47c3061c30f06edb06280aa9595ded8b94e474f7ce2691327d03b00df8fea8ab

Sharing

Copy URL Twitter E-mail

General

Target

47c3061c30f06edb06280aa9595ded8b94e474f7ce2691327d03b00df8fea8ab
Size

854KB
MD5

3effcf2f8d4c8f49f4b7386e5648b990
SHA1

25499aca73cbf15cdeddbb49e835da9eec3b5c46
SHA256

47c3061c30f06edb06280aa9595ded8b94e474f7ce2691327d03b00df8fea8ab
SHA512

ac42dedd6335120cd3edf50a8af6224966cba65afcfb04a21271d9c1f90a7c8b06eb182c9a9c6a14f92fd9637e1eec4815b723b5836f92c5c03ad12499d495dc
SSDEEP

12288:DjcTHBx1VJqXUU+VpLlNdK8fev1L/txfOny:DEVJqXUU+VpL/o1L/tROny

Score

N/A

Malware Config

Signatures

Files

47c3061c30f06edb06280aa9595ded8b94e474f7ce2691327d03b00df8fea8ab
.dll windows x86

72ae0ce016f111c6caa89b78737eaa08

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/08/2010, 00:00

Not After

12/08/2013, 23:59

Subject

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

17:12:fa:19:d5:2c:34:a9:18:2d:a9:7b:8e:74:84:a6:dd:d5:fb:44
Signer

Actual PE Digest

17:12:fa:19:d5:2c:34:a9:18:2d:a9:7b:8e:74:84:a6:dd:d5:fb:44

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

25/10/2012, 10:46
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winimhc3

SetPhotoWarningFlag
SetPhotoFlagType
SetNotRecordContentType
DbgInfo
SetIMTypeHooked
SetIMAgentInfo

kernel32

GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SetErrorMode
lstrcatW
GetVersion
SetLastError
GetFileSize
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
MulDiv
GlobalFlags
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentDirectoryW
GlobalFindAtomW
GlobalAddAtomW
LockResource
FindResourceW
LoadLibraryA
GetProcessVersion
GlobalSize
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
ExitProcess
TerminateProcess
ExitThread
HeapSize
HeapReAlloc
FatalAppExitA
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
GlobalFree
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetStringTypeA
GetStringTypeW
GetOEMCP
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLastError
GetSystemDirectoryW
GetModuleFileNameA
GetModuleFileNameW
GetCurrentProcessId
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
FormatMessageW
FindClose
FindNextFileW
lstrcmpW
FindFirstFileW
GetLocalTime
CreateDirectoryW
GetFileAttributesW
GetTickCount
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
GetFileInformationByHandle
CreateFileA
GetModuleHandleA
CreateThread
GetCurrentProcess
OpenProcess
LocalFree
ResetEvent
TerminateThread
GetExitCodeThread
QueryPerformanceCounter
TlsAlloc
LocalAlloc
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreW
GlobalUnlock
CreateEventW
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
lstrcmpA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetShortPathNameW
LoadLibraryW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetFullPathNameW
lstrcpynW
GetVolumeInformationW
lstrcpyW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
DuplicateHandle
LeaveCriticalSection
EnterCriticalSection
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
OutputDebugStringW
SetFilePointer
WriteFile
CreateFileW
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileStringW
GetProfileStringW
GetVersionExW
lstrlenW
GetACP
FindResourceExW
LoadResource
FormatMessageA
InterlockedDecrement
lstrlenA
InterlockedIncrement
ReleaseMutex
FreeLibrary
IsBadReadPtr
CreateMutexW
OpenMutexW
Sleep
MoveFileW
CopyFileW
SetFileAttributesW
RemoveDirectoryW
DeleteFileW
GetSystemInfo
FindFirstFileA
FindNextFileA
FreeEnvironmentStringsA

