c8f47f93cde227b88394d65b59d6e4b5c4c1f9056e1f9a61732d2af6091d6706

Sharing

Copy URL Twitter E-mail

General

Target

c8f47f93cde227b88394d65b59d6e4b5c4c1f9056e1f9a61732d2af6091d6706
Size

25KB
MD5

05a47a156362cc92e6aeaca6267adbd0
SHA1

43c03e848a588b8c98c7e2f67b1d20918e2a563d
SHA256

c8f47f93cde227b88394d65b59d6e4b5c4c1f9056e1f9a61732d2af6091d6706
SHA512

38a9f58476bbc0538c2c6d13c865fb9450f476ed3527c55ca7d5c01a2c302fe197bcf1c6f47f7dc2bccf908b3db1e18091109dc120a066f6eaed9238f346aa95
SSDEEP

768:7l3eVLR06ToEXZ3QbxOWRLWabC3EisKl4q3V:ZmVfToUZ3QlOWRaiCUisKld3V

Score

N/A

Malware Config

Signatures

Files

c8f47f93cde227b88394d65b59d6e4b5c4c1f9056e1f9a61732d2af6091d6706
.exe windows x86

2382f96b3d2402ff7394cb8af2ec9888

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:ea:45:6d:d0:a9:c3:b3:a0:dd:7b:d8:60:de:0b:55
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

27/07/2009, 00:00

Not After

29/07/2012, 23:59

Subject

CN=HUAWEI Technologies Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HUAWEI Technologies Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:05:0e:27:02:7b:a2:f5:11:bd:10:df:4b:cc:3b:64:02:2d:b0:b6
Signer

Actual PE Digest

05:05:0e:27:02:7b:a2:f5:11:bd:10:df:4b:cc:3b:64:02:2d:b0:b6

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=HUAWEI Technologies Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=HUAWEI Technologies Co.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

10/03/2011, 08:56
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringW
LoadLibraryW
GetProcAddress
FreeLibrary
WaitNamedPipeW
SetLastError
CreateFileW
GetLastError
CloseHandle
ReadFile
OutputDebugStringA
WriteFile
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime

msvcr80

?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_exit
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__set_app_type
_XcptFilter
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_lock
_cexit
__wgetmainargs
_amsg_exit
?what@exception@std@@UBEPBDXZ
sprintf
atoi
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_crt_debugger_hook
__CxxFrameHandler3
_CxxThrowException
memset

msvcp80

?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2382f96b3d2402ff7394cb8af2ec9888

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

78:ea:45:6d:d0:a9:c3:b3:a0:dd:7b:d8:60:de:0b:55Certificate

Extended Key Usages

Key Usages

05:05:0e:27:02:7b:a2:f5:11:bd:10:df:4b:cc:3b:64:02:2d:b0:b6Signer

Signature Validations

Verification

10/03/2011, 08:56 Valid: false

Headers

File Characteristics

Imports

kernel32

msvcr80

msvcp80

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 12KB - Virtual size: 12KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

78:ea:45:6d:d0:a9:c3:b3:a0:dd:7b:d8:60:de:0b:55
Certificate

05:05:0e:27:02:7b:a2:f5:11:bd:10:df:4b:cc:3b:64:02:2d:b0:b6
Signer

10/03/2011, 08:56
Valid: false

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 12KB - Virtual size: 12KB