06c2161c0964ebd534bcd5d548f74bc8f9afee7c53d327e53f8762276a864fd1

Sharing

Copy URL Twitter E-mail

General

Target

06c2161c0964ebd534bcd5d548f74bc8f9afee7c53d327e53f8762276a864fd1
Size

73KB
MD5

905842162f7e8afd331160433d5a2e40
SHA1

4b5152a99a3e0520cc40d0e4f8ee575721240208
SHA256

06c2161c0964ebd534bcd5d548f74bc8f9afee7c53d327e53f8762276a864fd1
SHA512

79c3c082879ca82cc314c1f6c9347f88827b8d3025842888cff994ac7d718239af8ed35a088e9705d4aaf80f3a4692998434aebefc13a930a47f2e481c0682cd
SSDEEP

1536:Fa2bcwXJ18u3kPyTzLg/STVX9VzgxZVNtV+TL7:1gQckM2HzeZVNtVe

Score

N/A

Malware Config

Signatures

Files

06c2161c0964ebd534bcd5d548f74bc8f9afee7c53d327e53f8762276a864fd1
.exe windows x86

1eb2e0ec49a898e47e6378f854f1b764

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:f9:9d:85:f0:a1:1e:ff:98:4d:ca:48:4e:28:99:a4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

14/05/2007, 00:00

Not After

12/07/2010, 23:59

Subject

CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fd:ea:74:a3:42:96:ca:27:df:7e:d1:39:69:22:30:d8:3d:d8:06:af
Signer

Actual PE Digest

fd:ea:74:a3:42:96:ca:27:df:7e:d1:39:69:22:30:d8:3d:d8:06:af

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN

14/01/2009, 03:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetSystemTime
GetTempPathA
CloseHandle
CreateProcessA
DeleteFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocalTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetLastError
WriteFile
InitializeCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
ReadFile
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
HeapAlloc
VirtualAlloc
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
SetStdHandle
FlushFileBuffers
CreateFileA
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

winmm

timeGetTime

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1eb2e0ec49a898e47e6378f854f1b764

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

0a:f9:9d:85:f0:a1:1e:ff:98:4d:ca:48:4e:28:99:a4Certificate

Extended Key Usages

Key Usages

fd:ea:74:a3:42:96:ca:27:df:7e:d1:39:69:22:30:d8:3d:d8:06:afSigner

Signature Validations

Verification

14/01/2009, 03:12 Valid: false

Headers

File Characteristics

Imports

kernel32

wininet

winmm

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 19KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

0a:f9:9d:85:f0:a1:1e:ff:98:4d:ca:48:4e:28:99:a4
Certificate

fd:ea:74:a3:42:96:ca:27:df:7e:d1:39:69:22:30:d8:3d:d8:06:af
Signer

14/01/2009, 03:12
Valid: false

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 19KB