12824adb0f9d5451372a58bd79741b62ccd0476c978574497c929fe362c6745c

Sharing

Copy URL Twitter E-mail

General

Target

12824adb0f9d5451372a58bd79741b62ccd0476c978574497c929fe362c6745c
Size

1.9MB
MD5

84a4acfc06ca0f4744dc88c6f605d24d
SHA1

24ce33811d2c4f607e4cbea5234901a95f83b044
SHA256

12824adb0f9d5451372a58bd79741b62ccd0476c978574497c929fe362c6745c
SHA512

6876609481d7344bb75cb51eb6a8e1401d50b6dadcb538b7ab15932d952813cfa5891dafa6cd65cae3a66dc1719bee9c95aedde6a39bfe4785fcaf9f1f12871b
SSDEEP

24576:XGTTrNJOO09vpFMLcdJSo3COE6s+ikSHq367F6g8UAkxrxZPDPVCh0y:XGTZJZKzMYv1pE6ifMW3V9ZPDPVCh0

Score

N/A

Malware Config

Signatures

Files

12824adb0f9d5451372a58bd79741b62ccd0476c978574497c929fe362c6745c
.exe windows x86

e29afbfb52dc8426384a65d4695b86ec

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ca:6d:19:cb:66:64:69:a3:48:2a:83:14:38:b7:b7:3d:16:25:75:9c
Signer

Actual PE Digest

ca:6d:19:cb:66:64:69:a3:48:2a:83:14:38:b7:b7:3d:16:25:75:9c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

18/11/2010, 03:56
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_fpreset
rand
wcsstr
wcstod
_wcsnicmp
iswspace
wcschr
memmove
_wtoi
_configthreadlocale
_CIasin
_CIacos
_CIsinh
_CIcosh
_CItanh
floor
_CIexp
_CIlog
_CIsqrt
_CIatan
_CItan
_finite
_CIpow
_CIcos
_CIsin
_wcsicmp
strncmp
ceil
wcsncmp
_set_purecall_handler
_CxxThrowException
memset
memcpy
__setusermatherr
_CIfmod
vswprintf_s
_vscwprintf
_fpclass
_CIatan2
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_crt_debugger_hook
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
_adjust_fdiv

kernel32

FindFirstFileW
GetTempPathW
WriteFile
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
ResetEvent
WaitForMultipleObjects
SetEvent
GetCurrentThread
SetThreadPriority
CreateEventW
ResumeThread
CreateThread
GetPrivateProfileStringA
Sleep
GetUserDefaultLCID
lstrcmpW
LocalFree
GetLocalTime
GetFullPathNameW
FindResourceExA
EnumCalendarInfoA
GetUserDefaultLangID
GetLocaleInfoW
GetLocaleInfoA
EnumTimeFormatsA
EnumDateFormatsA
EnumTimeFormatsW
EnumDateFormatsW
GetSystemDefaultLCID
IsValidCodePage
GetOEMCP
VirtualProtect
FindClose
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
lstrlenW
DeleteFileW
SetErrorMode
GetStartupInfoW
CreateProcessW
GetTempFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
WaitForSingleObject
GetTickCount
CreateEventA
GetCurrentThreadId
GetCommandLineW
CreateFileW
GetFileSize
ReadFile
SetFilePointer
GetCurrentDirectoryW
GetLongPathNameW
SetCurrentDirectoryW
CloseHandle
GetVersionExA
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
LoadLibraryA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetVersion
FindResourceW
SizeofResource
LoadResource
LockResource
GetStringTypeExW
GetSystemDefaultLangID
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MulDiv
GlobalAlloc
GlobalSize
RaiseException
GlobalUnlock
GlobalLock
GlobalFree
GlobalMemoryStatus
IsValidLocale
TlsAlloc
FormatMessageW
TlsSetValue
TlsGetValue
TlsFree
FoldStringW
GetStringTypeW
CompareStringW
HeapSize
HeapFree
HeapAlloc
LocalAlloc
QueryPerformanceCounter

