8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff

Sharing

Copy URL

Twitter E-mail

General

Target

8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff
Size

2.3MB
MD5

139a7ac7ed878636960070ecdb52e9ca
SHA1

f808a599104cdeca6e7c6e96c117d82b5fa117eb
SHA256

8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff
SHA512

3899fe6d6b280466b14669672fb0fe567805060cec64343d3a99134e1bf1c354b0591cd5c849501f666d9b14f5612782eadfad56db23ba351599f5b6d4e6d300
SSDEEP

12288:kfdvElIVwCbeKFrhGZ2SJy7ntMt+IBHNNt1BY3uAtW/lP7pMw9iRyaqp63f3e/mp:EdNwCbeKF3tM7X/RNT9yyadP3e/k9T

Score

N/A

Malware Config

Signatures

Files

8440257372515012226efb9459b5b0eea3e37e3b8d166154edd2a055de8dfcff
.exe windows x86

ef29608e73c89d88ae664c425b143ee1

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:4b:7f:cd:34:a4:5d:21:b1:7c:d1:fc:8f:85:59:a8
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

27-11-2008 00:00

Not After

27-11-2010 23:59

Subject

CN=ALIKET SOFTWARE CO.\, LTD.,OU=Secure Application Development,O=ALIKET SOFTWARE CO.\, LTD.,L=BEIJING,ST=BEIJING,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

f5:f4:e6:9d:80:5e:f0:a6:52:66:7a:2e:63:0e:42:d6:f2:60:1c:53
Signer

Actual PE Digest

f5:f4:e6:9d:80:5e:f0:a6:52:66:7a:2e:63:0e:42:d6:f2:60:1c:53

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=ALIKET SOFTWARE CO.\, LTD.,OU=Secure Application Development,O=ALIKET SOFTWARE CO.\, LTD.,L=BEIJING,ST=BEIJING,C=CN

21-01-2010 04:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shfolder

SHGetFolderPathW

shlwapi

PathFileExistsW

mfc42u

ord922
ord3281
ord6195
ord4273
ord6868
ord1165
ord6874
ord6139
ord4370
ord3716
ord2606
ord941
ord5871
ord3614
ord3871
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6017
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord2854
ord2559
ord2746
ord2855
ord4118
ord3792
ord2859
ord6190
ord2745
ord4018
ord5783
ord2914
ord6920
ord6918
ord5784
ord472
ord4279
ord2078
ord6211
ord3605
ord656
ord537
ord5647
ord3122
ord3611
ord798
ord1989
ord6403
ord5188
ord350
ord533
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord3312
ord6193
ord2371
ord927
ord4197
ord6003
ord3296
ord1761
ord4294
ord940
ord5857
ord3332
ord547
ord6865
ord4667
ord4075
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord815
ord384
ord561
ord2637
ord2613
ord356
ord2717
ord2088
ord3806
ord551
ord5461
ord859
ord4199
ord6871
ord6597
ord2857
ord6451
ord4803
ord5047
ord3084
ord1787
ord4270
ord4215
ord2576
ord3649
ord2430
ord6266
ord2858
ord1637
ord5977
ord3087
ord4470
ord2444
ord3701
ord6770
ord860
ord1569
ord4292
ord556
ord809
ord1088
ord2114
ord539
ord3688
ord613
ord289
ord1921
ord3074
ord3820
ord3826
ord3825
ord3365
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4396
ord1768
ord4073
ord6051
ord2574
ord3592
ord4419
ord5276
ord4401
ord1767
ord6048
ord2506
ord4992
ord5261
ord3569
ord925
ord2762
ord5568
ord2773
ord4053
ord3173
ord823
ord3993
ord1972
ord668
ord6655
ord4124
ord2756
ord5706
ord861
ord5679
ord2910
ord6278
ord6279
ord2810
ord4847
ord538
ord535
ord4219
ord858
ord795
ord470
ord1634
ord323
ord1633
ord1143
ord5781
ord2406
ord2397
ord640
ord755
ord3658
ord3621
ord3568
ord3566
ord4704
ord2634
ord2294
ord4229
ord324
ord540
ord541
ord567
ord641
ord801
ord693
ord609
ord3635
ord4418
ord1131
ord4621
ord3397
ord4390
ord2567
ord800
ord825
ord4269
ord4128