user32

LoadIconW
LoadCursorW
GetSysColorBrush
AppendMenuW
RemoveMenu
wvsprintfW
DestroyMenu
GetSysColor
SetActiveWindow
IsWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetClientRect
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
DefWindowProcW
DestroyWindow
CreateWindowExW
SetPropW
GetPropW
CallWindowProcW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
OffsetRect
IntersectRect
SystemParametersInfoW
IsIconic
GetWindowPlacement
SetFocus
UpdateWindow
SetWindowPos
MoveWindow
SetWindowLongW
IsDialogMessageW
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemTextW
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
GrayStringW
DrawTextW
TabbedTextOutW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ScreenToClient
GetMenuStringW
DeleteMenu
InsertMenuW
GetMenuItemCount
MessageBoxA
SetWindowTextW
ClientToScreen
GetWindowRect
PtInRect
LoadStringW
UnregisterClassW
UnhookWindowsHookEx
MsgWaitForMultipleObjects
GetWindowTextLengthW
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageW
GetCursorPos
SetWindowsHookExW
SendDlgItemMessageA
ShowWindow
MapWindowPoints
GetLastActivePopup
IsWindowEnabled
GetProcessWindowStation
EnableWindow
SetCursor
ShowOwnedPopups
SendMessageW
PostQuitMessage
GetSystemMetrics
CharUpperW
wsprintfW
GetDlgCtrlID
EnumChildWindows
PostMessageW
GetWindowTextA
IsWindowVisible
EnumDesktopWindows
MessageBoxW
SetProcessWindowStation
CloseWindowStation
GetUserObjectInformationW
OpenInputDesktop
OpenDesktopW
GetThreadDesktop
SetThreadDesktop
CloseDesktop
EnumDesktopsW
OpenWindowStationW
RegisterWindowMessageW
GetDesktopWindow
EnumWindows
GetWindowThreadProcessId
GetWindowLongW
GetWindow
GetWindowTextW
GetParent
GetClassNameW
FindWindowExW
GetMenuCheckMarkDimensions

gdi32

MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
OffsetClipRgn
PlayMetaFile
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetDCOrgEx
GetObjectW
CopyMetaFileW
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
BitBlt
GetBitmapBits
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
SelectPalette
GetStockObject
SelectObject
RestoreDC
SaveDC
StartDocW
DeleteDC
DeleteObject
CreateDCA
EnumMetaFile
CreateBitmap

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumValueW
RegSetValueExA
RegQueryValueExA
SetSecurityDescriptorDacl
RegSetValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyW
GetUserNameW
GetTokenInformation
LookupAccountSidW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
LookupAccountNameW

shell32

SHGetFileInfoW
DragAcceptFiles

comctl32

ord17

ole32

SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
CoTaskMemFree
CreateBindCtx
CoTaskMemAlloc
OleDuplicateData
CoCreateInstance
ReadClassStg
StringFromCLSID
CoTreatAsClass
ReleaseStgMedium
CoDisconnectObject

oleaut32

SysReAllocStringLen
SysAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantCopy
SysAllocString
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DebugInfo
GetIMFTLog
ScanIM
SetIMHookLogFlag
SetIMType
SetNotRecordContent
SetPhotoFlag
SetPhotoWarning
SetRecordFlag
SetUserInfo
StartIMHook
StopIMHook
SyncTime

Sections

.text
Size: 632KB - Virtual size: 629KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72ae0ce016f111c6caa89b78737eaa08

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4aCertificate

Extended Key Usages

Key Usages

17:12:fa:19:d5:2c:34:a9:18:2d:a9:7b:8e:74:84:a6:dd:d5:fb:44Signer

Signature Validations

Verification

25/10/2012, 10:46 Valid: false

Headers

File Characteristics

Imports

winimhc3

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 632KB - Virtual size: 629KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 64KB - Virtual size: 90KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 44KB - Virtual size: 42KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

17:12:fa:19:d5:2c:34:a9:18:2d:a9:7b:8e:74:84:a6:dd:d5:fb:44
Signer

25/10/2012, 10:46
Valid: false

.text
Size: 632KB - Virtual size: 629KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 64KB - Virtual size: 90KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 44KB - Virtual size: 42KB