f29e1a9f6cf9f2b1e333f11b39d8674303a965db0c34a9d7ff38718bbcc6c138

Sharing

Copy URL Twitter E-mail

General

Target

f29e1a9f6cf9f2b1e333f11b39d8674303a965db0c34a9d7ff38718bbcc6c138
Size

229KB
MD5

0ac1326fc028a0da109fbde2e25ba427
SHA1

c70448a5ba776ee4e934bb33fa6653107a78ca7c
SHA256

f29e1a9f6cf9f2b1e333f11b39d8674303a965db0c34a9d7ff38718bbcc6c138
SHA512

18d7b5324682ae2e8690d16764f37796d96f061353e9b739b0cc59e503e8e47039207c8527d64389ac5d0ccf9c41e611cecd812dda9e6de7a4f7d45038a53b8c
SSDEEP

3072:ofZUVRkSiy4WhVHyZuA0RD0mdiojt3mR78R4fPUcL7ZBsGqr/Kgta6grmdOjPUj8:ooRkSirZuAa88WnfXdBBqbKgUcis/gd

Score

N/A

Malware Config

Signatures

Files

f29e1a9f6cf9f2b1e333f11b39d8674303a965db0c34a9d7ff38718bbcc6c138
.exe windows x86

77d98ed530ed11365e9970e9c773a3d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/07/2010, 00:00

Not After

18/08/2011, 23:59

Subject

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:58:33:53:88:e8:ef:1f:fa:ba:0e:4a:36:60:0f:78:ba:a1:f8:f8
Signer

Actual PE Digest

b0:58:33:53:88:e8:ef:1f:fa:ba:0e:4a:36:60:0f:78:ba:a1:f8:f8

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

18/07/2011, 23:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
SetEvent
WaitForMultipleObjects
GetDiskFreeSpaceW
GetSystemDefaultLangID
GetFullPathNameA
CreateEventA
ExpandEnvironmentStringsW
lstrcatA
SetComputerNameW
GetSystemDefaultLCID
FileTimeToLocalFileTime
GetTempFileNameW
CopyFileExA
lstrlenW
SearchPathW
lstrcmpiA
MoveFileA
GetProcAddress
lstrcpynA
GlobalAlloc
GetModuleHandleW
GetAtomNameW
CreateMailslotW
lstrcpyA
FindAtomA
OpenSemaphoreW
InitializeCriticalSection
LoadLibraryA
OpenMutexW
QueryPerformanceCounter
GetTempPathA
lstrcpy
GetProcessHeaps
GetLongPathNameA
FindResourceW
lstrlenA
LoadLibraryA
GetNumberFormatA
GlobalDeleteAtom
GetModuleFileNameW
GlobalGetAtomNameA
GetLogicalDrives
GetLongPathNameW
GetThreadPriority
WinExec
IsBadStringPtrW
GetSystemDirectoryW
EnumTimeFormatsA

user32

LoadMenuW
CreateDialogIndirectParamW
EnumWindows
EnableMenuItem
GetCursorPos
IsMenu
LoadBitmapW
RemoveMenu
GetMessageA
CreateAcceleratorTableW
SetDlgItemTextA
RegisterWindowMessageW
SetActiveWindow
CreateDialogIndirectParamA
MessageBoxIndirectA
EndMenu
InsertMenuA
GetKeyboardType
OpenClipboard
wsprintfW

gdi32

SetMetaFileBitsEx
CreateICA
GetMetaFileW
GetEnhMetaFileW
SelectBrushLocal
RemoveFontResourceExW
UpdateICMRegKeyA
CreateMetaFileW
AddFontResourceW
AddFontResourceA
CreateFontA
CreateColorSpaceA
GetTextExtentPointW
CreateBrushIndirect
TranslateCharsetInfo
UpdateICMRegKeyW

ole32

IsValidIid
CoGetClassObject

setupapi

CM_Query_And_Remove_SubTree_ExA
CM_Get_Class_Registry_PropertyA
CM_Add_ID_ExW

wininet

FreeUrlCacheSpaceW
InternetQueryOptionA
InternetSetCookieW
InternetTimeFromSystemTimeW
FindFirstUrlCacheContainerA

Sections

.sqlBuW
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZmZkmp
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.RO
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dau
Size: 3KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UyC
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SENzh
Size: 11KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.T
Size: 4KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77d98ed530ed11365e9970e9c773a3d6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

b0:58:33:53:88:e8:ef:1f:fa:ba:0e:4a:36:60:0f:78:ba:a1:f8:f8Signer

Signature Validations

Verification

18/07/2011, 23:04 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

setupapi

wininet

Sections

.sqlBuW Size: 5KB - Virtual size: 4KB

.ZmZkmp Size: 85KB - Virtual size: 85KB

.RO Size: 14KB - Virtual size: 14KB

.dau Size: 3KB - Virtual size: 38KB

.UyC Size: 83KB - Virtual size: 83KB

.SENzh Size: 11KB - Virtual size: 108KB

.T Size: 4KB - Virtual size: 65KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

b0:58:33:53:88:e8:ef:1f:fa:ba:0e:4a:36:60:0f:78:ba:a1:f8:f8
Signer

18/07/2011, 23:04
Valid: false

.sqlBuW
Size: 5KB - Virtual size: 4KB

.ZmZkmp
Size: 85KB - Virtual size: 85KB

.RO
Size: 14KB - Virtual size: 14KB

.dau
Size: 3KB - Virtual size: 38KB

.UyC
Size: 83KB - Virtual size: 83KB

.SENzh
Size: 11KB - Virtual size: 108KB

.T
Size: 4KB - Virtual size: 65KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 1024B - Virtual size: 1024B