fc5ba7a59e3fcedb002ac4c52779b9598f0ab65df1ef466f819fadb2c40881ed

Sharing

Copy URL Twitter E-mail

General

Target

fc5ba7a59e3fcedb002ac4c52779b9598f0ab65df1ef466f819fadb2c40881ed
Size

687KB
MD5

5bbd1c393c992807677f9d18c80b6f2a
SHA1

f6181484691a4efe05e09c5bfb2028357b4d8cf5
SHA256

fc5ba7a59e3fcedb002ac4c52779b9598f0ab65df1ef466f819fadb2c40881ed
SHA512

5c2303cbbf49ae35a122911c0bd3967210e191164b86cd32eb50132fa845abf07ef1cee0a6d821617000ec8a81071a0f2b5a32a9b64baad7ff8216d6b07edcf0
SSDEEP

12288:Nk5aCSR3LClfOqzDxTyyfL844ZH+3lrI8w/ZUAfRqA:Nk5aC4bCl2qvxWk+Ui8GOAZv

Score

N/A

Malware Config

Signatures

Files

fc5ba7a59e3fcedb002ac4c52779b9598f0ab65df1ef466f819fadb2c40881ed
.exe windows x86

53688140e8222d42924dac33b67b02d4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b4:ae:50:6d:93:28:b9:4d:8f:f1:5d:aa:f3:14:5e:eb:50:2d:c1:8d
Signer

Actual PE Digest

b4:ae:50:6d:93:28:b9:4d:8f:f1:5d:aa:f3:14:5e:eb:50:2d:c1:8d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

10/07/2009, 19:15
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumKeyExW
RegCreateKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
RegDeleteValueW
GetTraceEnableFlags
RegisterTraceGuidsW
RegOpenKeyExW
UnregisterTraceGuids
RegSetValueExW
TraceEvent
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EncryptFileW
DecryptFileW
RegQueryValueExW

kernel32

SystemTimeToFileTime
GetLastError
FreeLibrary
MultiByteToWideChar
LeaveCriticalSection
lstrlenW
HeapSetInformation
SizeofResource
LoadResource
RaiseException
FindResourceW
GetModuleHandleW
InterlockedIncrement
LoadLibraryExW
GetProcAddress
InterlockedDecrement
GetSystemTime
LocalFree
FormatMessageW
LockResource
TryEnterCriticalSection
FindResourceExW
CloseHandle
GetCurrentThread
SetThreadAffinityMask
CreateEventW
SetEvent
Sleep
QueryPerformanceCounter
GetProcessAffinityMask
GetFullPathNameW
GetCurrentProcess
QueryPerformanceFrequency
GetFileAttributesExW
GetCurrentProcessId
DeleteCriticalSection
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
CreateThread
GetVersionExW
CompareStringW
LocalAlloc
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentThreadId
lstrcmpiW
GetModuleFileNameW
InitializeCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WaitForSingleObject
OutputDebugStringA
LoadLibraryW
SetLastError
GetSystemTimeAsFileTime
ResetEvent
FlushInstructionCache
GetVersion
GetFileAttributesW
GetModuleHandleA
GetExitCodeThread
ExpandEnvironmentStringsW
IsWow64Process
CreateProcessW
DeleteFileW
CreateFileW
GetTempFileNameW
GetTempPathW
SetFileAttributesW
MoveFileExW
DeviceIoControl
FindClose
BackupRead
BackupSeek
ReadFile
WriteFile
GetFileTime
GetProcessHeap
HeapFree
EnterCriticalSection
GetTickCount
SetFileTime
LoadLibraryA
RemoveDirectoryW

gdi32

DeleteObject

user32

GetClassInfoExW
LoadCursorW
IsWindow
CreateWindowExW
CharNextW
MessageBoxW
CallWindowProcW
PostMessageW
GetSystemMetrics
DestroyIcon
LoadImageW
GetActiveWindow
RegisterClassExW
GetWindowLongW
SetWindowLongW
UnregisterClassA
PeekMessageW
TranslateMessage
DispatchMessageW
SendMessageW
MsgWaitForMultipleObjects
DestroyWindow
DefWindowProcW

msvcr80

wcsrchr
swscanf_s
wcsstr
_beginthreadex
swprintf_s
_wcslwr_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_CxxThrowException
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_cexit
__wgetmainargs
_amsg_exit
memset
calloc
_wutime32
memmove_s
_vscwprintf
vswprintf_s
memcpy_s
_purecall
malloc
memmove
_recalloc
wcsncpy_s
free
_vsnwprintf
wcstok_s
__CxxFrameHandler3
memcpy
_exit

shell32

SHCreateShellItem
ord75
ord155
SHBindToParent
CommandLineToArgvW
SHParseDisplayName

ole32

CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoInitialize
CoUninitialize
PropVariantClear
CLSIDFromString

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysStringLen

gdiplus

GdipCloneBitmapAreaI
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipFree
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipAlloc

shlwapi

PathIsFileSpecW
SHRegEnumUSValueW
AssocQueryStringW
SHRegGetUSValueW
SHRegOpenUSKeyW
SHRegCloseUSKey
AssocGetPerceivedType
StrStrW
PathIsDirectoryEmptyW
UrlUnescapeW
ord158
PathRemoveFileSpecW
PathIsRelativeW
PathFindExtensionW
PathRenameExtensionW
SHStrDupW
PathFileExistsW
PathFindFileNameW

wlxphotobase

?Delete@BasePrivate@@YAXPAX@Z
?BaseAtlThrow@ATL@@YGXJ@Z
?New@BasePrivate@@YAPAXI_N@Z
??1Exception@Base@@UAE@XZ
?IsVistaOrGreater@OS@Base@@YG_NXZ
?GetBaseStringManager@String@Base@@SGAAVCAtlStringMgr@ATL@@XZ
?ThrowLastError@Base@@YGXXZ
?Throw@Base@@YGXJ@Z

wlxphotosqm

?AddToStream@Sqm@@YGXKPBVTuple@1@@Z
?Startup@Sqm@@YGXXZ
?Shutdown@Sqm@@YGXXZ

metadatasys

WLXPSGetItemPropertyHandler

msi

ord90

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53688140e8222d42924dac33b67b02d4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

b4:ae:50:6d:93:28:b9:4d:8f:f1:5d:aa:f3:14:5e:eb:50:2d:c1:8dSigner

Signature Validations

Verification

10/07/2009, 19:15 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcr80

shell32

ole32

oleaut32

gdiplus

shlwapi

wlxphotobase

wlxphotosqm

metadatasys

msi

Sections

.text Size: 111KB - Virtual size: 110KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 403KB - Virtual size: 402KB

.reloc Size: 11KB - Virtual size: 10KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

b4:ae:50:6d:93:28:b9:4d:8f:f1:5d:aa:f3:14:5e:eb:50:2d:c1:8d
Signer

10/07/2009, 19:15
Valid: false

.text
Size: 111KB - Virtual size: 110KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 403KB - Virtual size: 402KB

.reloc
Size: 11KB - Virtual size: 10KB