cb73fb540eaf5bd06ff877736bd1776573428dfc899e935c25b956367ac79dc2

Sharing

Copy URL Twitter E-mail

General

Target

cb73fb540eaf5bd06ff877736bd1776573428dfc899e935c25b956367ac79dc2
Size

374KB
MD5

767dafefc6958d0a8b2088ffcbcb0750
SHA1

152f87588742177e590c06d33f6c75c019785a90
SHA256

cb73fb540eaf5bd06ff877736bd1776573428dfc899e935c25b956367ac79dc2
SHA512

8b996bfeb4b33990f8e13be9c195932e27bc8740851e07a1d95abaf43c04887c3f95755f55a55da0744bd8030fee630831c82066c8d7316b5d7509c4832911f5
SSDEEP

6144:hiw/eJmCaT5z69Cw0pQpzD0P4Kvmw+KgMHzF0S/UaZh9s5ZqRNkcdpCfS6P02AcR:Mw/e5aFz69Cw0pQpzg4M+kF0S/UaZh9s

Score

N/A

Malware Config

Signatures

Files

cb73fb540eaf5bd06ff877736bd1776573428dfc899e935c25b956367ac79dc2
.exe windows x86

240a6d085ea30bb62e0ca90ec8278d15

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:8b:48:92:bd:19:55:eb:9a:88:8f:f3:93:b8:52:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

26/10/2006, 00:00

Not After

15/12/2009, 23:59

Subject

CN=F-Secure Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development,O=F-Secure Corporation,L=Helsinki,ST=Helsinki,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a2:a8:5a:75:c9:d1:7f:a9:68:2a:1f:33:9a:4b:46:85:cb:11:8f:3e
Signer

Actual PE Digest

a2:a8:5a:75:c9:d1:7f:a9:68:2a:1f:33:9a:4b:46:85:cb:11:8f:3e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=F-Secure Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research and Development,O=F-Secure Corporation,L=Helsinki,ST=Helsinki,C=FI

05/08/2009, 12:51
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

user32

MessageBoxA
SendMessageA
ExitWindowsEx

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

rpcrt4

UuidToStringA
RpcStringFreeA

kernel32

SetEvent
LocalFree
FormatMessageA
WaitForMultipleObjects
CopyFileA
ReadFile
SearchPathA
GetExitCodeThread
CreateThread
DeleteFileA
GlobalFree
CreateEventA
GetEnvironmentVariableA
GetTempPathA
GetFileAttributesA
GetSystemTime
lstrlenA
GetLocaleInfoA
LocalAlloc
FreeLibrary
GetCurrentProcess
LoadLibraryA
RemoveDirectoryA
FindNextFileA
FindClose
FindFirstFileA
GetDiskFreeSpaceExA
GetModuleHandleA
GlobalAlloc
OutputDebugStringA
GetCurrentThreadId
GetTickCount
DebugBreak
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
InterlockedExchange
RaiseException
lstrcpyA
ReleaseMutex
CreateMutexA
CreateDirectoryA
CreateFileA
WriteFile
GetVersionExA
Sleep
GetModuleFileNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateProcessA
GetLastError
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
CloseHandle
GetCurrentProcessId
VirtualQuery
SetEndOfFile
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProcAddress
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
MoveFileExA
WideCharToMultiByte
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStdHandle
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA

advapi32

ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf
DuplicateTokenEx
OpenSCManagerA
CreateServiceA
CloseServiceHandle
InitializeSecurityDescriptor
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTokenInformation
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
SetNamedSecurityInfoA
SetSecurityDescriptorDacl
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

ole32

CoCreateGuid

Sections

.text
Size: 288KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

240a6d085ea30bb62e0ca90ec8278d15

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

59:8b:48:92:bd:19:55:eb:9a:88:8f:f3:93:b8:52:37Certificate

Extended Key Usages

Key Usages

a2:a8:5a:75:c9:d1:7f:a9:68:2a:1f:33:9a:4b:46:85:cb:11:8f:3eSigner

Signature Validations

Verification

05/08/2009, 12:51 Valid: false

Headers

File Characteristics

Imports

version

user32

userenv

rpcrt4

kernel32

advapi32

shell32

ole32

Sections

.text Size: 288KB - Virtual size: 286KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

59:8b:48:92:bd:19:55:eb:9a:88:8f:f3:93:b8:52:37
Certificate

a2:a8:5a:75:c9:d1:7f:a9:68:2a:1f:33:9a:4b:46:85:cb:11:8f:3e
Signer

05/08/2009, 12:51
Valid: false

.text
Size: 288KB - Virtual size: 286KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 2KB