a6dafd08d896dce43a808287ef06147744c696ffe28b81fac40a1314d7c9f873

Sharing

Copy URL Twitter E-mail

General

Target

a6dafd08d896dce43a808287ef06147744c696ffe28b81fac40a1314d7c9f873
Size

559KB
MD5

41a1a7c46fff9ee8850fee5e8b2c3049
SHA1

97b70dd26bf50358568e693838dbe167b98e8e13
SHA256

a6dafd08d896dce43a808287ef06147744c696ffe28b81fac40a1314d7c9f873
SHA512

16d3736f2b9728c0baa9ab53c2baf88650e04977cf4c417dbf9e464dc617ce53e9a051400224b172c7bd87ca337588a1371f89305fecc371e66653548c9186e6
SSDEEP

6144:1T4Aqi6Qt+kLFGARDTcbwk0kU4WELEJmj86+bSgrqRHPtGHqVMSY:9qvRkRrRDxj4+JmmDuvtG0Y

Score

N/A

Malware Config

Signatures

Files

a6dafd08d896dce43a808287ef06147744c696ffe28b81fac40a1314d7c9f873
.exe windows x86

79bc48439b0f870d5b7c60501c5543dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:e9:4d:32:a3:a3:7a:25:2f:ba:7b:97:c9:23:f7:2e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19/05/2009, 00:00

Not After

18/05/2012, 23:59

Subject

CN=beijing qianxianghulian kejifazhan youxiangongsi,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=beijing qianxianghulian kejifazhan youxiangongsi,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

00:cb:4e:7b:e0:61:71:7a:79:98:3c:69:62:7c:c7:98:c6:6c:e1:6e
Signer

Actual PE Digest

00:cb:4e:7b:e0:61:71:7a:79:98:3c:69:62:7c:c7:98:c6:6c:e1:6e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=beijing qianxianghulian kejifazhan youxiangongsi,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=beijing qianxianghulian kejifazhan youxiangongsi,L=beijing,ST=beijing,C=CN

22/04/2010, 10:45
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetQueryOptionW
HttpAddRequestHeadersA
InternetQueryOptionA
HttpOpenRequestW
HttpOpenRequestA
InternetGetCookieW
InternetAttemptConnect
InternetConnectW
InternetOpenW
InternetCloseHandle
HttpSendRequestW
InternetReadFile
HttpQueryInfoW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpAddRequestHeadersW

kernel32

InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
FindResourceW
SetCurrentDirectoryW
GetCurrentDirectoryW
UnmapViewOfFile
GetModuleFileNameW
CloseHandle
GetCurrentThreadId
lstrlenW
GetLastError
lstrcmpiW
SizeofResource
LockResource
LoadResource
FindResourceExW
MulDiv
SetLastError
lstrcmpW
GlobalUnlock
GlobalLock
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
WideCharToMultiByte
OutputDebugStringW
GetCurrentThread
CreateMutexW
OpenMutexW
GlobalFree
GlobalHandle
GetACP
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
CreateFileW
GetFullPathNameW
GetFileAttributesW
CreateProcessW
DebugBreak
LocalFree
GetFileSize
ReadFile
LocalAlloc
ReadProcessMemory
VirtualQueryEx
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
ResumeThread
CreateProcessA
DisableThreadLibraryCalls
VirtualQuery
VirtualProtect
LeaveCriticalSection
InterlockedCompareExchange
SetThreadContext
GetThreadContext
SuspendThread
GetProcAddress
LoadLibraryA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
WriteFile
FatalAppExitA
HeapCreate
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
HeapSize
HeapReAlloc
HeapDestroy
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
SetHandleCount
GetFileType
ExitProcess
EnterCriticalSection
RaiseException
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
InterlockedDecrement
InterlockedIncrement
IsValidLocale
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetConsoleCtrlHandler
GetLocaleInfoW
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualAlloc
GetOEMCP

user32

UnregisterClassA
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetFocus
GetWindowTextLengthW
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
IsChild
SetCapture
RegisterWindowMessageW
CreateDialogIndirectParamW
MessageBoxW
PostMessageW
IsDialogMessageW
SystemParametersInfoW
SetPropW
EndDialog
LoadImageW
GetSystemMetrics
DialogBoxParamW
GetActiveWindow
GetFocus
InvalidateRgn
ReleaseDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
GetSysColor
PostQuitMessage
MapWindowPoints
MapDialogRect
GetParent
SetWindowContextHelpId
GetDlgItem
GetWindow
RedrawWindow
IsWindowVisible
InvalidateRect
GetWindowRect
SetWindowPos
SetWindowTextW
SendMessageW
CreateWindowExW
DestroyWindow
GetDesktopWindow
GetPropW
SetForegroundWindow
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
IsWindow
ShowWindow
BringWindowToTop
IsIconic
GetWindowLongW
SetWindowLongW
GetDC
GetWindowTextW

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC

advapi32

RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW

shell32

SHGetFileInfoW
ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize

oleaut32

LoadRegTypeLi
VarBstrCmp
LoadTypeLi
OleCreateFontIndirect
SysStringByteLen
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString

comctl32

InitCommonControlsEx

urlmon

CoInternetGetSession

Sections

.text
Size: 440KB - Virtual size: 436KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79bc48439b0f870d5b7c60501c5543dd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

5c:e9:4d:32:a3:a3:7a:25:2f:ba:7b:97:c9:23:f7:2eCertificate

Extended Key Usages

Key Usages

00:cb:4e:7b:e0:61:71:7a:79:98:3c:69:62:7c:c7:98:c6:6c:e1:6eSigner

Signature Validations

Verification

22/04/2010, 10:45 Valid: false

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

urlmon

Sections

.text Size: 440KB - Virtual size: 436KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 16KB - Virtual size: 25KB

.rsrc Size: 8KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5c:e9:4d:32:a3:a3:7a:25:2f:ba:7b:97:c9:23:f7:2e
Certificate

00:cb:4e:7b:e0:61:71:7a:79:98:3c:69:62:7c:c7:98:c6:6c:e1:6e
Signer

22/04/2010, 10:45
Valid: false

.text
Size: 440KB - Virtual size: 436KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 16KB - Virtual size: 25KB

.rsrc
Size: 8KB - Virtual size: 7KB