b0733a71dfd3f08778747a03206b42ed4cbaec6e6c8309fd13413218f88f2f79

Sharing

Copy URL Twitter E-mail

General

Target

b0733a71dfd3f08778747a03206b42ed4cbaec6e6c8309fd13413218f88f2f79
Size

241KB
MD5

be412391d1315eda3a6db17ac50e6fc1
SHA1

2738bdd8c3f81632862900174f778b3ecc97f483
SHA256

b0733a71dfd3f08778747a03206b42ed4cbaec6e6c8309fd13413218f88f2f79
SHA512

b9a1e16b36be7414775ec05cb75b7ac560850651388f5389231d2ca0e0dc950454c502b4eeab21bdca1426ec699a69e1cc9c1ace01872cd8aa321db24eaa5c16
SSDEEP

6144:PmDraZRT1YiICtg19qIvrjN5X3IS7MAt8DiZ:e3aZR9OPqUfX4S78DiZ

Score

N/A

Malware Config

Signatures

Files

b0733a71dfd3f08778747a03206b42ed4cbaec6e6c8309fd13413218f88f2f79
.exe windows x86

ce14c03f64505da3cf417bf04b713705

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:76:2f:ba:c0:02:f9:a8:d8:2c:9a:7c:9a:4d:6d:4e:f2:8c:41:f6
Signer

Actual PE Digest

79:76:2f:ba:c0:02:f9:a8:d8:2c:9a:7c:9a:4d:6d:4e:f2:8c:41:f6

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/05/2013, 21:09
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetStdHandle
GetCommandLineA
OutputDebugStringA
FreeResource
ReadFile
CreateEventA
CreateThread
WaitForSingleObject
GetComputerNameA
ExitThread
CreateSemaphoreA
WriteFile
SizeofResource
GetSystemDirectoryA
GetLastError
AllocConsole
LoadLibraryA
GetTickCount
GetCommandLineW
lstrcatA
FatalExit
SetFilePointer

user32

SendMessageA
CloseClipboard
GetDoubleClickTime
RegisterClassA
InSendMessageEx
DispatchMessageA
GetCaretBlinkTime
GetFocus
GetDialogBaseUnits
EndMenu
GetCursor
SetDoubleClickTime
LoadCursorA
GetClassInfoExA
IsChild
GetMessageTime
MessageBoxA
UpdateWindow
ReleaseCapture
BeginPaint
GetActiveWindow
GetForegroundWindow
DestroyCursor
CreateDialogParamA
InSendMessage
ReleaseDC
DestroyWindow
OpenClipboard
IsWindow

ole32

CoInitialize
CoFreeAllLibraries

gdi32

GdiFlush
LineTo

shlwapi

SHReleaseThreadRef

shell32

CommandLineToArgvW

winmm

timeGetTime

winspool.drv

ClosePrinter
GetPrinterDriverA

Sections

.text
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ce14c03f64505da3cf417bf04b713705

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33Certificate

Extended Key Usages

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

79:76:2f:ba:c0:02:f9:a8:d8:2c:9a:7c:9a:4d:6d:4e:f2:8c:41:f6Signer

Signature Validations

Verification

13/05/2013, 21:09 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

ole32

gdi32

shlwapi

shell32

winmm

winspool.drv

Sections

.text Size: 217KB - Virtual size: 217KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 856B

.reloc Size: 9KB - Virtual size: 9KB

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

79:76:2f:ba:c0:02:f9:a8:d8:2c:9a:7c:9a:4d:6d:4e:f2:8c:41:f6
Signer

13/05/2013, 21:09
Valid: false

.text
Size: 217KB - Virtual size: 217KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 9KB - Virtual size: 9KB