6b7d68e319bb4a344c6d7493d2ef66c75d6750eb26fe079675e6e3293faaf641

Sharing

Copy URL

Twitter E-mail

General

Target

6b7d68e319bb4a344c6d7493d2ef66c75d6750eb26fe079675e6e3293faaf641
Size

245KB
MD5

8450812399417a4ae5852e3fee5a7420
SHA1

262880952cc3085c418e581096a9c525c32cd522
SHA256

6b7d68e319bb4a344c6d7493d2ef66c75d6750eb26fe079675e6e3293faaf641
SHA512

ba43c89a3d23e35c3a97019b0e4105b8e9cc13fb9db5aa08bd8603a245ab0a0848c4477b1915c5ceaa3f7b1da1136edc85821c7907520cd9f63a92cf18370ed6
SSDEEP

6144:qkAlZN0AkWARPY5OrfyI5+hKJiabSXcPs1xS5xo2+y:qkA2WARgjhMi2cw5uK

Score

N/A

Malware Config

Signatures

Files

6b7d68e319bb4a344c6d7493d2ef66c75d6750eb26fe079675e6e3293faaf641
.exe windows x86

34b44fe53da24e14b1f09a9dfef8fa83

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/02/2009, 00:00

Not After

11/02/2012, 23:59

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
CreateFileMappingA
GlobalFindAtomW
lstrcmpiW
CreateMutexA
GetModuleHandleW
InitializeCriticalSection
MoveFileA
GetPriorityClass
RemoveDirectoryA
GetWindowsDirectoryW
GetUserDefaultLCID
DeleteAtom
CreateFiber
GetStringTypeA
WaitForMultipleObjects
GetSystemDirectoryW
GetNamedPipeInfo
CreateThread
IsDebuggerPresent
GetCalendarInfoW
VirtualAlloc
GetCommandLineW
SearchPathW
GetEnvironmentVariableW
GlobalGetAtomNameW

user32

InsertMenuItemA
DefWindowProcA
EndMenu
DefDlgProcW
GetDlgItem
LoadBitmapW
GetWindowTextLengthW
GetWindowTextA
LoadCursorA
SetCapture
IsDlgButtonChecked

gdi32

PolyPolyline
CreateDCW
BitBlt
GetNearestPaletteIndex
SetViewportExtEx
GetPath
GetCurrentPositionEx
CreateSolidBrush
ResetDCW
GetOutlineTextMetricsW
GetBkMode
SetPixelV
GetLayout
GetDIBColorTable
CreateColorSpaceW
SetICMMode
ScaleWindowExtEx

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumValueA
RegOpenKeyExW

shlwapi

SHSetThreadRef
PathIsPrefixA
UrlIsA

opengl32

wglDeleteContext

wininet

InternetCanonicalizeUrlA
InternetCanonicalizeUrlW
RetrieveUrlCacheEntryFileA
FtpFindFirstFileW
UrlZonesDetach
InternetFortezzaCommand
InternetSetOptionExA
SetUrlCacheEntryGroup
FindNextUrlCacheEntryW
HttpOpenRequestA
InternetOpenA
DetectAutoProxyUrl
InternetShowSecurityInfoByURLW
FtpRemoveDirectoryW
InternetCreateUrlW

urlmon

IsLoggingEnabledW

winspool.drv

EnumPrinterDataExW
StartDocPrinterW
QueryRemoteFonts
EnumPrinterDataW
AdvancedDocumentPropertiesW

inetcomm

CreateRASTransport
MimeOleGetContentTypeExt
EssSecurityLabelDecodeEx
MimeOleGenerateFileName
HrAttachDataFromFile
MimeOleGetBodyPropA
DllGetClassObject
MimeOleCreateHeaderTable

sqlunirl

newMultiByteFromWideCharSize
_SetDefaultCommConfig_@12
_ShellExecuteEx_@4
_EnumFonts_@16
_ExtractAssociatedIcon_@12
_CreateFont@56
_PropertySheet_@4
_strerror_@4
_DefDlgProc_@16

crypt32

RegOpenHKCUKeyExU
CertFreeCertificateChainEngine
CertFindCRLInStore
CryptBinaryToStringW
CryptCloseAsyncHandle
CertFindCTLInStore
CryptHashMessage
CryptEncryptMessage
I_CryptEnableLruOfEntries
I_CryptGetDefaultCryptProvForEncrypt

Sections

.4@+
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.5
Size: 2KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.'pwb,
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.0,,X@#
Size: 1024B - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.K<f
Size: 4KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Ab>q")
Size: 1024B - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34b44fe53da24e14b1f09a9dfef8fa83

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

opengl32

wininet

urlmon

winspool.drv

inetcomm

sqlunirl

crypt32

Sections

.4@+ Size: 11KB - Virtual size: 11KB

.5 Size: 2KB - Virtual size: 46KB

.'pwb, Size: 3KB - Virtual size: 3KB

.0,,X@# Size: 1024B - Virtual size: 34KB

.K<f Size: 4KB - Virtual size: 34KB

.Ab>q") Size: 1024B - Virtual size: 29KB

.rsrc Size: 214KB - Virtual size: 213KB

.reloc Size: 1024B - Virtual size: 36KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

.4@+
Size: 11KB - Virtual size: 11KB

.5
Size: 2KB - Virtual size: 46KB

.'pwb,
Size: 3KB - Virtual size: 3KB

.0,,X@#
Size: 1024B - Virtual size: 34KB

.K<f
Size: 4KB - Virtual size: 34KB

.Ab>q")
Size: 1024B - Virtual size: 29KB

.rsrc
Size: 214KB - Virtual size: 213KB

.reloc
Size: 1024B - Virtual size: 36KB