6ebd34016722a7604e4d67c2c6d0d64294896d425527504f8bcf737f5a5c7d9d

Sharing

Copy URL Twitter E-mail

General

Target

6ebd34016722a7604e4d67c2c6d0d64294896d425527504f8bcf737f5a5c7d9d
Size

538KB
MD5

4c9a6b02ee95ef5fe607e4af14bd243a
SHA1

0a27191cb0e9d38ba2f3524e2e75a0ea1633b975
SHA256

6ebd34016722a7604e4d67c2c6d0d64294896d425527504f8bcf737f5a5c7d9d
SHA512

12f654f3dc85dd585585bdfa2b6124dd10eb933226d1d6ad4e9c08b1abe64605e878b09b581ba692041ce9f512511ebfd29bf3877f6c1f4ae6604fb67a07d618
SSDEEP

12288:Eb4XJXtWtYGYw6VQyNR0Tx8Uky/CrEY70XgiHOtplxrOx:5XJdWdYw6VQyNR0+Uky/Cr70QiH+p3r0

Score

N/A

Malware Config

Signatures

Files

6ebd34016722a7604e4d67c2c6d0d64294896d425527504f8bcf737f5a5c7d9d
.exe windows x86

82ab9a9101dbbc217fa8d323cd3b7a23

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:d9:23:f1:69:59:74:b9:12:f1:fb:18:19:55:b9:f2:0c:80:6f:8c
Signer

Actual PE Digest

5e:d9:23:f1:69:59:74:b9:12:f1:fb:18:19:55:b9:f2:0c:80:6f:8c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/05/2011, 15:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

__dllonexit
_lock
_onexit
_unlock
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_decode_pointer
_amsg_exit

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

ppcore

_ShowSplashScreen@0
_PPMain@0

Exports

Exports

DllGetLCID

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

82ab9a9101dbbc217fa8d323cd3b7a23

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:b2:9b:00:00:00:00:00:15Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

5e:d9:23:f1:69:59:74:b9:12:f1:fb:18:19:55:b9:f2:0c:80:6f:8cSigner

Signature Validations

Verification

31/05/2011, 15:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

kernel32

ppcore

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 892B

.rsrc Size: 497KB - Virtual size: 496KB

.reloc Size: 36KB - Virtual size: 36KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:b2:9b:00:00:00:00:00:15
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

5e:d9:23:f1:69:59:74:b9:12:f1:fb:18:19:55:b9:f2:0c:80:6f:8c
Signer

31/05/2011, 15:52
Valid: false

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 892B

.rsrc
Size: 497KB - Virtual size: 496KB

.reloc
Size: 36KB - Virtual size: 36KB