2afbc72a4f98758374ab3cea4e9159afbcd50b00278892e8c74151028163173c

Sharing

Copy URL Twitter E-mail

General

Target

2afbc72a4f98758374ab3cea4e9159afbcd50b00278892e8c74151028163173c
Size

427KB
MD5

440452f987126a3e658cc34186a936fb
SHA1

0a309396466d93d90ca3d9a7b04ba6e3353355cc
SHA256

2afbc72a4f98758374ab3cea4e9159afbcd50b00278892e8c74151028163173c
SHA512

c3924759d1de0fff1de84a922372b33c867768657dbd75242b294bd33cf11c3630c89ba13b94e0114fd1dec49d2a90d2afdd59fcfd787f398510bd2bf97d16c2
SSDEEP

6144:vgUbnObCclcB6BQVnhLbm6BN6BJNOprSQxLLp9ifhseUJtpJYqZ:xoQVhX3UJNASQRrifhGJtpJZZ

Score

N/A

Malware Config

Signatures

Files

2afbc72a4f98758374ab3cea4e9159afbcd50b00278892e8c74151028163173c
.exe windows x86

6b3fe2939fb430e3ae12baa0280be9b9

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:87:98:91:13:7c:32:15:cb:c5:e6:5a:fc:3d:76:d9:6f:ae:98:8c
Signer

Actual PE Digest

6f:87:98:91:13:7c:32:15:cb:c5:e6:5a:fc:3d:76:d9:6f:ae:98:8c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/11/2008, 01:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
RaiseException
CloseHandle
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
GetProcAddress
LoadLibraryW
FreeLibrary
DeleteFileW
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetCurrentThreadId
FoldStringW
GetLocaleInfoW
Sleep
TlsAlloc
GetLastError
TlsGetValue
TlsFree
LoadLibraryA

user32

SetForegroundWindow
IsZoomed
IsIconic
ShowWindow
SetWindowPos
DestroyWindow
IsWindow
SetWindowPlacement
GetWindowPlacement
GetParent
UpdateWindow
LoadImageW
GetSystemMetrics
LoadIconW
MapVirtualKeyW
PostMessageW

msocf

?Init@CToolbarData@MsoCF@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
??0CToolbarData@MsoCF@@QAE@XZ
?TheApp@Frame@MsoCF@@YGPAUAFrameApp@2@XZ
?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z
?Set@Properties@MsoCF@@YGXPAUIPropertySet@2@ABUPropertyInfo@2@PBXW4PropertyType@2@@Z
?LookupProperty@MsoCF@@YGABUPropertyInfo@1@I@Z
?TheActionManager@MsoCF@@YGPAUIActionManager@1@XZ
?Start@Frame@MsoCF@@YGXXZ
?Start@Utilities@MsoCF@@YGXHPAU_msotcfcf@@@Z
?Free@Allocator@Memory@MsoCF@@YGXPAX@Z
?SetWzFromPattern@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IQAPB_WHPAH@Z
?SetWtzFromPattern@Strings@MsoCF@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@_W@MsoCF@@@2@PAUHINSTANCE__@@IQAPB_WH@Z
?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z
?SetWzFromResource@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IPAH@Z
?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
??1CToolbarData@MsoCF@@QAE@XZ
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@IHHPAH@Z
?g_FastBufferAllocator@MsoCF@@3VCFastBufferAllocator@1@A
?g_FixedBufferAllocator@MsoCF@@3VCFixedBufferAllocator@1@A
?Finish@Utilities@MsoCF@@YGXXZ
?Finish@Frame@MsoCF@@YGXXZ
?TerminateTheApp@Frame@MsoCF@@YGXXZ

oisapp

?OnSetFocus@OISAppApi@@YGXXZ
?CreateMediaWindow@OISAppApi@@YGPAUHWND__@@PAU2@@Z
?ExitInstance@OISAppApi@@YGXXZ
?Singleton@CAppOA@@SGPAV1@XZ
?GetRootCollection@CAppOA@@SGXPAPB_W@Z
?CdlDoIdle@OISAppApi@@YGXXZ
?GetCDLContext@OISAppApi@@YGPAUICdlContext@Cdl@@XZ
?GetApp@OISAppApi@@YGPAVCOISApp@@XZ
?DgRedEyePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRotatePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRenamePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgHueSatPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgBrightContrastPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?GetTestWizardInfo@COISApp@@SGXW4TestWizardRequestedItem@@PAXPAUtagPOINT@@@Z
?DgFileFormatOptDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgResizeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgEditHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgNavigationPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPublishDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEditModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgCompressPicsDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgLocatePicturesDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEmailDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPropertiesPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?SetTestWizardInfo@COISApp@@SGJKUtagVARIANT@@@Z
?SetShowToolbar@OISAppApi@@YGXP6GXH@Z@Z
?SetContextMenuCallback@OISAppApi@@YGXP6GXHABUtagPOINT@@H@Z@Z
?SetFrameHwnd@OISAppApi@@YGXPAUHWND__@@@Z
?InitInstance@OISAppApi@@YGXPAUMSOINST@@PAUHINSTANCE__@@ABVCThreadLocalStorage@Ofc@@@Z
?DoEditMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@_N@Z
?DoSendToMode@COISApp@@QAEXABUDownloadSettings@@@Z
?DoDownloadMode@COISApp@@QAEXAAUDownloadSettings@@@Z
?DoUploadMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoBrowseMode@COISApp@@SGXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoNormalMode@COISApp@@SGXXZ
?FDoShutdown@OISAppApi@@YG_NXZ
?CdlDoEvent@OISAppApi@@YG_NAAUtagMSG@@@Z
?RFMDisableApp@COISApp@@QAEXXZ
?CdlWorkPaneCallback@OISAppApi@@YGHHHPAX00@Z
?DgCropPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?GetOISSelectionContext@OISAppApi@@YGXPAPAUIActionContext@MsoCF@@@Z

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__CxxFrameHandler3
memset
_CxxThrowException
memcpy
memmove
_amsg_exit
__getmainargs

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b3fe2939fb430e3ae12baa0280be9b9

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6f:87:98:91:13:7c:32:15:cb:c5:e6:5a:fc:3d:76:d9:6f:ae:98:8cSigner

Signature Validations

Verification

04/11/2008, 01:21 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msocf

oisapp

msvcr80

Sections

.text Size: 61KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 191KB - Virtual size: 191KB

.reloc Size: 4KB - Virtual size: 4KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6f:87:98:91:13:7c:32:15:cb:c5:e6:5a:fc:3d:76:d9:6f:ae:98:8c
Signer

04/11/2008, 01:21
Valid: false

.text
Size: 61KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 191KB - Virtual size: 191KB

.reloc
Size: 4KB - Virtual size: 4KB