0edb58f41291b480ba4ca54dd0af82c806c2078565024988a5e07b9ce33344ae

Sharing

Copy URL Twitter E-mail

General

Target

0edb58f41291b480ba4ca54dd0af82c806c2078565024988a5e07b9ce33344ae
Size

108KB
MD5

64e2ad275e1bc776d489c0a639cdea30
SHA1

f8d2775d3e721a2cd4f10b3ffe8969d05efb2db6
SHA256

0edb58f41291b480ba4ca54dd0af82c806c2078565024988a5e07b9ce33344ae
SHA512

bdfff25927e3dafb15d3e0c2f0bfbf1006332452e1ec4caf1847ac17dbad6b378c12cb01d08a2b3938d754672cc9015766632a516bf92335b400e17bc3288f81
SSDEEP

1536:hjlZcNOAxHVQ8xUI3ODto58B7YYgc6TTE4dmu2NCz5lDqdqrHU3isKldx:hxZcMAxHV7TqI89Tgy+mbNe5ledqoE9

Score

N/A

Malware Config

Signatures

Files

0edb58f41291b480ba4ca54dd0af82c806c2078565024988a5e07b9ce33344ae
.exe windows x86

57e5d898d86ffa019486545823bf0785

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:8b:5a:23:5d:ff:d1:6f:11:25:4a:38:34:2b:d0:46:d6:19:d2:ec
Signer

Actual PE Digest

48:8b:5a:23:5d:ff:d1:6f:11:25:4a:38:34:2b:d0:46:d6:19:d2:ec

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

25/11/2009, 10:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
OpenProcessToken
EqualSid
OpenThreadToken
RegCloseKey

kernel32

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
CloseHandle
GetCommandLineW
WaitForMultipleObjects
GetVersion
ExpandEnvironmentStringsW
MapViewOfFile
CreateFileMappingW
GetLastError
GetCurrentProcess
CancelWaitableTimer
SetWaitableTimer
UnmapViewOfFile
ReleaseMutex
SetEvent
WaitForSingleObject
CreateProcessW
GetCurrentThreadId
DuplicateHandle
CreateMutexW
CreateEventW
GetCurrentThread
CreateWaitableTimerW
SetPriorityClass
OpenEventW
GetModuleFileNameW
VirtualQuery
SetErrorMode
SetUnhandledExceptionFilter
HeapSetInformation
OpenProcess
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

msvcr90

_time64
wcschr
_wcsdup
free
wcstoul
_wcsicmp
memmove
iswspace
_wfopen_s
fclose
_wdupenv_s
_snwprintf_s
_wctime64
swprintf_s
memcpy_s
_wpgmptr
memset
memcpy
malloc
strncpy_s
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
_crt_debugger_hook
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
wcsncpy_s
fflush
vfwprintf
fwprintf
__iob_func
exit

mspdbcore

?FOpen@MREngine@@SGHPAPAU1@PAUMreToPdb@@HH@Z
?FOpenW@MREngine@@SGHPAPAU1@PBGAAJPAGIHH@Z
?open@NameMap@@SAHPAUPDB@@HPAPAU1@@Z
?OpenEx2W@PDB@@SAHPBGPBDJPAJPAGIPAPAU1@@Z
?OpenValidate4@PDB@@SAHPBGPBDPBU_GUID@@KKPAJPAGIPAPAU1@@Z
?CloseAllTimeoutPDB@PDB@@SAHXZ
?SetErrorHandlerAPI@PDB@@SAHP6APAUIPDBError@@PAU1@@Z@Z
?SetPDBCloseTimeout@PDB@@SAH_K@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?FOpen@MREngine@@SGHPAPAU1@PAUPDB@@PAUNameMap@@HH@Z

rpcrt4

RpcMgmtInqStats
NdrServerCall2
NdrClientCall2
RpcImpersonateClient
RpcRevertToSelf
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcBindingInqAuthClientW
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcMgmtStatsVectorFree

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

57e5d898d86ffa019486545823bf0785

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

48:8b:5a:23:5d:ff:d1:6f:11:25:4a:38:34:2b:d0:46:d6:19:d2:ecSigner

Signature Validations

Verification

25/11/2009, 10:13 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr90

mspdbcore

rpcrt4

Sections

.text Size: 85KB - Virtual size: 85KB

.data Size: 1KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

48:8b:5a:23:5d:ff:d1:6f:11:25:4a:38:34:2b:d0:46:d6:19:d2:ec
Signer

25/11/2009, 10:13
Valid: false

.text
Size: 85KB - Virtual size: 85KB

.data
Size: 1KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB