ff188144cf2d88df7a387d9e309bf59e9e8bdf329a06a231b2a5d03b9199157c

Sharing

Copy URL

Twitter E-mail

General

Target

ff188144cf2d88df7a387d9e309bf59e9e8bdf329a06a231b2a5d03b9199157c
Size

1022KB
MD5

754d5997a2d49c95160fb92daf79142f
SHA1

acf09b2c2f93144439a9fa4748946c2acc1b5abd
SHA256

ff188144cf2d88df7a387d9e309bf59e9e8bdf329a06a231b2a5d03b9199157c
SHA512

89bfd08b0f6f5b6fe5c8d89b3273124bc43845b98377db1df9cb4ecb7493718c64631c017dd4b406ea7f0acb261e566d722646c107f0d650cbbf73a0df92f366
SSDEEP

24576:XQm5H4SK2Fq/JRt2axaWi4JRIAnBn/Pj60s2Yz:XQt2r4JRlxr60s2Yz

Score

N/A

Malware Config

Signatures

Files

ff188144cf2d88df7a387d9e309bf59e9e8bdf329a06a231b2a5d03b9199157c
.exe windows x86

9accbd1f9998766ed04e58f4922a2733

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3d:7b:7e:4f:14:bb:04:bf:34:c2:66:86:a6:1a:bd:a0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/09/2012, 00:00

Not After

10/10/2015, 23:59

Subject

CN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:b0:0a:76:b6:7c:fd:58:16:c5:f3:38:5b:fd:d6:52:d4:1b:a8:f3
Signer

Actual PE Digest

58:b0:0a:76:b6:7c:fd:58:16:c5:f3:38:5b:fd:d6:52:d4:1b:a8:f3

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=LogMeIn\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=LogMeIn\, Inc.,ST=Massachusetts,C=US

19/10/2012, 16:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

ws2_32

WSACleanup
WSAStartup
socket
WSASetLastError
closesocket
sendto
send
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
setsockopt
connect
getservbyport

kernel32

GetProcAddress
LoadLibraryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetLocalTime
WaitForMultipleObjects
ReleaseMutex
OutputDebugStringA
OutputDebugStringW
DeleteCriticalSection
SetEvent
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetFilePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
SetThreadPriority
GetCurrentThread
InitializeCriticalSection
GetComputerNameA
GetModuleHandleA
SetLastError
LocalFree
CreateEventA
FindClose
SetConsoleTitleW
SetErrorMode
CreateDirectoryA
GetFileAttributesA
GetVersionExA
GetSystemDirectoryA
GetWindowsDirectoryA
GetEnvironmentVariableA
DeleteFileA
CreateFileA
SuspendThread
GetCurrentThreadId
GetCurrentProcessId
GetThreadContext
SetUnhandledExceptionFilter
GetExitCodeProcess
CreateProcessW
OpenProcess
InterlockedDecrement
GetModuleFileNameW
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
InterlockedExchange
TlsFree
TlsAlloc
TlsGetValue
GetConsoleMode
TlsSetValue
ResumeThread
UnmapViewOfFile
DuplicateHandle
MapViewOfFile
CreateFileMappingA
OpenEventA
GetStdHandle
GetModuleFileNameA
GetVersion
ExitProcess
FlushFileBuffers
SetEndOfFile
CreateFileW
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetConsoleCtrlHandler
LCMapStringW
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
InterlockedIncrement
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
MultiByteToWideChar
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
HeapSize
RtlUnwind
HeapReAlloc
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapFree
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FreeLibrary
GetFileSize
ReadFile
GetCurrentProcess
CreateMutexW
CloseHandle
WaitForSingleObject
GetTickCount
Sleep
GetLastError
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalMemoryStatus
FlushConsoleInputBuffer
WinExec
GetConsoleCP
ReadConsoleInputA
SetConsoleMode
RaiseException

user32

FillRect
GetSysColor
SetCursor
InvalidateRect
DrawTextW
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
CharNextExA
SetCapture
GetActiveWindow
SendMessageW
ReleaseCapture
TranslateMessage
EndDialog
DestroyWindow
BeginPaint
EndPaint
PostQuitMessage
wsprintfW
ReleaseDC
GetDlgItem
LoadIconW
SetDlgItemTextW
RedrawWindow
EnableWindow
ShowWindow
GetClientRect
MoveWindow
wsprintfA
CallWindowProcW
GetParent
GetWindowLongW
GetDC
GetWindowTextLengthW
GetWindowTextW
UpdateWindow
LoadCursorW
IsWindow
SetWindowLongW
GetCursorPos
GetWindowRect
MessageBoxW

gdi32

CreatePen
MoveToEx
LineTo
GetObjectW
CreateFontIndirectW
SelectObject
SetTextColor
SetBkMode
CreateSolidBrush
DeleteObject

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
GetTokenInformation
SetTokenInformation
RevertToSelf
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetFolderPathW
ShellExecuteW

ole32

OleRun
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoRevertToSelf
CLSIDFromProgID
CLSIDFromString
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

version

GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

Sections

.text
Size: 452KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9accbd1f9998766ed04e58f4922a2733

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3d:7b:7e:4f:14:bb:04:bf:34:c2:66:86:a6:1a:bd:a0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

58:b0:0a:76:b6:7c:fd:58:16:c5:f3:38:5b:fd:d6:52:d4:1b:a8:f3Signer

Signature Validations

Verification

19/10/2012, 16:11 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

Sections

.text Size: 452KB - Virtual size: 448KB

.rdata Size: 172KB - Virtual size: 168KB

.data Size: 12KB - Virtual size: 42KB

.rsrc Size: 296KB - Virtual size: 293KB

.reloc Size: 86KB - Virtual size: 86KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3d:7b:7e:4f:14:bb:04:bf:34:c2:66:86:a6:1a:bd:a0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

58:b0:0a:76:b6:7c:fd:58:16:c5:f3:38:5b:fd:d6:52:d4:1b:a8:f3
Signer

19/10/2012, 16:11
Valid: false

.text
Size: 452KB - Virtual size: 448KB

.rdata
Size: 172KB - Virtual size: 168KB

.data
Size: 12KB - Virtual size: 42KB

.rsrc
Size: 296KB - Virtual size: 293KB

.reloc
Size: 86KB - Virtual size: 86KB