9f9ab1520cf37dbd018704526577e33e14c86987cff496063150bb0cade7c3b3

Sharing

Copy URL Twitter E-mail

General

Target

9f9ab1520cf37dbd018704526577e33e14c86987cff496063150bb0cade7c3b3
Size

262KB
MD5

a22450cefc38f714266900196107157c
SHA1

5b9f04871603daa60af7dbdb01710c555f59529a
SHA256

9f9ab1520cf37dbd018704526577e33e14c86987cff496063150bb0cade7c3b3
SHA512

623527b59aeebff37df85f3fdd96f6c549056290429a314834a44edc4e70e9ee0e794434584fccc992e09514918b03e7e44a1637e9d5ad18b7772f76960e1a53
SSDEEP

6144:9lGBCnCXoCp6DrHlMYJl8/6KWddsBecrfcvgP0Kj6/Z4:9zCXSrnl8yKWQvjIZ

Score

N/A

Malware Config

Signatures

Files

9f9ab1520cf37dbd018704526577e33e14c86987cff496063150bb0cade7c3b3
.exe windows x64

0cc5032562bbfd300f47cd35f28f20c8

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:58:c0:9b:bd:ce:26:e7:9b:20:49:2f:6c:af:05:c1:10:ef:aa:bb
Signer

Actual PE Digest

bf:58:c0:9b:bd:ce:26:e7:9b:20:49:2f:6c:af:05:c1:10:ef:aa:bb

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

18/07/2012, 09:53
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

DdeCreateStringHandleW
DdeDisconnect
DdeGetLastError
DdeClientTransaction
DdeFreeStringHandle
DdeInitializeW
WaitForInputIdle
DdeConnect
DdeUninitialize

shell32

ShellExecuteExW

psapi

GetModuleFileNameExW

advapi32

RegQueryValueExA
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey

shlwapi

StrStrIW

ole32

CoInitialize
CoCreateInstance

wintrust

WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

version

GetFileVersionInfoSizeA
VerQueryValueA

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
CloseHandle
GetLongPathNameW
WideCharToMultiByte
GetProcAddress
OpenProcess
GetModuleFileNameW
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
Sleep
ExpandEnvironmentStringsW
GetVersionExA
GetLastError
CreateProcessW
GetFileAttributesW
FindClose
FindFirstFileW
GetWindowsDirectoryW
FreeLibrary
LoadLibraryA
GetWindowsDirectoryA
MultiByteToWideChar
lstrlenA
lstrcmpA
SetLastError
LoadLibraryW
lstrlenW
GetFileType
CreateFileA
LocalFree
GetSystemTime
FormatMessageW
GetCurrentThreadId
OutputDebugStringA
ReadFile
SetFilePointer
GetACP
WriteFile
GetFileSize
CreateFileW
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsGetValue
TlsSetValue
HeapAlloc
GetProcessHeap
HeapFree
OpenThread
TlsAlloc
TlsFree
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCurrentProcessId
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileSizeEx
SetFilePointerEx
DeviceIoControl
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
GetStartupInfoA
RaiseException
RtlPcToFileHeader
HeapReAlloc
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode

crypt32

CertGetCertificateContextProperty
CertGetNameStringW
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore

Sections

.text
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

!
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cc5032562bbfd300f47cd35f28f20c8

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

bf:58:c0:9b:bd:ce:26:e7:9b:20:49:2f:6c:af:05:c1:10:ef:aa:bbSigner

Signature Validations

Verification

18/07/2012, 09:53 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

psapi

advapi32

shlwapi

ole32

wintrust

version

kernel32

crypt32

Sections

.text Size: 169KB - Virtual size: 168KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 8KB - Virtual size: 18KB

.pdata Size: 9KB - Virtual size: 9KB

! Size: 15KB - Virtual size: 15KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

bf:58:c0:9b:bd:ce:26:e7:9b:20:49:2f:6c:af:05:c1:10:ef:aa:bb
Signer

18/07/2012, 09:53
Valid: false

.text
Size: 169KB - Virtual size: 168KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 8KB - Virtual size: 18KB

.pdata
Size: 9KB - Virtual size: 9KB

!
Size: 15KB - Virtual size: 15KB