4a2517d0d74ba3b444423d7c6e6adea0f0e026f1a9b554094106e40d2e2f0acb

Sharing

Copy URL Twitter E-mail

General

Target

4a2517d0d74ba3b444423d7c6e6adea0f0e026f1a9b554094106e40d2e2f0acb
Size

240KB
MD5

60465c056027b7da3fd70c82c9ae92d3
SHA1

1e94f1610a98c71887365565ad8de79239505673
SHA256

4a2517d0d74ba3b444423d7c6e6adea0f0e026f1a9b554094106e40d2e2f0acb
SHA512

add7286e4d4c487812f6d50fa4b8a1e7b7891a9c7eada0cfdf0e147c3a6d5e189805d6a8a87e3fce863568e1c52e2bebab99ae042afdd1f7486adc3430ff7625
SSDEEP

6144:qOrzUc1isQab7k4iBl2BeAHT/YyA3yqUHLG7HQ:Rkc7bzizAzKu8Q

Score

N/A

Malware Config

Signatures

Files

4a2517d0d74ba3b444423d7c6e6adea0f0e026f1a9b554094106e40d2e2f0acb
.exe windows x86

0076ba3684e4d2cb28e6b087a3bd8864

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02/12/2008, 00:00

Not After

02/12/2011, 23:59

Subject

CN=Sophos Plc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sophos Plc,L=Abingdon,ST=Oxfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

94:be:98:f9:e4:c5:c8:66:6e:f0:35:d9:9e:29:01:ac:28:ef:31:e2
Signer

Actual PE Digest

94:be:98:f9:e4:c5:c8:66:6e:f0:35:d9:9e:29:01:ac:28:ef:31:e2

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Sophos Plc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sophos Plc,L=Abingdon,ST=Oxfordshire,C=GB

28/05/2010, 13:24
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
GetCalendarInfoW
GetSystemTime
GetEnvironmentStringsW
lstrcatA
OpenMutexW
SleepEx
GetEnvironmentVariableW
GetEnvironmentStringsA
GetNumberFormatW
lstrcat
CreateSemaphoreW
BeginUpdateResourceW
MultiByteToWideChar
GetProcAddress
OpenMutexA
SetComputerNameA
GetModuleFileNameW
LocalFree
GetSystemDefaultLangID
lstrcpynW
GetVersionExA
GetOEMCP
lstrcpyW
GetCurrentProcessId
GetCurrentThreadId
FindAtomA
lstrcpyn
GetFileAttributesW
GetLongPathNameW
HeapCreate
RemoveDirectoryW
OpenWaitableTimerA
GetLogicalDriveStringsW
EnumCalendarInfoW
FatalAppExitA
GetExpandedNameW
SetErrorMode
GetVersion
CompareFileTime
GetTimeFormatW
EnumTimeFormatsA
BeginUpdateResourceA
GetCPInfo
QueryPerformanceFrequency
Beep
GlobalFindAtomW
CreateMutexW
CreateMailslotA
SetCurrentDirectoryA
SystemTimeToFileTime
WaitForMultipleObjects
CreateMailslotW
GetTempPathW
lstrcpynA
MulDiv
GetFullPathNameA
LoadLibraryExA

