26073fbd852140640957dda1c1ab9dd79add27939f1b640e4f4a93eee178209d

Sharing

Copy URL

Twitter E-mail

General

Target

26073fbd852140640957dda1c1ab9dd79add27939f1b640e4f4a93eee178209d
Size

256KB
MD5

6d6548c1082d3a78342af95de17b8c67
SHA1

6fc330fa719ae91aaca6482dfe633eab6c33b4cd
SHA256

26073fbd852140640957dda1c1ab9dd79add27939f1b640e4f4a93eee178209d
SHA512

60af57afc9ecc54d7244719829f8fb732a4db7e50fc7270c5b086f487613bd727ef549ce55dacc236a9c6f6cbb15e5c784b6e949b6881484783ce16700298f2b
SSDEEP

6144:XeujK1hPk7Eh7mqE2Wd9kb6Wn6eBEH+BxHWNmuJ:P97gER86eBEH+qN9

Score

N/A

Malware Config

Signatures

Files

26073fbd852140640957dda1c1ab9dd79add27939f1b640e4f4a93eee178209d
.exe windows x86

7fc56897586cc418869b1b5dda0ba1dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:c3:09:c2:ed:0e:e4:35:09:fc:8b:d8:68:bc:4c:fd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

26-04-2006 00:00

Not After

31-05-2009 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Department of System Engineering,O=ShenZhen Thunder Networking Technologies Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3742
ord800
ord818
ord860
ord540
ord567
ord825
ord3663
ord3626
ord2414
ord4275
ord2152
ord6197
ord6880
ord2864
ord1641
ord3571
ord755
ord6172
ord5789
ord2753
ord640
ord5785
ord1640
ord323
ord1146
ord470
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord641
ord765
ord2514
ord2621
ord2982
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord1775
ord5280
ord4425
ord3597
ord324
ord4234
ord3402
ord3698
ord1168
ord2301
ord2302
ord4160
ord2863
ord2379
ord858
ord537
ord535
ord940
ord2915
ord6283
ord6282
ord6648
ord2764
ord3092
ord2818
ord6199
ord6215
ord538
ord2645
ord665
ord1979
ord5572
ord5442
ord3318
ord5186
ord354
ord6385
ord939
ord941
ord4129
ord809
ord556
ord1949
ord1088
ord2122
ord4284
ord3874
ord2754
ord6194
ord4333
ord3706
ord3797
ord4123
ord5875
ord5782
ord3089
ord1151
ord1193
ord816
ord2860
ord562
ord2370
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord1134
ord3619
ord1576

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_setmbcp
__CxxFrameHandler
_mbsnbicmp
__p___argv
__p___argc
_mbscmp
_mbschr
strstr
__dllonexit
_onexit
_exit
_XcptFilter
_controlfp

kernel32

GetModuleHandleA
GetWindowsDirectoryA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileSectionA
CreateProcessA
WaitForSingleObject
CloseHandle
GetStartupInfoA

user32

DrawIcon
IsIconic
SendMessageA
GetCursorPos
SetTimer
KillTimer
DestroyCursor
SetCursor
LoadCursorA
GetWindowLongA
UpdateWindow
MapWindowPoints
GetParent
GetSystemMenu
PtInRect
LoadIconA
EnableWindow
GetClientRect
LoadBitmapA
DrawIconEx
DrawTextA
InvalidateRect
GetWindow
GetWindowRect
DestroyIcon
GetSysColor
CopyIcon
AppendMenuA
GetSystemMetrics
LoadImageA

gdi32

GetTextExtentPoint32A
CreateRectRgnIndirect
CreateFontIndirectA
GetObjectA
CreateCompatibleDC
SetStretchBltMode
StretchBlt
SetBkMode
CreateFontA
GetStockObject

shell32

ShellExecuteA

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7fc56897586cc418869b1b5dda0ba1dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3d:c3:09:c2:ed:0e:e4:35:09:fc:8b:d8:68:bc:4c:fdCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

shell32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 652B

.rsrc Size: 16KB - Virtual size: 15KB

.tc Size: 204KB - Virtual size: 204KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3d:c3:09:c2:ed:0e:e4:35:09:fc:8b:d8:68:bc:4c:fd
Certificate

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 652B

.rsrc
Size: 16KB - Virtual size: 15KB

.tc
Size: 204KB - Virtual size: 204KB