417ffde2db53a693e83dacd700e6ad42def1ec251f37d505914cda992e1254bf

Sharing

Copy URL Twitter E-mail

General

Target

417ffde2db53a693e83dacd700e6ad42def1ec251f37d505914cda992e1254bf
Size

5.5MB
MD5

b6645d7706b4eac541d4151d358f8aa2
SHA1

d4464f7c91513e10dd2e0bb0bfeb943452230971
SHA256

417ffde2db53a693e83dacd700e6ad42def1ec251f37d505914cda992e1254bf
SHA512

2448bf8cdcf7fc19a7504cf5b767909b87ccc0a0b4f764e069f7ca6427e810b443b4b92758df2e7427961d4d55702bff585331e3177bf009b4996c88cf192089
SSDEEP

98304:gds/ZsvMZcd9t689MwTt4nda7QNCigqzuHIhGQme3W65RYTpCLPmk8aqsFDBN:gdvbjthGw54ndauCdqijQme15RYsj3qS

Score

N/A

Malware Config

Signatures

Files

417ffde2db53a693e83dacd700e6ad42def1ec251f37d505914cda992e1254bf
.exe windows x86

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/12/2010, 00:00

Not After

14/12/2012, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:bb:5e:50:2c:49:05:db:a7:03:ee:48:92:c4:08:30:ec:70:a0:5e
Signer

Actual PE Digest

83:bb:5e:50:2c:49:05:db:a7:03:ee:48:92:c4:08:30:ec:70:a0:5e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

18/09/2011, 19:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GlobalFree
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
HeapCreate
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
GetCurrentThreadId
GetNumberFormatW
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetCurrencyFormatW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
VirtualFree
SwitchToThread
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetFullPathNameW
CreateEventA

user32

InsertMenuW
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
EnableWindow
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
ShowWindowAsync
GetWindow
IsWindowVisible
ShowWindow
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
BeginPaint
EndPaint
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
CreateWindowExW
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
CallWindowProcW
GetCapture
DestroyWindow
MessageBoxW
LoadCursorW
GetCursorPos
InsertMenuA
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
ScreenToClient
SetWindowTextA
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
GetSystemMetrics
GetWindowTextA
UnregisterClassA
PostQuitMessage
LoadMenuW
DeleteMenu
RegisterClassExW
UpdateWindow
GetWindowTextLengthW
GetWindowTextW
LoadStringA
GetMenu
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
InsertMenuItemW
GetClassInfoExW
PostMessageA
RegisterWindowMessageA
GetClientRect
SetMenu

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
CreateDIBSection
GetObjectW
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
EnumFontFamiliesExW
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
getsockname
bind

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 905KB - Virtual size: 905KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

83:bb:5e:50:2c:49:05:db:a7:03:ee:48:92:c4:08:30:ec:70:a0:5eSigner

Signature Validations

Verification

18/09/2011, 19:49 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

urlmon

version

winmm

oleaut32

dsound

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

mscms

ws2_32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rodata Size: 1KB - Virtual size: 1KB

.rdata Size: 905KB - Virtual size: 905KB

.data Size: 92KB - Virtual size: 182KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 356KB - Virtual size: 356KB

.reloc Size: 158KB - Virtual size: 157KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

83:bb:5e:50:2c:49:05:db:a7:03:ee:48:92:c4:08:30:ec:70:a0:5e
Signer

18/09/2011, 19:49
Valid: false

.text
Size: 4.0MB - Virtual size: 4.0MB

.rodata
Size: 1KB - Virtual size: 1KB

.rdata
Size: 905KB - Virtual size: 905KB

.data
Size: 92KB - Virtual size: 182KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 356KB - Virtual size: 356KB

.reloc
Size: 158KB - Virtual size: 157KB