fe:ba:96:7f:8d:95:c8:c2:de
Signer

Actual PE Digest

29:ad:88:78:94:1e:35:86:cf:49:65:fe:ba:96:7f:8d:95:c8:c2:de

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AVG Technologies CZ\, s.r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies CZ\, s.r.o.,L=Brno,ST=Jihomoravsky kraj,C=CZ

26/07/2012, 01:23
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memcpy
memmove
memset
_aulldiv
ZwClose
_alldiv
RtlNtStatusToDosError
ZwSetInformationProcess
ZwQueryVolumeInformationFile
ZwOpenFile
RtlEqualUnicodeString
_chkstk
ZwFsControlFile
LdrUnloadDll
LdrLoadDll
RtlInitUnicodeString
ZwWaitForSingleObject
ZwReadFile
LdrGetProcedureAddress
_allmul
RtlFreeUnicodeString
ZwCreateKey
RtlOpenCurrentUser
ZwDuplicateToken
RtlCreateSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAceEx
ZwQueryInformationToken
RtlEqualSid
RtlGetAce
ZwDeleteValueKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenKey
ZwEnumerateKey
ZwQueryKey
ZwDeleteKey
RtlInitAnsiString
LdrGetDllHandle
ZwWaitForMultipleObjects
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
ZwFlushBuffersFile
ZwSetInformationThread
ZwWriteFile
ZwCreateNamedPipeFile
ZwSetInformationFile
RtlCreateUnicodeString
ZwQueryInformationProcess
ZwOpenProcess
ZwCreateEvent
ZwCancelIoFile
ZwQueryInformationFile
ZwOpenThreadToken
ZwCreateFile
RtlTimeToTimeFields
_aullrem
RtlTimeFieldsToTime
ZwQueryVirtualMemory
ZwReadVirtualMemory
DbgPrint
_allrem
_stricmp
_strnicmp
_ftol
ZwTerminateProcess
ZwQueryInformationThread
ZwDelayExecution
ZwResumeThread
ZwTerminateThread
RtlRaiseException
ZwDuplicateObject
LdrShutdownThread
CsrClientCallServer
RtlCreateUserThread
RtlUpcaseUnicodeString
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlAnsiStringToUnicodeString
RtlOemStringToUnicodeString
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
_aullshr
ZwSetEvent
ZwResetEvent
RtlSystemTimeToLocalTime
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
ZwReleaseMutant
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwDeviceIoControlFile
RtlGetFullPathName_U
RtlQueryEnvironmentVariable_U
ZwQuerySystemInformation
RtlCopySid
RtlAddAccessDeniedAceEx
RtlAdjustPrivilege
RtlImpersonateSelf
RtlDestroyProcessParameters
RtlCreateUserProcess
RtlCreateProcessParameters
RtlGetCurrentDirectory_U
ZwQueryObject
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
RtlUpcaseUnicodeChar
RtlDosPathNameToNtPathName_U
RtlExpandEnvironmentStrings_U
RtlDestroyEnvironment
RtlSetEnvironmentVariable
RtlCreateEnvironment
ZwDisplayString
RtlUnwind
RtlReleasePebLock
RtlClearBits
RtlFindClearBitsAndSet
RtlAcquirePebLock
RtlAreBitsSet
_allshl
NtRaiseException

Sections

.text
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

de534fe88655866fd24a7f5ef3badfdd

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:caCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

29:ad:88:78:94:1e:35:86:cf:49:65:fe:ba:96:7f:8d:95:c8:c2:deSigner

Signature Validations

Verification

26/07/2012, 01:23 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

Sections

.text Size: 577KB - Virtual size: 577KB

.rdata Size: 95KB - Virtual size: 94KB

.data Size: 5KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 66KB - Virtual size: 66KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

29:ad:88:78:94:1e:35:86:cf:49:65:fe:ba:96:7f:8d:95:c8:c2:de
Signer

26/07/2012, 01:23
Valid: false

.text
Size: 577KB - Virtual size: 577KB

.rdata
Size: 95KB - Virtual size: 94KB

.data
Size: 5KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 66KB