user32

LoadMenuIndirectW
UnregisterClassW
GetWindowRgn
GetMenuItemInfoA
InvalidateRect
IsMenu
CharUpperA
GetClassInfoA
CreateDialogIndirectParamA
GetMenuItemCount
GetDlgItemInt
LoadBitmapW
CharNextW
GetMessageW
GetMenuInfo
keybd_event
DestroyMenu
DefWindowProcA
ShowCaret
LoadIconA
InsertMenuA
GetDlgItemTextA
UnregisterClassA
CreateDesktopW
DestroyIcon
CopyIcon
EmptyClipboard
RegisterClassW
CharPrevW
LoadCursorW
ShowWindow
DialogBoxParamW
TrackPopupMenuEx
LoadImageA
SetWindowTextA
FindWindowW
UpdateLayeredWindow
CharNextA
CheckMenuItem
DefWindowProcW
ActivateKeyboardLayout
MessageBoxIndirectW
AppendMenuA
GetMenuItemID
GetCaretPos
CharPrevA
PeekMessageW
GetMessageA
CreatePopupMenu
GetMenuStringW
IsDlgButtonChecked
CreateDialogParamA
MessageBoxW
PostMessageW
LoadMenuIndirectA
IsMenu
CreateDesktopA
CopyRect
AppendMenuW
GetDlgItemTextW
LoadMenuW
LoadImageW
InsertMenuItemW
MonitorFromRect
MonitorFromWindow
SetDlgItemInt
WinHelpA
RegisterWindowMessageW
CreateAcceleratorTableW
FindWindowA
DialogBoxParamA
SetCapture
SetWindowLongW
GetClassInfoExW

gdi32

CreateScalableFontResourceW
GetMetaFileW
GetStockObject
CreateICA
GetRasterizerCaps
CreateMetaFileA
CreateBitmap
CreatePolyPolygonRgn
CreateRoundRectRgn
CreateColorSpaceW
TranslateCharsetInfo
CreateHatchBrush
RemoveFontResourceExW

shell32

StrChrIW
SHCreateDirectoryExW
ShellExecuteW
DuplicateIcon
ExtractIconExW
SHGetDiskFreeSpaceExA
Shell_NotifyIconW
StrStrW
StrChrW
StrChrA
Shell_NotifyIcon
SHCreateDirectoryExA
StrCmpNA

oledlg

OleUIPromptUserW
OleUIChangeIconA
OleUIEditLinksW
OleUIInsertObjectA
OleUIObjectPropertiesA
OleUIAddVerbMenuA
OleUIBusyW
OleUIEditLinksA

crypt32

CryptVerifyCertificateSignatureEx
CryptSIPCreateIndirectData
CertIsValidCRLForCertificate
CertGetCTLContextProperty
CertNameToStrA
CertSetEnhancedKeyUsage
CertFreeCertificateChain
I_CryptAddSmartCardCertToStore
CertFindSubjectInSortedCTL
CertAddCertificateLinkToStore
CertFindChainInStore

Sections

.FkAvR
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gE
Size: 5KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Sm
Size: 5KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.s
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.z
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.JSLTVt
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.LTpK
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hP
Size: 5KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xxP
Size: 2KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0076ba3684e4d2cb28e6b087a3bd8864

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cbCertificate

Extended Key Usages

Key Usages

94:be:98:f9:e4:c5:c8:66:6e:f0:35:d9:9e:29:01:ac:28:ef:31:e2Signer

Signature Validations

Verification

28/05/2010, 13:24 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

oledlg

crypt32

Sections

.FkAvR Size: 3KB - Virtual size: 2KB

.gE Size: 5KB - Virtual size: 58KB

.Sm Size: 5KB - Virtual size: 258KB

.s Size: 89KB - Virtual size: 89KB

.z Size: 13KB - Virtual size: 13KB

.JSLTVt Size: 5KB - Virtual size: 19KB

.LTpK Size: 90KB - Virtual size: 90KB

.hP Size: 5KB - Virtual size: 315KB

.xxP Size: 2KB - Virtual size: 199KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cb
Certificate

94:be:98:f9:e4:c5:c8:66:6e:f0:35:d9:9e:29:01:ac:28:ef:31:e2
Signer

28/05/2010, 13:24
Valid: false

.FkAvR
Size: 3KB - Virtual size: 2KB

.gE
Size: 5KB - Virtual size: 58KB

.Sm
Size: 5KB - Virtual size: 258KB

.s
Size: 89KB - Virtual size: 89KB

.z
Size: 13KB - Virtual size: 13KB

.JSLTVt
Size: 5KB - Virtual size: 19KB

.LTpK
Size: 90KB - Virtual size: 90KB

.hP
Size: 5KB - Virtual size: 315KB

.xxP
Size: 2KB - Virtual size: 199KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 1024B