6b5bb9e136b30bbd703a6d02c414c0debb066305f1d2cdda7d11397c59cd857e

Sharing

Copy URL Twitter E-mail

General

Target

6b5bb9e136b30bbd703a6d02c414c0debb066305f1d2cdda7d11397c59cd857e
Size

230KB
MD5

512705aa315ed8c330a10a3f5af01845
SHA1

093bffd5ce1747f35efaf4128b43a1bae3dfbb47
SHA256

6b5bb9e136b30bbd703a6d02c414c0debb066305f1d2cdda7d11397c59cd857e
SHA512

779836c71fc174192d6cf3fc286d6c017ac0d89de025ab578d9a530e12749393b87d3c12d048acbf4ba1d498a49f1592c9544838526938f6209765269a80e5b2
SSDEEP

3072:Wyill44WhjvjJdeYPzVaBKpNn9PyekNcWM0MSgmI+dyiWGCXVJA+QntzcMEmcq3m:Wy/14YhWw0K9bmI+kiOItRcq3hU8Af

Score

N/A

Malware Config

Signatures

Files

6b5bb9e136b30bbd703a6d02c414c0debb066305f1d2cdda7d11397c59cd857e
.exe windows x86

a6856b195d7489635f05ad7ee2a197bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02/12/2008, 00:00

Not After

02/12/2011, 23:59

Subject

CN=Sophos Plc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sophos Plc,L=Abingdon,ST=Oxfordshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

81:e3:1b:2f:09:76:a9:a9:f8:73:a4:78:6a:21:4c:ad:59:a2:0e:2e
Signer

Actual PE Digest

81:e3:1b:2f:09:76:a9:a9:f8:73:a4:78:6a:21:4c:ad:59:a2:0e:2e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Sophos Plc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sophos Plc,L=Abingdon,ST=Oxfordshire,C=GB

28/05/2010, 13:24
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadPriority
GetProcessHeap
ReplaceFileW
LoadLibraryExA
WinExec
LoadLibraryA
lstrcmp
lstrcpynA
GetVolumeInformationA
GetModuleFileNameA
GetProcAddress
LocalFree
GetDiskFreeSpaceW
GetVersionExW
GetModuleFileNameW
GetEnvironmentVariableW
RaiseException
MoveFileW
GlobalGetAtomNameA
OpenMutexW
GetStringTypeW
GetLongPathNameW
LocalAlloc
GetLocalTime
CreateEventW
SetComputerNameA
GetCurrentProcessId
EnumCalendarInfoA
GetHandleInformation
Sleep
CreateEventA
GetSystemDefaultLCID
CopyFileExW
IsValidCodePage
GetProcessHeaps
GlobalDeleteAtom
WaitForMultipleObjects
lstrcpyA
SetCurrentDirectoryA

user32

InvalidateRgn
SetWindowPos
GetMenuStringA
WaitForInputIdle
RegisterClassExA
LoadBitmapW
ShowCaret
MonitorFromRect
GetCapture
ShowWindow
SetDlgItemInt
EndMenu
PeekMessageA
CreateAcceleratorTableA
MessageBoxW
DestroyCursor
InsertMenuItemA
WinHelpA
MonitorFromPoint
GetClassInfoExA
FindWindowW
IsMenu
LoadCursorW
GetClassInfoA
PostMessageA
GetKeyboardLayout
RemoveMenu
GetMenuStringW
SetWindowLongW
GetMenuItemRect
SendDlgItemMessageA
OffsetRect
GetMenu
IsIconic
GetScrollPos
DestroyIcon
InsertMenuItemW
wvsprintfA
LoadIconA
CheckMenuItem
EmptyClipboard
RegisterClassW
CharNextA
CharPrevW
UnregisterClassA
ShowCursor
wsprintfA
CharLowerA
TrackPopupMenuEx
keybd_event
WaitMessage
GetForegroundWindow
DialogBoxParamA
RegisterClassExW
AppendMenuW
CreateWindowExA
CharLowerW
CharNextW
LoadImageA
SetDlgItemTextW
GetMessageW
GetMenuState
GetMenuItemInfoW
UnregisterClassW
CreateDialogParamA
EnableWindow
GetKeyboardType
GetClassInfoExW
DialogBoxIndirectParamA
CreateDesktopA
GetCursorPos
DestroyMenu
MessageBeep
GetDCEx
GetActiveWindow
InsertMenuA
LoadMenuIndirectA
CreateDialogIndirectParamA
wsprintfW
GetKeyState
GetSystemMetrics
PeekMessageW
SetDlgItemTextA
DialogBoxParamW
MonitorFromWindow
FindWindowA
MessageBoxIndirectW
GetClassInfoW
AppendMenuA

