1f5d191455a431a38237b2329ef5568049ed075d223c182a50d6fc218a6001e6

Sharing

Copy URL Twitter E-mail

General

Target

1f5d191455a431a38237b2329ef5568049ed075d223c182a50d6fc218a6001e6
Size

236KB
MD5

63aa87d6f2d36bad3d61136c57324801
SHA1

58a09a147dfe2c477ca00557e3a27cd77a08c7b9
SHA256

1f5d191455a431a38237b2329ef5568049ed075d223c182a50d6fc218a6001e6
SHA512

2db4561905231c6b47231164191149fa0949a67acbdbe23a53635d70bb023f10edb2738f18b8498c4848a34197671f89b966a7a062f05222e5b43bf05f6cb301
SSDEEP

6144:PUok3mTegDeHhwaZ0EwlWOMVQSeky1qldGya70Dg/fg:PUolTegO6aZ0blPMd1gt70M/fg

Score

N/A

Malware Config

Signatures

Files

1f5d191455a431a38237b2329ef5568049ed075d223c182a50d6fc218a6001e6
.exe windows x86

26fb2f1a70cd69f12d3148b657c9e814

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/07/2010, 00:00

Not After

18/08/2011, 23:59

Subject

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:20:ec:0b:64:22:0b:8b:63:c4:ab:41:a9:15:60:72:62:ec:e1:91
Signer

Actual PE Digest

30:20:ec:0b:64:22:0b:8b:63:c4:ab:41:a9:15:60:72:62:ec:e1:91

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

18/07/2011, 23:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MulDiv
OpenEventW
GetStartupInfoW
GetCurrentDirectoryA
IsBadReadPtr
lstrcmp
GetModuleHandleW
LoadLibraryA
GetProcAddress
GlobalGetAtomNameW
GlobalAlloc
SetCurrentDirectoryA
ExpandEnvironmentStringsA
DuplicateHandle
GetLogicalDriveStringsA
RemoveDirectoryA
GetTimeFormatA
lstrcmpiA
CreateNamedPipeA
AddAtomA
GetLogicalDriveStringsW
FindAtomW
LoadLibraryW
GetSystemDirectoryW
CreateNamedPipeW
OpenFile
EnumTimeFormatsA
FreeLibrary

user32

IsWindow
LoadMenuIndirectA
PeekMessageA
RegisterClassExW
wvsprintfA
LoadIconA
SetDlgItemInt
GetMenuStringA
WinHelpW
wsprintfA
LoadCursorA
wvsprintfW
EndDialog
RegisterWindowMessageW
CharPrevW
PostMessageW
IsIconic
GetActiveWindow
CreateWindowExW
LoadCursorW
UnregisterClassW
MonitorFromWindow
LoadMenuW
GetActiveWindow
SetWindowTextW

gdi32

CreateFontA
CreateScalableFontResourceA
SetMetaFileBitsEx
CreateRectRgn
CreateBitmap
ExtCreateRegion
CreateSolidBrush

shlwapi

StrRetToStrA
PathIsLFNFileSpecA
SHRegCloseUSKey
PathFindOnPathA
PathRemoveArgsA
SHStrDupA
PathAddExtensionW
StrChrIW

comctl32

ImageList_Add

winmm

midiOutCachePatches
waveOutPrepareHeader
mmioClose
midiOutCacheDrumPatches
waveInPrepareHeader

crypt32

CertOpenSystemStoreW
CertSerializeCRLStoreElement
I_CryptReleaseLruEntry
CryptSignMessageWithKey
CryptEnumOIDFunction
CryptImportPublicKeyInfo
CertComparePublicKeyInfo
CryptImportPublicKeyInfoEx
CryptUnregisterOIDFunction
CertFindSubjectInCTL
CryptMemRealloc
CertControlStore
CertGetSubjectCertificateFromStore
CertGetIssuerCertificateFromStore
I_CryptInstallOssGlobal
CertVerifyCRLTimeValidity
CryptQueryObject
CertOpenSystemStoreA
CertFreeCTLContext

Sections

.Jhsu
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Wgk
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.FQoiM
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.JyqN
Size: 3KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lkz
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pKtDH
Size: 17KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.AEu
Size: 3KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26fb2f1a70cd69f12d3148b657c9e814

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

30:20:ec:0b:64:22:0b:8b:63:c4:ab:41:a9:15:60:72:62:ec:e1:91Signer

Signature Validations

Verification

18/07/2011, 23:04 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shlwapi

comctl32

winmm

crypt32

Sections

.Jhsu Size: 5KB - Virtual size: 4KB

.Wgk Size: 86KB - Virtual size: 85KB

.FQoiM Size: 13KB - Virtual size: 13KB

.JyqN Size: 3KB - Virtual size: 29KB

.lkz Size: 82KB - Virtual size: 81KB

.pKtDH Size: 17KB - Virtual size: 343KB

.AEu Size: 3KB - Virtual size: 187KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

30:20:ec:0b:64:22:0b:8b:63:c4:ab:41:a9:15:60:72:62:ec:e1:91
Signer

18/07/2011, 23:04
Valid: false

.Jhsu
Size: 5KB - Virtual size: 4KB

.Wgk
Size: 86KB - Virtual size: 85KB

.FQoiM
Size: 13KB - Virtual size: 13KB

.JyqN
Size: 3KB - Virtual size: 29KB

.lkz
Size: 82KB - Virtual size: 81KB

.pKtDH
Size: 17KB - Virtual size: 343KB

.AEu
Size: 3KB - Virtual size: 187KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 1024B