d147c5d7119c75983271e9972b4e9e92bc8f6bcb89441a5af05daae5a50ec8e8

Sharing

Copy URL Twitter E-mail

General

Target

d147c5d7119c75983271e9972b4e9e92bc8f6bcb89441a5af05daae5a50ec8e8
Size

214KB
MD5

935a51901da1b114f1942b30d0c81950
SHA1

dee9e2ca596a8072652961e538c287448f5c17c3
SHA256

d147c5d7119c75983271e9972b4e9e92bc8f6bcb89441a5af05daae5a50ec8e8
SHA512

966af831ce0f84e939dc434edb934d0d783804b36b07cc78baad45bc05367936272ed2266e70444522facf01aee3c93686a5362fcb347efec0e1ceca1e8b3b60
SSDEEP

3072:Ig4gZnmTJ2MpAI10/UfULiRa2DAocPsShYXtH6/tnAylcn:ZzZAJgMSPsSaXF6xxcn

Score

N/A

Malware Config

Signatures

Files

d147c5d7119c75983271e9972b4e9e92bc8f6bcb89441a5af05daae5a50ec8e8
.exe windows x86

63b2b21b3991e1acc7716346c3ce600e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

01/09/2011, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b3:31:42:4a:0b:e2:1e:69:f9:b9:6b:f1:b2:c1:33:7c:40:0a:6a:fa
Signer

Actual PE Digest

b3:31:42:4a:0b:e2:1e:69:f9:b9:6b:f1:b2:c1:33:7c:40:0a:6a:fa

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

06/01/2010, 00:51
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisconnectNamedPipe
FlushFileBuffers
WriteFile
ReadFile
ResumeThread
InterlockedIncrement
ConnectNamedPipe
CreateNamedPipeW
InterlockedDecrement
CompareStringW
CompareStringA
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileW
SwitchToThread
GetCommandLineW
InitializeCriticalSection
OpenEventW
DeleteCriticalSection
SetEvent
WTSGetActiveConsoleSessionId
CreateThread
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CloseHandle
SetLastError
GetLastError
Sleep
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateEventW
LocalFree
SetEnvironmentVariableA
WaitForSingleObject
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InterlockedCompareExchange
GetUserDefaultLCID
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapFree
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA

shlwapi

SHDeleteValueW
PathAppendW
PathFileExistsW
SHSetValueW
PathAddBackslashW

shell32

SHGetFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW

advapi32

RegGetValueW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW

rpcrt4

UuidToStringW
RpcStringFreeW

ole32

CoInitializeSecurity
CoInitialize

Sections

.text
Size: 164KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63b2b21b3991e1acc7716346c3ce600e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31Certificate

Extended Key Usages

Key Usages

b3:31:42:4a:0b:e2:1e:69:f9:b9:6b:f1:b2:c1:33:7c:40:0a:6a:faSigner

Signature Validations

Verification

06/01/2010, 00:51 Valid: false

Headers

File Characteristics

Imports

kernel32

shlwapi

shell32

advapi32

rpcrt4

ole32

Sections

.text Size: 164KB - Virtual size: 160KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

b3:31:42:4a:0b:e2:1e:69:f9:b9:6b:f1:b2:c1:33:7c:40:0a:6a:fa
Signer

06/01/2010, 00:51
Valid: false

.text
Size: 164KB - Virtual size: 160KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 3KB