gdi32

CreatePolygonRgn
CreateScalableFontResourceA
CreateSolidBrush
CreateDIBPatternBrushPt
GetRasterizerCaps
UpdateICMRegKeyW
CreateMetaFileA
CreateICA
GetStockObject
GetEnhMetaFilePixelFormat
GdiGetBatchLimit
GetEnhMetaFileW
RemoveFontResourceExW
GetMetaFileW
CreateBitmap
GetMetaFileA
CreateDIBPatternBrush
CreateFontIndirectW
CreatePen
CreateFontA
SetMetaFileBitsEx
TranslateCharsetInfo

shell32

Shell_NotifyIconA
StrRStrIW
StrChrW
SHCreateDirectoryExA
StrCmpNA
StrStrIW
ExtractAssociatedIconW
SHGetFolderPathA

comdlg32

GetSaveFileNameW
PrintDlgA
FindTextA
PageSetupDlgA
GetFileTitleW
GetOpenFileNameW
GetSaveFileNameA

ole32

CoCreateInstance

urlmon

CoInternetQueryInfo
CoInternetGetSession
URLDownloadA
CoInstall
CoInternetCreateSecurityManager
CoGetClassObjectFromURL
HlinkNavigateMoniker
RegisterMediaTypes
CoInternetCombineUrl
CoInternetCompareUrl
RegisterMediaTypeClass
CreateURLMoniker
FindMimeFromData

wsock32

htons
WSAAsyncGetServByName
WSAAsyncGetProtoByName
WSAUnhookBlockingHook
GetServiceA
rresvport
accept
GetAcceptExSockaddrs
GetServiceW
inet_addr
WSARecvEx
getnetbyname
WSAGetLastError
ntohl
ioctlsocket
SetServiceA

Sections

.RU
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ssrPLC
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.RNcIsm
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Zq
Size: 5KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.D
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.N
Size: 10KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Q
Size: 3KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6856b195d7489635f05ad7ee2a197bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cbCertificate

Extended Key Usages

Key Usages

81:e3:1b:2f:09:76:a9:a9:f8:73:a4:78:6a:21:4c:ad:59:a2:0e:2eSigner

Signature Validations

Verification

28/05/2010, 13:24 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

urlmon

wsock32

Sections

.RU Size: 4KB - Virtual size: 3KB

.ssrPLC Size: 90KB - Virtual size: 90KB

.RNcIsm Size: 13KB - Virtual size: 13KB

.Zq Size: 5KB - Virtual size: 43KB

.D Size: 88KB - Virtual size: 88KB

.N Size: 10KB - Virtual size: 129KB

.Q Size: 3KB - Virtual size: 132KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

42:35:34:0f:b5:e0:b7:68:74:26:e3:8d:d4:2c:56:cb
Certificate

81:e3:1b:2f:09:76:a9:a9:f8:73:a4:78:6a:21:4c:ad:59:a2:0e:2e
Signer

28/05/2010, 13:24
Valid: false

.RU
Size: 4KB - Virtual size: 3KB

.ssrPLC
Size: 90KB - Virtual size: 90KB

.RNcIsm
Size: 13KB - Virtual size: 13KB

.Zq
Size: 5KB - Virtual size: 43KB

.D
Size: 88KB - Virtual size: 88KB

.N
Size: 10KB - Virtual size: 129KB

.Q
Size: 3KB - Virtual size: 132KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 1024B