bc48cc6c478e374bc6286277c7efb3d1b315832dfe911f3feb6e00b1270ee323

Sharing

Copy URL Twitter E-mail

General

Target

bc48cc6c478e374bc6286277c7efb3d1b315832dfe911f3feb6e00b1270ee323
Size

1.3MB
MD5

689b7d1d80bed6f750f9d8c468a764d6
SHA1

51d59ef9f8d547db1dd85402b872585f1bc305ee
SHA256

bc48cc6c478e374bc6286277c7efb3d1b315832dfe911f3feb6e00b1270ee323
SHA512

f5c51adc048b99454e6714afa79bc1e36bd83709bc472033e9ffd2d6b1f54614fc97fa43c04e3d93aa62ce614502f37f88f5545ed8103d8c1c597e4497ea63ef
SSDEEP

12288:dxqbhiyesdlEzj957tfUifuHlHCoH/MW/Wm7MDgTuaZxZMma:dxGcYEzj9GFJJt7kgqSM

Score

N/A

Malware Config

Signatures

Files

bc48cc6c478e374bc6286277c7efb3d1b315832dfe911f3feb6e00b1270ee323
.exe windows x86

92324820b1dc1d935e0da95a32ee164e

Code Sign

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:01:c6:c1:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 20:39

Not After

22/01/2010, 20:49

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

7a:61:dd:23:eb:4a:29:d9:ba:8c:92:25:cd:f1:0b:c2:5d:55:06:0e
Signer

Actual PE Digest

7a:61:dd:23:eb:4a:29:d9:ba:8c:92:25:cd:f1:0b:c2:5d:55:06:0e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

08/03/2009, 23:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CloseServiceHandle
OpenSCManagerW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW

kernel32

CreateMutexW
ExpandEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleW
ReadFile
GetFileSize
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
LocalFree
GetSystemDefaultUILanguage
WriteFile
lstrcmpW
FlushFileBuffers
GetTickCount
GetLocalTime
SetFilePointer
SetLastError
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetExitCodeProcess
WaitForMultipleObjects
CreateProcessW
GetSystemDirectoryW
SystemTimeToFileTime
DeleteCriticalSection
WaitForSingleObject
SetEvent
CreateThread
CreateEventW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalAlloc
GetCurrentProcessId
CopyFileW
GetDriveTypeW
GetSystemTime
GlobalMemoryStatusEx
GetSystemDefaultLangID
GetUserDefaultLangID
EnumUILanguagesW
GetExitCodeThread
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemInfo
GetCommandLineW
FindFirstFileW
MoveFileExW
FindNextFileW
FindClose
lstrcmpiW
GetCurrentProcess
GetLastError
CloseHandle
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
OutputDebugStringA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
MulDiv
CompareFileTime
UnhandledExceptionFilter

gdi32

CreatePatternBrush
CreateCompatibleDC
BitBlt
CreateSolidBrush
SetTextColor
SetBkMode
GetStockObject
SelectObject
GetTextMetricsW
GetTextFaceA
CreateFontA
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
SetBrushOrgEx

user32

CopyRect
KillTimer
RedrawWindow
UpdateWindow
EndPaint
BeginPaint
PeekMessageW
MsgWaitForMultipleObjectsEx
EnableWindow
SetFocus
GetMenuState
LoadImageW
DestroyIcon
LoadIconW
SetTimer
GetFocus
DestroyWindow
IsWindow
PostMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
SendDlgItemMessageW
SendMessageW
ShowWindow
PostQuitMessage
LoadBitmapW
UnionRect
ClientToScreen
PtInRect
InflateRect
CheckDlgButton
IsDlgButtonChecked
GetSystemMenu
EnableMenuItem
SetWindowTextW
GetSysColor
CharToOemW
GetClientRect
MapWindowPoints
MoveWindow
ReleaseDC
SetCursor
CallWindowProcW
DrawFocusRect
DrawTextW
LoadCursorW
GetParent
GetDlgCtrlID
DestroyCursor
CharNextW
CharUpperBuffW
ExitWindowsEx
LoadStringW
CreateDialogParamW
GetDC
SetWindowLongW
SystemParametersInfoW
GetWindowLongW
GetDesktopWindow
SetDlgItemTextW
IsChild
GetWindowRect
SetWindowPos
OffsetRect

msvcrt

iswctype
?terminate@@YAXXZ
_controlfp
calloc
isdigit
mbtowc
isleadbyte
isxdigit
localeconv
wctomb
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
malloc
ungetc
__p__fmode
__p__commode
??3@YAXPAX@Z
??_V@YAXPAX@Z
_wtol
memset
??_U@YAPAXI@Z
??2@YAPAXI@Z
_vsnwprintf
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
__mb_cur_max
__set_app_type
_errno
_purecall
wcschr
free
_wcsdup
_itow
towupper
memcpy
_wtoi
wcstoul
wcsstr
iswdigit
_amsg_exit

comctl32

InitCommonControlsEx

ole32

StringFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
CLSIDFromString

oleaut32

SysFreeString
VariantClear
SysAllocString

psapi

GetModuleFileNameExW

setupapi

SetupGetLineTextW
SetupOpenInfFileW
SetupCloseInfFile

shell32

ShellExecuteW
CommandLineToArgvW
SHFileOperationW
SHGetDiskFreeSpaceExW
SHGetFolderPathW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

ord388
PathRemoveFileSpecW
PathFileExistsW
SHRegGetUSValueW
StrStrW
SHDeleteKeyW
PathCombineW
PathIsRelativeW
SHGetValueW
PathIsDirectoryW
SHRegSetUSValueW
PathUnquoteSpacesW
PathStripToRootW
ord437
PathQuoteSpacesW
PathFindFileNameW
ord158
SHRegGetValueW
PathAppendW

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 874KB - Virtual size: 876KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

�b
Size: 235KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92324820b1dc1d935e0da95a32ee164e

Code Sign

61:04:ca:69:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:01:c6:c1:00:00:00:00:00:07Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

7a:61:dd:23:eb:4a:29:d9:ba:8c:92:25:cd:f1:0b:c2:5d:55:06:0eSigner

Signature Validations

Verification

08/03/2009, 23:58 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

ole32

oleaut32

psapi

setupapi

shell32

version

shlwapi

Sections

.text Size: 179KB - Virtual size: 178KB

.data Size: 1KB - Virtual size: 32KB

.rsrc Size: 874KB - Virtual size: 876KB

.reloc Size: 12KB - Virtual size: 11KB

�b Size: 235KB - Virtual size: 236KB

61:04:ca:69:00:00:00:00:00:08
Certificate

61:01:c6:c1:00:00:00:00:00:07
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

7a:61:dd:23:eb:4a:29:d9:ba:8c:92:25:cd:f1:0b:c2:5d:55:06:0e
Signer

08/03/2009, 23:58
Valid: false

.text
Size: 179KB - Virtual size: 178KB

.data
Size: 1KB - Virtual size: 32KB

.rsrc
Size: 874KB - Virtual size: 876KB

.reloc
Size: 12KB - Virtual size: 11KB

�b
Size: 235KB - Virtual size: 236KB