msvcrt

?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
_onexit
__CxxFrameHandler
wcscmp
wcscpy
wcscat
wcslen
_ftol
__dllonexit
_except_handler3
__set_app_type
_wtoi
_CxxThrowException
wcstok
wcsstr
_itow
fclose
swprintf
fread
ftell
fseek
_wfopen
wcsncpy
wcschr
wcsncmp
wcstol
strncpy
_wcsnicmp
malloc
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

kernel32

SetEvent
ResetEvent
CreateEventW
GetExitCodeThread
TerminateThread
ResumeThread
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
QueryInformationJobObject
FormatMessageW
GetPrivateProfileIntW
WritePrivateProfileStringW
lstrcatW
WinExec
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
CreateFileW
GetFileInformationByHandle
CloseHandle
CreateMutexW
lstrlenW
lstrcpyW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
Sleep
GetModuleFileNameW
SetCurrentDirectoryW
FreeLibrary
GetVersionExW
LoadLibraryW
GetProcAddress
FindFirstFileW
GetLastError
FindNextFileW
FindClose
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
MoveFileExW
CreateThread
WaitForSingleObject
GetStartupInfoW

user32

GetClientRect
FillRect
LoadBitmapW
InvalidateRect
IsWindow
MessageBeep
LoadCursorW
SetCursor
CopyRect
ReleaseCapture
SetCapture
SetWindowRgn
ReleaseDC
LoadMenuW
GetSubMenu
CreatePopupMenu
AppendMenuW
GetAsyncKeyState
UpdateWindow
GetWindowLongW
SetWindowLongW
SendMessageW
GetSystemMetrics
MessageBoxW
GetDC
KillTimer
DrawIcon
OpenClipboard
GetClipboardData
CloseClipboard
GrayStringW
DrawTextW
TabbedTextOutW
PostQuitMessage
LoadImageW
SetRect
SystemParametersInfoW
GetIconInfo
DrawStateW
SetTimer
GetParent
GetCapture
GetCursorPos
GetWindowRect
PtInRect
WindowFromPoint
IsWindowEnabled
ScreenToClient
ChildWindowFromPointEx
LoadIconW
EnableWindow
DrawFrameControl
OffsetRect
InflateRect
GetSysColor

gdi32

CreateRectRgn
GetNearestColor
GetStockObject
CombineRgn
SetTextColor
SetBkColor
StretchBlt
RoundRect
CreatePen
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
Polyline
GetTextMetricsW
CreateFontIndirectW
GetDIBits
StretchDIBits
GetObjectW
GetPixel
CreateBitmap
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateFontW
GetTextExtentPoint32W
CreateSolidBrush
DeleteDC
BitBlt
CreateCompatibleDC

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumValueW
RegQueryValueExW
RegQueryValueW
AdjustTokenPrivileges
RegDeleteValueW
RegCloseKey
RegNotifyChangeKeyValue
OpenProcessToken
LookupPrivilegeValueW

shell32

ExtractIconExW
ShellExecuteW

comctl32

ImageList_GetImageCount
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_Remove

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetOpenW
InternetCloseHandle
InternetGetConnectedState
InternetOpenUrlW
InternetCanonicalizeUrlW
InternetReadFile

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef29608e73c89d88ae664c425b143ee1

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6c:4b:7f:cd:34:a4:5d:21:b1:7c:d1:fc:8f:85:59:a8Certificate

Extended Key Usages

f5:f4:e6:9d:80:5e:f0:a6:52:66:7a:2e:63:0e:42:d6:f2:60:1c:53Signer

Signature Validations

Verification

21-01-2010 04:00 Valid: false

Headers

File Characteristics

Imports

shfolder

shlwapi

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

version

wininet

Sections

.text Size: 148KB - Virtual size: 147KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 12KB - Virtual size: 10KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6c:4b:7f:cd:34:a4:5d:21:b1:7c:d1:fc:8f:85:59:a8
Certificate

f5:f4:e6:9d:80:5e:f0:a6:52:66:7a:2e:63:0e:42:d6:f2:60:1c:53
Signer

21-01-2010 04:00
Valid: false

.text
Size: 148KB - Virtual size: 147KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB