6007b88cb5a8c5218eb7bd78f2f5247f4c7919fc1dc93502951e0eec290be9fb

Sharing

Copy URL

Twitter E-mail

General

Target

6007b88cb5a8c5218eb7bd78f2f5247f4c7919fc1dc93502951e0eec290be9fb
Size

1.2MB
MD5

82e26e0a94b9aff0e63094c1f80470a5
SHA1

b9e811a99696c4eba210f263f00e02c1967b36ca
SHA256

6007b88cb5a8c5218eb7bd78f2f5247f4c7919fc1dc93502951e0eec290be9fb
SHA512

42b4e2873ae432b4f6223c2a343d7b3f14af17f0004ea34cc37f4e2208639cca2d387c7984be5b01e209413ad9081a90cd1c948c5273c45c4be609c0c7eb21d9
SSDEEP

24576:aqUr8Ep32k3yd8LkwlWiNwYhdM8RAMN4cT1fi5aFK6c:aJr8EdKY8YvT1Aao

Score

N/A

Malware Config

Signatures

Files

6007b88cb5a8c5218eb7bd78f2f5247f4c7919fc1dc93502951e0eec290be9fb
.exe windows x86

baa93d47220682c04d92f7797d9224ce

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:d2:08:d5:87:8e:4d:25:73:4d:33:5f:71:c6:4a:5d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

06/05/2012, 00:00

Not After

05/06/2013, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,OU=Provided by TrustAsia,O=上海瑞创网络科技股份有限公司,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e0:30:fe:7f:cd:91:4f:19:9a:41:4d:64:c2:1c:33:8d:91:da:7b:20
Signer

Actual PE Digest

e0:30:fe:7f:cd:91:4f:19:9a:41:4d:64:c2:1c:33:8d:91:da:7b:20

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=上海瑞创网络科技股份有限公司,OU=Provided by TrustAsia,O=上海瑞创网络科技股份有限公司,L=上海,ST=上海,C=CN

07/09/2012, 05:43
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata2
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xiaozi
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kmncbnqr
Size: 981KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

artwheuz
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

11:d2:08:d5:87:8e:4d:25:73:4d:33:5f:71:c6:4a:5dCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

e0:30:fe:7f:cd:91:4f:19:9a:41:4d:64:c2:1c:33:8d:91:da:7b:20Signer

Signature Validations

Verification

07/09/2012, 05:43 Valid: false

Headers

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 188KB - Virtual size: 188KB

.rsrc Size: 1024B - Virtual size: 984B

.idata2 Size: 2KB - Virtual size: 4KB

.xiaozi Size: 512B - Virtual size: 512B

.idata Size: 512B - Virtual size: 4KB

kmncbnqr Size: 981KB - Virtual size: 984KB

artwheuz Size: 512B - Virtual size: 4KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

11:d2:08:d5:87:8e:4d:25:73:4d:33:5f:71:c6:4a:5d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

e0:30:fe:7f:cd:91:4f:19:9a:41:4d:64:c2:1c:33:8d:91:da:7b:20
Signer

07/09/2012, 05:43
Valid: false

.rsrc
Size: 1024B - Virtual size: 984B

.idata2
Size: 2KB - Virtual size: 4KB

.xiaozi
Size: 512B - Virtual size: 512B

.idata
Size: 512B - Virtual size: 4KB

kmncbnqr
Size: 981KB - Virtual size: 984KB

artwheuz
Size: 512B - Virtual size: 4KB