f2fe90574cdaa05665e6ecc7f6a4284739dbcd76a86602a7b3a6a0ce725b1151

Sharing

Copy URL

Twitter E-mail

General

Target

f2fe90574cdaa05665e6ecc7f6a4284739dbcd76a86602a7b3a6a0ce725b1151
Size

292KB
MD5

66fc85493b92b9e5c64cf3b8f1b30f20
SHA1

8b3aceb4998615650b9b933f961f383f93e7b9be
SHA256

f2fe90574cdaa05665e6ecc7f6a4284739dbcd76a86602a7b3a6a0ce725b1151
SHA512

6ddfc9915e090c31ae2235328ad706e7eebb8cd99a3b2b2fe1a4a68791398a3ea11a9a4fede2182fcae5684b41b5f1bf19e3a8716dc9b799183cc68318976a65
SSDEEP

3072:9YkOnU4sCFGMoIls5W+wFJ9KtQ1gMkHixKwLk3adibLAOLA8fVCDQvgoL4HXhz+u:9F44IiQ1gMkHAKC+7/9UYvoXXd

Score

N/A

Malware Config

Signatures

Files

f2fe90574cdaa05665e6ecc7f6a4284739dbcd76a86602a7b3a6a0ce725b1151
.exe windows x86

f47cc39ed6665a59fdea3b9745326e29

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

92:a9:d6:08:1f:85:88:69:26:ab:cd:54:ad:03:bd:69
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15-11-2012 00:00

Not After

15-11-2015 23:59

Subject

CN=SWIFT Weather,O=SWIFT Weather,POSTALCODE=55419,STREET=5332 Girard Ave S,L=Minneapolis,ST=MN,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4f:46:60:41:42:11:5f:13:a6:50:1e:4f:d3:cc:b9:75:7a:e6:d9:ac
Signer

Actual PE Digest

4f:46:60:41:42:11:5f:13:a6:50:1e:4f:d3:cc:b9:75:7a:e6:d9:ac

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SWIFT Weather,O=SWIFT Weather,POSTALCODE=55419,STREET=5332 Girard Ave S,L=Minneapolis,ST=MN,C=US

16-04-2015 10:47
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsProcessorFeaturePresent
IsProcessorFeaturePresent

user32

GetSystemMetrics

oleaut32

DispGetIDsOfNames
VarFormatDateTime
VarR8FromStr
VarCyFromI1
VarR8FromI4
VarI1FromCy
SafeArrayLock
VarCyFromR8
VarDecFromR8
VarDateFromI4
VarI4FromDate
SafeArrayDestroy
VarFormatNumber
SafeArrayCreate
VarBstrFromDisp
VarUI1FromDec
SysStringLen
VarUI4FromDec
GetActiveObject
VarUI4FromI4

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f47cc39ed6665a59fdea3b9745326e29

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

92:a9:d6:08:1f:85:88:69:26:ab:cd:54:ad:03:bd:69Certificate

Extended Key Usages

Key Usages

4f:46:60:41:42:11:5f:13:a6:50:1e:4f:d3:cc:b9:75:7a:e6:d9:acSigner

Signature Validations

Verification

16-04-2015 10:47 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

Sections

.text Size: 132KB - Virtual size: 131KB

.rdata Size: 1024B - Virtual size: 533B

.data Size: 149KB - Virtual size: 148KB

.CRT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 968B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

92:a9:d6:08:1f:85:88:69:26:ab:cd:54:ad:03:bd:69
Certificate

4f:46:60:41:42:11:5f:13:a6:50:1e:4f:d3:cc:b9:75:7a:e6:d9:ac
Signer

16-04-2015 10:47
Valid: false

.text
Size: 132KB - Virtual size: 131KB

.rdata
Size: 1024B - Virtual size: 533B

.data
Size: 149KB - Virtual size: 148KB

.CRT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 968B