cafdb3e479a50c8daf0de62ee5326dbe4166732296968bc2a9e2136d16c24019

Sharing

Copy URL

Twitter E-mail

General

Target

cafdb3e479a50c8daf0de62ee5326dbe4166732296968bc2a9e2136d16c24019
Size

262KB
MD5

66db18791ab568aaa31acd7b864c0c40
SHA1

27383607cd0339c9673dd890fab0a0ca45ffb92a
SHA256

cafdb3e479a50c8daf0de62ee5326dbe4166732296968bc2a9e2136d16c24019
SHA512

7cd682ff46b0a793ec4f8be5fee5b0ace1874fb2f5a0344f7251f0df749a93454ab497a62eb59e7359a3565d3a71c8538ae24ffcac90c5cca39d61dd096f3f8e
SSDEEP

6144:9lGBCnCXoCp6DrHlMYJl8/6KWddsBecrfcvgP0Kj6/Z4:9zCXSrnl8yKWQvjIZ

Score

N/A

Malware Config

Signatures

Files

cafdb3e479a50c8daf0de62ee5326dbe4166732296968bc2a9e2136d16c24019
.exe windows x64

0cc5032562bbfd300f47cd35f28f20c8

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:63:9c:bb:a3:67:b1:52:a5:05:b3:28:2d:df:ac:52:32:89:3d:4c
Signer

Actual PE Digest

26:63:9c:bb:a3:67:b1:52:a5:05:b3:28:2d:df:ac:52:32:89:3d:4c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

18/07/2012, 09:53
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

DdeCreateStringHandleW
DdeDisconnect
DdeGetLastError
DdeClientTransaction
DdeFreeStringHandle
DdeInitializeW
WaitForInputIdle
DdeConnect
DdeUninitialize

shell32

ShellExecuteExW

psapi

GetModuleFileNameExW

advapi32

RegQueryValueExA
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey

shlwapi

StrStrIW

ole32

CoInitialize
CoCreateInstance

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

version

GetFileVersionInfoSizeA
VerQueryValueA

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
CloseHandle
GetLongPathNameW
WideCharToMultiByte
GetProcAddress
OpenProcess
GetModuleFileNameW
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
Sleep
ExpandEnvironmentStringsW
GetVersionExA
GetLastError
CreateProcessW
GetFileAttributesW
FindClose
FindFirstFileW
GetWindowsDirectoryW
FreeLibrary
LoadLibraryA
GetWindowsDirectoryA
MultiByteToWideChar
lstrlenA
lstrcmpA
SetLastError
LoadLibraryW
lstrlenW
GetFileType
CreateFileA
LocalFree
GetSystemTime
FormatMessageW
GetCurrentThreadId
OutputDebugStringA
ReadFile
SetFilePointer
GetACP
WriteFile
GetFileSize
CreateFileW
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsGetValue
TlsSetValue
HeapAlloc
GetProcessHeap
HeapFree
OpenThread
TlsAlloc
TlsFree
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCurrentProcessId
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileSizeEx
SetFilePointerEx
DeviceIoControl
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetStartupInfoA
RaiseException
RtlPcToFileHeader
HeapReAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode

crypt32

CertGetCertificateContextProperty
CertGetNameStringW
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

!
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cc5032562bbfd300f47cd35f28f20c8

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

26:63:9c:bb:a3:67:b1:52:a5:05:b3:28:2d:df:ac:52:32:89:3d:4cSigner

Signature Validations

Verification

18/07/2012, 09:53 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

psapi

advapi32

shlwapi

ole32

wintrust

version

kernel32

crypt32

Sections

.text Size: 169KB - Virtual size: 168KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 8KB - Virtual size: 18KB

.pdata Size: 9KB - Virtual size: 9KB

! Size: 15KB - Virtual size: 15KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

26:63:9c:bb:a3:67:b1:52:a5:05:b3:28:2d:df:ac:52:32:89:3d:4c
Signer

18/07/2012, 09:53
Valid: false

.text
Size: 169KB - Virtual size: 168KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 8KB - Virtual size: 18KB

.pdata
Size: 9KB - Virtual size: 9KB

!
Size: 15KB - Virtual size: 15KB