df7d480a19c017a54562284c95f49b4f2b23fb30578cc12b4a12eeb54b28e8c5

Sharing

Copy URL

Twitter E-mail

General

Target

df7d480a19c017a54562284c95f49b4f2b23fb30578cc12b4a12eeb54b28e8c5
Size

226KB
MD5

6ebbaa20ea5b959b43ea3fe5c457933f
SHA1

05ad68b175c1a7e9afe21af53daddda5bd7d8b6c
SHA256

df7d480a19c017a54562284c95f49b4f2b23fb30578cc12b4a12eeb54b28e8c5
SHA512

a179d662ccc1eac23ff0590ef65bb546e299dee6efff83daaecca9c476c899aff65e3ac5911e05f3140a3601b9326a0193c3c769da00ce28116bf535a84ddc10
SSDEEP

6144:aFtDCIAtqHbPxhlV1PUF3HPFY2iEUS6kegd/:uteD0HbphlV1PmPFY2iEUSvjd/

Score

N/A

Malware Config

Signatures

Files

df7d480a19c017a54562284c95f49b4f2b23fb30578cc12b4a12eeb54b28e8c5
.exe windows x86

cc699307641244679859fd48f5a0ffe9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20-07-2010 00:00

Not After

18-08-2011 23:59

Subject

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ad:9f:e2:58:85:95:2c:2d:d8:d3:3c:83:bc:7d:c6:20:b8:f4:0e:c4
Signer

Actual PE Digest

ad:9f:e2:58:85:95:2c:2d:d8:d3:3c:83:bc:7d:c6:20:b8:f4:0e:c4

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

18-07-2011 23:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
ExpandEnvironmentStringsA
GetProcessHeaps
LocalFree
LoadLibraryA
lstrcmpA
IsValidLocale
lstrlenW
GlobalAlloc
CreateMutexA
ReplaceFileA
LocalAlloc
CreateEventW
BeginUpdateResourceW
lstrcmpiA
GetExpandedNameA
GetSystemDefaultLangID
lstrcatA
GetTempFileNameW
GetSystemTime
Sleep
GlobalFindAtomA
lstrcmpW
FileTimeToSystemTime
GetCalendarInfoW
GetUserDefaultLCID
GetProcAddress
WaitForMultipleObjects
lstrcpynA
DeleteAtom
DuplicateHandle
WinExec
CreateMailslotW
GetStartupInfoW

user32

CharPrevW
TrackPopupMenu
GetKeyState
GetDlgItemTextW
CreateAcceleratorTableW
AppendMenuW
GetMenuItemID
CreateDialogIndirectParamA
LoadCursorA
SetMenu
DefWindowProcW
IsChild
SendMessageW
SetTimer
WaitForInputIdle
DestroyCursor
GetMessageA
CharUpperW
ShowCaret
CreateDesktopW
GetClassInfoExA
SetDlgItemTextA
InsertMenuItemW
InsertMenuA
WaitMessage
SetFocus
SetCapture
LoadIconA
IsIconic
SetActiveWindow
DefWindowProcA
SetWindowPos
keybd_event
LoadBitmapW
SetDlgItemTextW
CreatePopupMenu
CreateDesktopA
InvalidateRect
MonitorFromWindow

gdi32

CreateMetaFileA
UpdateICMRegKeyW
CreateEllipticRgn
CreateICW
GetEnhMetaFileW
GdiGetBatchLimit
TranslateCharsetInfo
CreateFontIndirectA
GetRasterizerCaps
SetEnhMetaFileBits
CreatePalette
CreateFontA
CreateColorSpaceW
CreateFontIndirectExA
CreateFontIndirectW
UpdateICMRegKeyA
CreateScalableFontResourceA
CreateRectRgn
CreateBrushIndirect

advapi32

RegQueryValueW
RegCreateKeyW
OpenBackupEventLogW
BackupEventLogA

shell32

SHBrowseForFolder
SHBrowseForFolderW
StrChrIA
Shell_NotifyIcon
FreeIconList
ShellExecuteW
SHGetDiskFreeSpaceExW
ExtractIconExA

comdlg32

LoadAlterBitmap
PageSetupDlgW
ReplaceTextW

opengl32

glGetPolygonStipple
glGetError
glCopyTexSubImage1D
glPointSize
glVertex4s

Sections

.CAUsi
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ztYhK
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CkOZ
Size: 4KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AnA
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uO
Size: 3KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bTEb
Size: 1024B - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KB
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Zb
Size: 11KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CgCF
Size: 1KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc699307641244679859fd48f5a0ffe9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

ad:9f:e2:58:85:95:2c:2d:d8:d3:3c:83:bc:7d:c6:20:b8:f4:0e:c4Signer

Signature Validations

Verification

18-07-2011 23:04 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

comdlg32

opengl32

Sections

.CAUsi Size: 5KB - Virtual size: 4KB

.ztYhK Size: 86KB - Virtual size: 85KB

.CkOZ Size: 4KB - Virtual size: 418KB

.AnA Size: 12KB - Virtual size: 12KB

.uO Size: 3KB - Virtual size: 31KB

.bTEb Size: 1024B - Virtual size: 379KB

.KB Size: 86KB - Virtual size: 85KB

.Zb Size: 11KB - Virtual size: 98KB

.CgCF Size: 1KB - Virtual size: 289KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

ad:9f:e2:58:85:95:2c:2d:d8:d3:3c:83:bc:7d:c6:20:b8:f4:0e:c4
Signer

18-07-2011 23:04
Valid: false

.CAUsi
Size: 5KB - Virtual size: 4KB

.ztYhK
Size: 86KB - Virtual size: 85KB

.CkOZ
Size: 4KB - Virtual size: 418KB

.AnA
Size: 12KB - Virtual size: 12KB

.uO
Size: 3KB - Virtual size: 31KB

.bTEb
Size: 1024B - Virtual size: 379KB

.KB
Size: 86KB - Virtual size: 85KB

.Zb
Size: 11KB - Virtual size: 98KB

.CgCF
Size: 1KB - Virtual size: 289KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1024B