General

Malware Config

Signatures

Files

• 2fa774cef59aeb96e93f4c542070bd87a5ca7204ab7887ca2144780a8bc6eb25

  .exe windows x86

  ad9870b6a98a1a0ef9173b8963e4c9b5

  
  

  Code Sign

  47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  10-05-2010 00:00

  Not After

  10-05-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  08-11-2006 00:00

  Not After

  07-11-2021 23:59

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageNetscapeServerGatedCrypto

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  61:0c:12:06:00:00:00:00:00:1b

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-05-2006 17:01

  Not After

  23-05-2016 17:11

  Subject

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  35:6e:db:c5:53:5c:4b:89:e5:6d:2c:cb:e0:e1:7d:7f

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  08-03-2011 00:00

  Not After

  28-02-2014 23:59

  Subject

  CN=Ashampoo GmbH & Co. KG,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ashampoo GmbH & Co. KG,L=Oldenburg,ST=Lower Saxony,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  d2:89:52:e9:05:a7:48:c5:b7:4b:be:c1:ec:52:43:b7:f5:0e:34:29

  Signer

  Actual PE Digest

  d2:89:52:e9:05:a7:48:c5:b7:4b:be:c1:ec:52:43:b7:f5:0e:34:29

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Ashampoo GmbH & Co. KG,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ashampoo GmbH & Co. KG,L=Oldenburg,ST=Lower Saxony,C=DE

  24-01-2013 13:46

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvbvm60

  __vbaR8FixI4

  ord583

  ord584

  _CIcos

  _adj_fptan

  __vbaVarMove

  ord585

  ord693

  __vbaFreeVar

  ord694

  ord587

  __vbaAryMove

  __vbaStrVarMove

  ord695

  ord588

  ord589

  __vbaFreeVarList

  _adj_fdiv_m64

  ord698

  __vbaR8Sgn

  ord516

  _adj_fprem1

  ord519

  ord628

  __vbaSetSystemError

  ord661

  __vbaHresultCheckObj

  ord663

  ord664

  _adj_fdiv_m32

  ord667

  __vbaAryDestruct

  ord591

  ord593

  ord594

  __vbaObjSet

  ord595

  __vbaOnError

  _adj_fdiv_m16i

  __vbaObjSetAddref

  _adj_fdivr_m16i

  ord598

  ord521

  _CIsin

  ord631

  ord632

  ord525

  __vbaChkstk

  EVENT_SINK_AddRef

  DllFunctionCall

  ord671

  ord672

  ord673

  _adj_fpatan

  __vbaLateIdCallLd

  ord676

  ord677

  ord678

  EVENT_SINK_Release

  __vbaUI1I2

  _CIsqrt

  EVENT_SINK_QueryInterface

  __vbaExceptHandler

  ord712

  ord606

  ord713

  _adj_fprem

  _adj_fdivr_m64

  ord608

  ord609

  __vbaFPException

  ord717

  __vbaStrVarVal

  __vbaDateVar

  __vbaI2Var

  ord536

  _CIlog

  ord646

  ord539

  __vbaErrorOverflow

  ord647

  __vbaNew2

  __vbaInStr

  __vbaVar2Vec

  _adj_fdiv_m32i

  _adj_fdivr_m32i

  ord574

  _adj_fdivr_m32

  _adj_fdiv_r

  ord685

  ord100

  ord687

  __vbaI4Var

  ord610

  __vbaInStrB

  __vbaVarDup

  __vbaR4Sgn

  ord614

  __vbaFpI4

  _CIatan

  __vbaStrMove

  ord540

  __vbaR8IntI4

  ord542

  ord543

  ord650

  _allmul

  __vbaLateIdSt

  ord544

  ord651

  ord545

  _CItan

  ord546

  ord547

  _CIexp

  __vbaFreeObj

  __vbaFreeStr

  ord581

  Sections

  .text

  Size: 136KB - Virtual size: 133KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