b27f1cc02c834e9f3efab3e3d9164bef20659a58e2ba971e1fffc1ceaeffaadf

Sharing

Copy URL Twitter E-mail

General

Target

b27f1cc02c834e9f3efab3e3d9164bef20659a58e2ba971e1fffc1ceaeffaadf
Size

64KB
MD5

92b0e2ebece9a1540c4484ca0d2795a0
SHA1

83a8221d9fa19c393c4a3f930e76e92301409be1
SHA256

b27f1cc02c834e9f3efab3e3d9164bef20659a58e2ba971e1fffc1ceaeffaadf
SHA512

cfb964781a339c43eae48c383db88f75ddb21707f65a93d8c9e939cc4bb41c0dcd8f0d8b334bcee067cdc0f6b3ca16a6136d6e7e206039d7aec453b165728f31
SSDEEP

1536:s7E21nFm2JDUKdlOBrKEiwIGJ/AT5XCrumDU1biK:s7E2nISUKle29yoQrXDUxR

Score

N/A

Malware Config

Signatures

Files

b27f1cc02c834e9f3efab3e3d9164bef20659a58e2ba971e1fffc1ceaeffaadf
.exe windows x86

34085480855ea853fdade81d9784775c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SwitchToFiber
Process32Next
_lread
LocalUnlock
PrepareTape
UnlockFileEx
TerminateThread
BackupSeek
SizeofResource
WriteConsoleOutputAttribute
PeekNamedPipe
GetLongPathNameA
MapViewOfFile
MulDiv
ContinueDebugEvent
DeleteAtom
GetTimeZoneInformation
SearchPathA
GetExitCodeThread
lstrcpyn
SetFilePointer
CreateThread
EnumResourceLanguagesA
GetConsoleTitleA
GetCommConfig
FindNextChangeNotification
IsDBCSLeadByteEx
DeleteFileA
GetProcessVersion
_llseek
DisconnectNamedPipe
GlobalAddAtomA
GetUserDefaultLangID
Heap32ListNext
TlsSetValue
WaitNamedPipeA
OpenEventA
FoldStringA
TlsFree
AreFileApisANSI
LocalShrink
FindCloseChangeNotification
OpenFileMappingA
lstrcpy
GetCommState
SetConsoleOutputCP
FindFirstFileA
lstrcat
OpenSemaphoreA
SetDefaultCommConfigA
ClearCommBreak
GetCommModemStatus
GlobalCompact
GetModuleFileNameA
SetConsoleCtrlHandler
FillConsoleOutputAttribute
GetOverlappedResult
GetProcessHeaps

shlwapi

StrToIntExA
PathAppendA
StrCSpnA
ColorHLSToRGB
PathQuoteSpacesA
SHRegWriteUSValueA
PathSearchAndQualifyA
PathMakePrettyA
StrFormatByteSize64A
StrIsIntlEqualA
AssocQueryStringA
PathIsRelativeA
HashData
StrRChrIA
PathFindOnPathA
PathGetDriveNumberA
PathCommonPrefixA
StrSpnA
SHAutoComplete
UrlCombineA
SHDeleteValueA
PathIsUNCA
PathIsFileSpecA
SHRegCreateUSKeyA
PathFileExistsA
StrChrIA
PathStripToRootA
UrlIsOpaqueA
PathRemoveBlanksA
SHRegOpenUSKeyA
SHRegEnumUSKeyA
UrlGetLocationA

advapi32

RegSaveKeyA

Sections

.wpi
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gnid
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.grwv
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dsdo
Size: 27KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34085480855ea853fdade81d9784775c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.wpi Size: 22KB - Virtual size: 45KB

.gnid Size: 5KB - Virtual size: 10KB

.grwv Size: 1KB - Virtual size: 1KB

.dsdo Size: 27KB - Virtual size: 132KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.wpi
Size: 22KB - Virtual size: 45KB

.gnid
Size: 5KB - Virtual size: 10KB

.grwv
Size: 1KB - Virtual size: 1KB

.dsdo
Size: 27KB - Virtual size: 132KB

.rsrc
Size: 2KB - Virtual size: 4KB