479824fc34889204028d562470559597d47a6661f3e3d883d77616cede88ff17

Sharing

Copy URL Twitter E-mail

General

Target

479824fc34889204028d562470559597d47a6661f3e3d883d77616cede88ff17
Size

94KB
MD5

a0062bc35507364824ab81f8e80ce986
SHA1

de3df70694ce6f8e69c74718191821c3b4bc00be
SHA256

479824fc34889204028d562470559597d47a6661f3e3d883d77616cede88ff17
SHA512

cdd84ceada146d11d5a753d439c1a405f631de8b20cdc504469062464a17e7ce4cd8c200318ffbe443641ff4e995dfe3843f836d087e6df5854fdd75b61ca428
SSDEEP

1536:QrV6xPwWugVbfxyDJTi88CcKG6EE1UxXBabahUWZ0QiK3T78/mZnV959isKldT:8hzgb4D7cKG6E2UtFhzZnLZnV95qH

Score

N/A

Malware Config

Signatures

Files

479824fc34889204028d562470559597d47a6661f3e3d883d77616cede88ff17
.exe windows x64

e2a1473b0e014e6198ec40276d567ed6

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2f:b3:14:bf:9a:42:6d:4d:a7:57:49:6a:36:51:e4:f8:54:b1:3b:94
Signer

Actual PE Digest

2f:b3:14:bf:9a:42:6d:4d:a7:57:49:6a:36:51:e4:f8:54:b1:3b:94

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/03/2010, 17:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

SetLastError
HeapCreate
HeapDestroy
GetSystemInfo
HeapFree
HeapAlloc
GetVersion
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
CloseHandle
CreateEventW
CreateMutexW
GetCurrentProcess
DuplicateHandle
GetCurrentProcessId
GetCurrentThreadId
CreateProcessW
WaitForSingleObject
ReleaseMutex
SetEvent
UnmapViewOfFile
HeapSetInformation
SetErrorMode
SetUnhandledExceptionFilter
VirtualQuery
GetModuleFileNameW
CreateFileW
GetFileTime
SetEndOfFile
SetFileTime
FindResourceExW
LoadResource
GetUserDefaultUILanguage
GetFileAttributesW
FindFirstFileW
GetLastError
FindNextFileW
FindClose
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetFileType
GetConsoleMode
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
DecodePointer
EncodePointer
Sleep
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

msvcr100

_wpgmptr
memcpy_s
swprintf_s
setlocale
memmove
_wgetcwd
_errno
_wsopen_s
_close
fseek
ftell
wcsncpy_s
_wfsopen
_read
wcsncat_s
_itow_s
swscanf_s
_wsplitpath_s
_wmakepath_s
iswalpha
wcschr
wcsrchr
iswupper
iswlower
towlower
_wfindfirst64i32
_wfindnext64i32
_findclose
wcscspn
towupper
free
strcpy_s
calloc
realloc
_fileno
_get_osfhandle
__iob_func
fflush
_vcwprintf
vfwprintf
_amsg_exit
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
__crt_debugger_hook
memcpy
signal
exit
_wutime64
_wunlink
_wcserror_s
_purecall
_wstat64i32
wcscat_s
wcscpy_s
_wcsicmp
_snwprintf_s
fgetwc
memset

mspdb100

?Open2W@PDB@@SAHPEBGPEBDPEAJPEAG_KPEAPEAU1@@Z
?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2a1473b0e014e6198ec40276d567ed6

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

2f:b3:14:bf:9a:42:6d:4d:a7:57:49:6a:36:51:e4:f8:54:b1:3b:94Signer

Signature Validations

Verification

19/03/2010, 17:58 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr100

mspdb100

Sections

.text Size: 57KB - Virtual size: 56KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 100KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 6KB - Virtual size: 6KB

� Size: 512B - Virtual size: 492B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

2f:b3:14:bf:9a:42:6d:4d:a7:57:49:6a:36:51:e4:f8:54:b1:3b:94
Signer

19/03/2010, 17:58
Valid: false

.text
Size: 57KB - Virtual size: 56KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 100KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 6KB

�
Size: 512B - Virtual size: 492B