ec3f1fcd0c949090bba91e688a7f967ea38a53ef401f44e783a8ddf808e46825

Sharing

Copy URL Twitter E-mail

General

Target

ec3f1fcd0c949090bba91e688a7f967ea38a53ef401f44e783a8ddf808e46825
Size

136KB
MD5

4e6fc04d57cb4018fe0e562663f93021
SHA1

bdda646473fc54937189d4327a28c00d28c92003
SHA256

ec3f1fcd0c949090bba91e688a7f967ea38a53ef401f44e783a8ddf808e46825
SHA512

29f5a9c6a6c919c6182f69169511e525c1abc08c879da1f9befbb7577832b32650ad74ef216f7511fa46eb1ba0dee2f0e40510eb9d0cabc3bd482ba9d5704125
SSDEEP

3072:dTgzhr7zbz29UNZ0gOwchc6QHyB+hJAIT:GNj+M0gOwL6o3C

Score

N/A

Malware Config

Signatures

Files

ec3f1fcd0c949090bba91e688a7f967ea38a53ef401f44e783a8ddf808e46825
.exe windows x86

605212e171117433723c06eb504a2394

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

17/08/2009, 00:00

Not After

05/09/2012, 23:59

Subject

CN=IncrediMail Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=IncrediMail Ltd.,L=Tel-Aviv,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:2b:2c:22:84:4c:de:10:b0:92:a0:71:f3:4f:e6:7a:01:d7:ed:c7
Signer

Actual PE Digest

60:2b:2c:22:84:4c:de:10:b0:92:a0:71:f3:4f:e6:7a:01:d7:ed:c7

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IncrediMail Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=IncrediMail Ltd.,L=Tel-Aviv,ST=Israel,C=IL

17/10/2010, 15:37
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imlooku

ord204
ord1579
ord1586
ord1584
ord1606
ord909
ord952
ord1640
ord833
ord675
ord362
ord955
ord850
ord1532
ord1599
ord1603
ord1666
ord1371
ord1066
ord1067
ord1065
ord1561
ord650
ord546
ord430
ord1048
ord996
ord991
ord243
ord201
ord232
ord233
ord598
ord899
ord1689
ord1690
ord1691
ord1692
ord1693
ord1694
ord987
ord1327
ord263
ord1313
ord1031
ord632
ord970
ord1383
ord1384
ord1510
ord1703
ord1698
ord24
ord8
ord9
ord35
ord1369
ord521
ord336
ord581
ord1076
ord1533
ord760
ord1367
ord4
ord1340
ord219
ord314
ord1696
ord1306
ord1587
ord1585
ord1605
ord54
ord84
ord57
ord73
ord58
ord599
ord56

imlookexu

ord5
ord156
ord435
ord147
ord106
ord6
ord63
ord16
ord15
ord463
ord462
ord214

imutilsu

ord1802
ord51
ord605
ord1996
ord830
ord738
ord363
ord895
ord106
ord388
ord1781
ord675
ord1569
ord1359
ord695
ord1409
ord1350
ord1322
ord865
ord1702
ord1333
ord1356
ord65
ord1335
ord1336
ord1804
ord5
ord951
ord931
ord2258
ord1929
ord1481
ord86
ord314
ord1594
ord1596
ord31
ord1801
ord1809
ord72
ord1800
ord13
ord66
ord2266
ord874
ord1370
ord2063
ord1372
ord6

gdiplus

GdiplusShutdown
GdiplusStartup

mfc80u

ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord4475
ord2708
ord4301
ord2829
ord2725
ord2531
ord5209
ord5226
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord1049
ord6086
ord860
ord2895
ord1058
ord4256
ord4480
ord2856
ord5196
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord4179
ord5067
ord1899
ord5148
ord4238
ord1392
ord3940
ord1608
ord1611
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord5178
ord4743
ord709
ord501
ord1220
ord894
ord5558
ord3927
ord5484
ord6063
ord6061
ord776
ord774
ord1476
ord2261
ord1176
ord5711
ord1271
ord1785
ord5609
ord5524
ord3756
ord283
ord2155
ord1479
ord282
ord6700
ord6111
ord1472
ord2366
ord1299
ord2167
ord3051
ord5398
ord2468
ord630
ord266
ord280
ord3990
ord3032
ord2012
ord3050
ord265
ord385
ord631
ord2271
ord386
ord899
ord6278
ord5829
ord6171
ord745
ord6002
ord557
ord2121
ord3249
ord1178
ord1172
ord5316
ord6282
ord3082
ord4100
ord896
ord5327
ord6293
ord4255
ord4535
ord3590
ord3155
ord3204
ord1925
ord293
ord2311
ord870
ord1118
ord577
ord1079
ord764
ord2832
ord1198

msvcr80

__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memcpy_s
memset
__CxxFrameHandler3
_adjust_fdiv

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
DeleteFileW
CopyFileW
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
Sleep

user32

GetFocus
GetWindowRect
LoadBitmapW
RegisterWindowMessageW
EnableWindow
LoadIconW
GetClientRect
IsIconic
SendMessageW
DrawIcon
PostQuitMessage
GetSystemMetrics

shell32

SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString

sfttree_ix86_u_60

ord417
ord414
ord413
ord401
ord487
ord372
ord353
ord317
ord427
ord436
ord411
ord438
ord253
ord466
ord462
ord454
ord354
ord130
ord289
ord131
ord146
ord141
ord400
ord483

Exports

Exports

??0WindowlessFlashPlayer@@QAE@ABV0@@Z
??4WindowlessFlashPlayer@@QAEAAV0@ABV0@@Z
??_7WindowlessFlashPlayer@@6B@

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

yrdpomf
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

605212e171117433723c06eb504a2394

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

60:2b:2c:22:84:4c:de:10:b0:92:a0:71:f3:4f:e6:7a:01:d7:ed:c7Signer

Signature Validations

Verification

17/10/2010, 15:37 Valid: false

Headers

File Characteristics

Imports

imlooku

imlookexu

imutilsu

gdiplus

mfc80u

msvcr80

kernel32

user32

shell32

ole32

oleaut32

sfttree_ix86_u_60

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 67KB - Virtual size: 67KB

yrdpomf Size: - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

60:2b:2c:22:84:4c:de:10:b0:92:a0:71:f3:4f:e6:7a:01:d7:ed:c7
Signer

17/10/2010, 15:37
Valid: false

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 67KB - Virtual size: 67KB

yrdpomf
Size: - Virtual size: 4KB