553396d61c36d01084cd39eea956ac5dc51e1c3496ec4aad0276e3cc7e9caad4

Sharing

Copy URL Twitter E-mail

General

Target

553396d61c36d01084cd39eea956ac5dc51e1c3496ec4aad0276e3cc7e9caad4
Size

2.5MB
MD5

26f49f8b79437a6f33a8cf9d02df958d
SHA1

a48922378e90c5f5aecf99a0b77627b5f2fbc2d5
SHA256

553396d61c36d01084cd39eea956ac5dc51e1c3496ec4aad0276e3cc7e9caad4
SHA512

363a515123be34488775135bc3dfcb00bdd849db437b685ba96b79cbaaf2f32f18c3d53dd1dc24e407af3c26a2c34c0210ac6c00964e20804a460f00e714ff2f
SSDEEP

24576:bfN//cMF59JjT2aY58S0gcOV0m0sF7WRZ7TM8:bVcMF5PH2aY5B0pRZc8

Score

N/A

Malware Config

Signatures

Files

553396d61c36d01084cd39eea956ac5dc51e1c3496ec4aad0276e3cc7e9caad4
.exe windows x86

45789d9cdd253dcf2f9b41a180b21b5f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20/04/2006, 00:00

Not After

22/06/2009, 23:59

Subject

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

86:ca:c0:2d:3c:ca:ed:bb:12:ff:39:a9:a8:fc:65:c7:06:56:7e:20
Signer

Actual PE Digest

86:ca:c0:2d:3c:ca:ed:bb:12:ff:39:a9:a8:fc:65:c7:06:56:7e:20

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nero AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=LEGAL DEPARTMENT,O=Nero AG,L=Karlsbad,ST=Baden Wuerttemberg,C=DE

08/04/2009, 13:18
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetTickCount
HeapFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
HeapReAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteConsoleW
GetFileType
GetStdHandle
GetVolumeInformationA
GetTimeFormatA
GetDateFormatA
ExitProcess
SetStdHandle
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
LoadLibraryW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
LocalAlloc
GetFileSize
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualProtect
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcmpA
WritePrivateProfileStringA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetCurrentProcess
FindClose
GetCurrentDirectoryA
GetDriveTypeA
GetCommandLineA
GetTempPathA
CreateProcessA
GetFileTime
CreateFileA
GetUserDefaultLCID
SetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
SetLastError
FreeResource
GetSystemDefaultLangID
GetLocaleInfoA
lstrcpyA
GetWindowsDirectoryA
IsBadReadPtr
FormatMessageA
LocalFree
lstrcatA
WinExec
GetFileAttributesA
GetUserDefaultLangID
GetVersionExA
SetThreadLocale
GetModuleHandleA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetLongPathNameA
InterlockedExchange
CompareStringW
GetEnvironmentVariableA
CompareStringA
GetVersion
lstrlenW
lstrlenA
lstrcmpiA
CopyFileA
MoveFileA
GetExitCodeProcess
OutputDebugStringA
Sleep
CloseHandle
GetLastError
CreateMutexA
WaitForSingleObject
DeleteFileA
SetEnvironmentVariableA
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LoadLibraryA
FindFirstFileA
FreeLibrary
GetSystemTimeAsFileTime
GetProcAddress
InterlockedCompareExchange

user32

GetWindowPlacement
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetLastActivePopup
SetWindowContextHelpId
SetWindowPos
SetWindowsHookExA
CallNextHookEx
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
GetDlgItem
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DefWindowProcA
PostQuitMessage
SetFocus
CreateWindowExA
GetClassInfoExA
DispatchMessageA
TranslateMessage
GetWindowTextLengthA
GetMessageA
UpdateWindow
ShowWindow
SetForegroundWindow
BringWindowToTop
LoadImageA
LoadIconA
DrawIcon
wsprintfA
ExitWindowsEx
PostThreadMessageA
FindWindowA
GetTopWindow
SetWindowTextA
GetDlgCtrlID
GetWindowLongA
GetClassNameA
GetWindowTextA
IsWindowEnabled
IsDialogMessageA
MapDialogRect
GetWindow
KillTimer
GetCursorPos
SetWindowLongA
SetTimer
MessageBeep
CopyIcon
DestroyCursor
SetCursor
RedrawWindow
GetWindowRect
DrawFocusRect
InflateRect
SetRectEmpty
PtInRect
GetKeyState
WinHelpA
GetParent
IsChild
GetFocus
ScreenToClient
MoveWindow
PostMessageA
SendMessageA
WaitForInputIdle
GetDesktopWindow
GetSystemMetrics
SystemParametersInfoA
GetSysColor
EnableWindow
ReleaseCapture
IsWindowVisible
GetSysColorBrush
LoadCursorA
IsWindow
DestroyWindow
SetCapture
InvalidateRect
ReleaseDC
GetDC
GetClientRect
OffsetRect
SetRect
MessageBoxA
RegisterClipboardFormatA
DestroyMenu
UnregisterClassA
CharUpperA
GetNextDlgGroupItem
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableA
CharNextA
IsIconic
WindowFromPoint
RegisterWindowMessageA
SendDlgItemMessageA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetMessageTime
IntersectRect
MapWindowPoints
GetMenu
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
DestroyIcon
CallWindowProcA
GetMessagePos

gdi32

GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExtSelectClipRgn
DeleteDC
CreateSolidBrush
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
DeleteObject
SelectObject
GetTextExtentPointA
SetTextJustification
TextOutA
GetStockObject
GetObjectA
GetTextExtentPoint32A
CreateFontIndirectA
CreateFontA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

AdjustTokenPrivileges
RegEnumKeyA
RegQueryInfoKeyA
RegOpenKeyA
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
LookupPrivilegeValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegOpenCurrentUser
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA
SHFileOperationA

comctl32

ord17

shlwapi

PathIsDirectoryA
SHCopyKeyA
SHDeleteKeyA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathFileExistsA
PathIsUNCA

oledlg

ord8

ole32

CoCreateGuid
CoTaskMemFree
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitializeEx
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
OleFlushClipboard

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringByteLen
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
OleCreateFontIndirect
VariantClear

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

msi

ord103
ord124
ord17
ord8

Sections

.text
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

45789d9cdd253dcf2f9b41a180b21b5f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34Certificate

Extended Key Usages

Key Usages

86:ca:c0:2d:3c:ca:ed:bb:12:ff:39:a9:a8:fc:65:c7:06:56:7e:20Signer

Signature Validations

Verification

08/04/2009, 13:18 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

msi

Sections

.text Size: 480KB - Virtual size: 478KB

.rdata Size: 120KB - Virtual size: 116KB

.data Size: 32KB - Virtual size: 46KB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2a:6a:d4:4a:46:42:fb:73:94:2c:a2:b9:2d:eb:3d:34
Certificate

86:ca:c0:2d:3c:ca:ed:bb:12:ff:39:a9:a8:fc:65:c7:06:56:7e:20
Signer

08/04/2009, 13:18
Valid: false

.text
Size: 480KB - Virtual size: 478KB

.rdata
Size: 120KB - Virtual size: 116KB

.data
Size: 32KB - Virtual size: 46KB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB