0943cea701318f8583cea6284e645af951ec8f9ad7c1302507e15637979341ae

Sharing

Copy URL Twitter E-mail

General

Target

0943cea701318f8583cea6284e645af951ec8f9ad7c1302507e15637979341ae
Size

152KB
MD5

922fcc285ee731b85f07c6450c045380
SHA1

4da941536abc71048c88f2183f3e6e3a5734d2d4
SHA256

0943cea701318f8583cea6284e645af951ec8f9ad7c1302507e15637979341ae
SHA512

4ae288352760600bc75f607c569f049c20173c6b6791171361c68a8ba17eb6c89b5b171a8bed736ff3a76a0abd55f48c2303325986c0cbac817e78804bd26ae4
SSDEEP

3072:XjUlk+AlwppdVypx22PNg+rSxSDADeak7dJHB/AU:XjUlk+A23dmx22PNg+mxSsQLH5AU

Score

N/A

Malware Config

Signatures

Files

0943cea701318f8583cea6284e645af951ec8f9ad7c1302507e15637979341ae
.exe windows x86

e5603ab9d8bb342a1b79ee8b9020c06e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a3:93:54:66:a9:f9:a7:f2:97:28:2a:7e:df:88:76:3d:1b:fa:a8:0b
Signer

Actual PE Digest

a3:93:54:66:a9:f9:a7:f2:97:28:2a:7e:df:88:76:3d:1b:fa:a8:0b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

08/09/2012, 05:18
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

GetPrivateProfileSectionW
InterlockedIncrement
GetModuleFileNameW
WritePrivateProfileStringW
CreateDirectoryW
GetWindowsDirectoryW
GetVersionExW
CloseHandle
ReadFile
GetFileSize
CreateFileW
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
OutputDebugStringW
VirtualProtect
GetModuleHandleW
CreateThread
GetEnvironmentVariableW
GetTickCount
DebugBreak
lstrlenA
GetPrivateProfileIntA
WideCharToMultiByte
GetACP
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
CopyFileA
GetPrivateProfileStringA
DeleteFileA
DeleteFileW
WriteFile
SetFilePointer
CreateFileA
HeapFree
GetLastError
HeapAlloc
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoW
GetCommandLineW
lstrlenW
LocalFree
InterlockedDecrement
WritePrivateProfileSectionW

user32

DialogBoxParamW
GetActiveWindow
LoadStringW
DestroyWindow
DefWindowProcW
SetWindowLongW
SetTimer
ShowWindow
CheckDlgButton
CharNextW
wvsprintfW
GetDlgItemTextW
IsDlgButtonChecked
FindWindowW
EnableWindow
KillTimer
EndDialog
GetWindowLongW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowTextW
SendMessageW
GetDlgItem

gdi32

SetBkMode
GetStockObject
CreateFontW
DeleteObject

advapi32

GetUserNameW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
ExtractIconW
CommandLineToArgvW

shlwapi

PathFileExistsW

ole32

CoInitialize
CoUninitialize

comctl32

InitCommonControlsEx

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

msvcrt

calloc
atol
_CxxThrowException
__CxxFrameHandler
malloc
strncmp
ftell
fseek
fread
fopen
fwrite
__dllonexit
strncpy
_controlfp
sprintf
strrchr
iswdigit
wcscspn
free
wcscmp
wcsstr
_except_handler3
__set_app_type
wcsncat
wcsrchr
__p__fmode
__p__commode
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_wcmdln
wcsncpy
__wgetmainargs
_initterm
__setusermatherr
fclose
??2@YAPAXI@Z
_wcsicmp
_wtoi
wcslen
_wtol
wcschr
_adjust_fdiv

wininet

HttpOpenRequestA
InternetCloseHandle
InternetAttemptConnect
InternetConnectA
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
InternetSetCookieA
HttpEndRequestW
InternetWriteFile
HttpSendRequestExA
InternetReadFile

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e5603ab9d8bb342a1b79ee8b9020c06e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

a3:93:54:66:a9:f9:a7:f2:97:28:2a:7e:df:88:76:3d:1b:fa:a8:0bSigner

Signature Validations

Verification

08/09/2012, 05:18 Valid: false

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

comctl32

msvcp60

msvcrt

wininet

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 68KB - Virtual size: 65KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

a3:93:54:66:a9:f9:a7:f2:97:28:2a:7e:df:88:76:3d:1b:fa:a8:0b
Signer

08/09/2012, 05:18
Valid: false

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 68KB - Virtual size: 65KB