f7a83f75e38edb08395e41f826ff9ef3abd06d851e9b8d130a0f245247f072c1

Sharing

Copy URL Twitter E-mail

General

Target

f7a83f75e38edb08395e41f826ff9ef3abd06d851e9b8d130a0f245247f072c1
Size

126KB
MD5

a1a93488727391aa7a6fa5410b0b8db0
SHA1

d03c82cae43058af1aaeb5d29c4f5e6704f1727a
SHA256

f7a83f75e38edb08395e41f826ff9ef3abd06d851e9b8d130a0f245247f072c1
SHA512

833046a41538c35c43779ab9ca7990b95dd971f2b7b69766dca746caffabd7e989df87e4ff3bd68f66d4f2c145008be470d20e26d055971dc135503f1078376a
SSDEEP

3072:mJI0WGIghC5cK8LbTBqxKNA5bL4U2DsSLA5aD5DRgS2f2rbu8Z:mJI0W2LKib1qkDzps2rbu8Z

Score

N/A

Malware Config

Signatures

Files

f7a83f75e38edb08395e41f826ff9ef3abd06d851e9b8d130a0f245247f072c1
.exe windows x64

d317abd077369ff0d133db4f40fd298a

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:63:04:0f:94:b3:30:a5:3b:38:b5:ea:6d:a2:36:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

18/09/2009, 00:00

Not After

14/03/2010, 23:59

Subject

CN=Andrea Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Andrea Digital,O=Andrea Electronics,L=MELVILLE,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

76:34:6b:ce:1d:83:4a:04:3d:40:ef:0b:e1:2e:1f:8f:50:14:ad:24
Signer

Actual PE Digest

76:34:6b:ce:1d:83:4a:04:3d:40:ef:0b:e1:2e:1f:8f:50:14:ad:24

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Andrea Electronics,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Andrea Digital,O=Andrea Electronics,L=MELVILLE,ST=New York,C=US

18/11/2009, 01:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegEnumKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CreateServiceA
ControlService
QueryServiceStatus
DeleteService
StartServiceCtrlDispatcherA
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor

kernel32

GetModuleHandleA
GetModuleFileNameA
lstrlenA
SetEvent
WaitForSingleObject
CloseHandle
Sleep
WriteFile
CreateFileA
GetLastError
CreateEventA
WaitForMultipleObjects
GetLocalTime
GetDateFormatA
GetTimeFormatA
SetFilePointer
MultiByteToWideChar
SetConsoleCtrlHandler
FormatMessageA
LocalFree
LoadLibraryA
GetProcAddress
CreateNamedPipeA
ResetEvent
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
HeapSetInformation
HeapCreate
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
DeleteCriticalSection
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

&�
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d317abd077369ff0d133db4f40fd298a

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

2f:63:04:0f:94:b3:30:a5:3b:38:b5:ea:6d:a2:36:1cCertificate

Extended Key Usages

Key Usages

76:34:6b:ce:1d:83:4a:04:3d:40:ef:0b:e1:2e:1f:8f:50:14:ad:24Signer

Signature Validations

Verification

18/11/2009, 01:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 3KB

&� Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

2f:63:04:0f:94:b3:30:a5:3b:38:b5:ea:6d:a2:36:1c
Certificate

76:34:6b:ce:1d:83:4a:04:3d:40:ef:0b:e1:2e:1f:8f:50:14:ad:24
Signer

18/11/2009, 01:14
Valid: false

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 3KB

&�
Size: 1KB - Virtual size: 1KB