gdi32

LPtoDP
CreateBitmap
CreateCompatibleBitmap
GetTextAlign
DeleteMetaFile
DeleteEnhMetaFile
CopyMetaFileA
GetMetaFileW
CopyEnhMetaFileA
SetStretchBltMode
StretchDIBits
CreateFontA
EnumFontFamiliesExA
GetBitmapBits
TextOutW
GetGlyphOutlineW
GetCharABCWidthsA
GetKerningPairsA
Escape
GetViewportExtEx
GetWindowExtEx
CreatePen
IntersectClipRect
RestoreDC
GetEnhMetaFileW
GetTextFaceA
GetFontData
CreateFontIndirectW
CreateHalftonePalette
EndPage
StartPage
EndDoc
StartDocW
GetCharWidthA
GetCharWidthW
GetTextCharset
ExtTextOutW
StretchBlt
OffsetViewportOrgEx
CreateDIBSection
CreateCompatibleDC
GetClipBox
MoveToEx
LineTo
GetCurrentObject
AnimatePalette
Pie
GdiFlush
Rectangle
Polygon
Ellipse
GetViewportOrgEx
SetTextAlign
SetBkMode
SetTextColor
EnumMetaFile
EnumEnhMetaFile
PlayMetaFileRecord
PlayEnhMetaFileRecord
CreateSolidBrush
BitBlt
CreateDCW
SetMapMode
SetWindowOrgEx
DeleteDC
GetRasterizerCaps
GetObjectW
CreatePalette
GetSystemPaletteUse
GetSystemPaletteEntries
GetPaletteEntries
UpdateColors
GetRgnBox
SelectPalette
RealizePalette
GetTextColor
SelectClipRgn
GetStockObject
SetBkColor
ExtTextOutA
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
GetTextMetricsA
GetDeviceCaps
SelectObject
CreateFontIndirectA
GetObjectA
DeleteObject
EnumFontFamiliesExW
GetOutlineTextMetricsW
GetTextMetricsW
GetTextFaceW
GetTextCharsetInfo
SaveDC

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
CryptGenRandom
RegQueryValueExW

ole32

CoCreateInstance
OleLockRunning
StgOpenStorageOnILockBytes
GetHGlobalFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
GetHGlobalFromILockBytes
CreateStreamOnHGlobal
StgOpenStorage
CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString
VariantInit
SysAllocString
SysStringLen
VariantCopy
SysAllocStringLen
GetErrorInfo
VarR8FromStr
VariantChangeTypeEx
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

mpr

WNetGetConnectionW

Exports

Exports

_MsoDeletePx@12
_MsoEmptyPx@4
_MsoFCompactPx@8
_MsoFGrowPx@8
_MsoFInitPx@12
_MsoFInsertPx@12
_MsoFIsDefault@8
_MsoFIsNinch@8
_MsoFIsValidOpid@4
_MsoFIsValidValue@8
_MsoFLookupPx@16
_MsoFRemovePx@12
_MsoFResizePx@12
_MsoGetPropSetDefault@8
_MsoIAppendPx@8
_MsoPopinfoGet@4
_MsoPopsinfoGet@4

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e29afbfb52dc8426384a65d4695b86ec

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

ca:6d:19:cb:66:64:69:a3:48:2a:83:14:38:b7:b7:3d:16:25:75:9cSigner

Signature Validations

Verification

18/11/2010, 03:56 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

kernel32

gdi32

advapi32

ole32

oleaut32

version

urlmon

mpr

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 39KB - Virtual size: 319KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 131KB - Virtual size: 130KB

.reloc Size: 87KB - Virtual size: 87KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

ca:6d:19:cb:66:64:69:a3:48:2a:83:14:38:b7:b7:3d:16:25:75:9c
Signer

18/11/2010, 03:56
Valid: false

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 39KB - Virtual size: 319KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 131KB - Virtual size: 130KB

.reloc
Size: 87KB - Virtual size: 87KB