b6b9a6b75dba130e26f5993854bcafd7fae79162f890203a5eae067dd73a209f

Sharing

Copy URL Twitter E-mail

General

Target

b6b9a6b75dba130e26f5993854bcafd7fae79162f890203a5eae067dd73a209f
Size

125KB
MD5

6041ee5482523af1c021dc4a9dc3ff05
SHA1

d79f0b6649b9687fb8e594462888df6b25d8631c
SHA256

b6b9a6b75dba130e26f5993854bcafd7fae79162f890203a5eae067dd73a209f
SHA512

fb863b014a9889e97cbf4caa9035a5824715b93ff1b2d33675416c465332c5af83d5a5d361c6cd5673b01e1c792aab65933ce80b029b3636044bd6980d721ebf
SSDEEP

1536:cksj617AtNhlEB79DcM4ayRJ2hlpCoX2T1Yr9tT2wo86FrHU32:ujOcohWaWklAow1YjirZFoG

Score

N/A

Malware Config

Signatures

Files

b6b9a6b75dba130e26f5993854bcafd7fae79162f890203a5eae067dd73a209f
.exe windows x86

bc9dfac08cbdc86ac4c9050e67383718

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

84:c4:5d:35:4b:cd:94:4b:a4:a9:4f:10:dd:6b:ba:8a:77:b7:60:5e
Signer

Actual PE Digest

84:c4:5d:35:4b:cd:94:4b:a4:a9:4f:10:dd:6b:ba:8a:77:b7:60:5e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/05/2011, 03:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord583
_CIcos
_adj_fptan
__vbaStrI4
ord585
__vbaVarMove
ord693
ord587
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
ord588
ord697
__vbaFreeVarList
_adj_fdiv_m64
ord514
ord517
_adj_fprem1
ord519
__vbaStrCat
ord554
ord661
__vbaSetSystemError
ord662
__vbaHresultCheckObj
ord663
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
ord593
__vbaI4Abs
ord594
__vbaObjSet
ord595
_adj_fdiv_m16i
ord702
_adj_fdivr_m16i
ord703
ord704
ord705
__vbaFpR8
_CIsin
ord631
__vbaErase
__vbaChkstk
__vbaCyVar
EVENT_SINK_AddRef
__vbaStrCmp
__vbaAryConstruct2
__vbaI2I4
DllFunctionCall
ord673
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaUI1I2
ord601
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
ord714
__vbaFPException
__vbaStrVarVal
__vbaDateVar
ord537
ord538
_CIlog
ord539
__vbaErrorOverflow
__vbaInStr
ord648
__vbaVar2Vec
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
ord683
_adj_fdivr_m32
ord577
__vbaR8Var
_adj_fdiv_r
ord685
ord100
ord579
__vbaI4Var
ord610
ord611
__vbaAryLock
__vbaVarAdd
__vbaStrComp
__vbaVarDup
ord614
__vbaFpI4
__vbaVarCopy
__vbaR8IntI2
_CIatan
ord540
__vbaAryCopy
__vbaStrMove
ord541
_allmul
ord544
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc9dfac08cbdc86ac4c9050e67383718

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:b2:9b:00:00:00:00:00:15Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

84:c4:5d:35:4b:cd:94:4b:a4:a9:4f:10:dd:6b:ba:8a:77:b7:60:5eSigner

Signature Validations

Verification

14/05/2011, 03:12 Valid: false

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 88KB - Virtual size: 86KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 24KB - Virtual size: 21KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:b2:9b:00:00:00:00:00:15
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

84:c4:5d:35:4b:cd:94:4b:a4:a9:4f:10:dd:6b:ba:8a:77:b7:60:5e
Signer

14/05/2011, 03:12
Valid: false

.text
Size: 88KB - Virtual size: 86KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 24KB - Virtual size: 21KB