02223fe8ce165be664f6ab190ea56c571dbc56c4447b869e318a1162ce3e9a94

Sharing

Copy URL Twitter E-mail

General

Target

02223fe8ce165be664f6ab190ea56c571dbc56c4447b869e318a1162ce3e9a94
Size

709KB
MD5

0bd8fcd38f75816e9b37acfb512244c4
SHA1

3983a35fdc0a59451838f9a4eae009818b6ec459
SHA256

02223fe8ce165be664f6ab190ea56c571dbc56c4447b869e318a1162ce3e9a94
SHA512

1c932d6645b10dfa9cfbf974f7c74a5ffde4161c716ae6253de6dc7fb1f7d2382e415223a0ca6f9df5342f3686fe5b0f61dec65088b22e8fef03886ac57aa296
SSDEEP

12288:v6g9AgOWhvJQ+zgbqkKJ7n3p6zUFZL5+aVTOyS:PpOav2+sbQJ7ngeLzTHS

Score

N/A

Malware Config

Signatures

Files

02223fe8ce165be664f6ab190ea56c571dbc56c4447b869e318a1162ce3e9a94
.dll windows x86

e04d0d86315f2e96f373cd76f245ef43

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/08/2010, 00:00

Not After

12/08/2013, 23:59

Subject

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9e:d8:34:f0:30:17:03:de:e5:4b:ba:c0:46:ee:23:45:84:8a:65:e3
Signer

Actual PE Digest

9e:d8:34:f0:30:17:03:de:e5:4b:ba:c0:46:ee:23:45:84:8a:65:e3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

22/02/2011, 11:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
LockResource
LoadResource
FindResourceA
GetProcessVersion
DuplicateHandle
ReadFile
FlushFileBuffers
LockFile
UnlockFile
GetVolumeInformationA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
GetCPInfo
GetOEMCP
GetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
GetACP
ExitProcess
ExitThread
HeapSize
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
WritePrivateProfileStringA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalFlags
MulDiv
GlobalSize
SetLastError
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreA
GlobalMemoryStatus
GetExitCodeThread
WaitForMultipleObjects
TerminateThread
ResetEvent
FormatMessageW
SetThreadLocale
GetComputerNameW
LoadLibraryExW
LoadLibraryExA
EnumResourceLanguagesA
FindResourceExA
SizeofResource
UnmapViewOfFile
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetModuleFileNameW
QueryPerformanceCounter
QueryPerformanceFrequency
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
CreateEventA
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
GetModuleFileNameA
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
FormatMessageA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
GlobalLock
GlobalUnlock
lstrlenA
InterlockedDecrement
InterlockedIncrement
CreateMutexA
OpenMutexA
CreateProcessA
OutputDebugStringA
GetFileSize
WriteFile
GetStdHandle
WriteConsoleA
SetFilePointer
SetEndOfFile
AllocConsole
FreeConsole
TerminateProcess
SetPriorityClass
GetPriorityClass
GetDriveTypeA
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
FreeLibrary
OutputDebugStringW
Sleep
MoveFileA
CopyFileA
GetFileAttributesA
SetFileAttributesA
lstrcmpA
RemoveDirectoryA
DeleteFileA
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
GetLastError
LoadLibraryA
LocalFree
OpenProcess
GetCurrentProcess
CreateThread
GetSystemDirectoryA
CreateFileA
GetFileInformationByHandle
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetModuleHandleA
GetProcAddress
GetSystemInfo
WaitForSingleObject
GetEnvironmentStringsW
GetTickCount

user32

MapWindowPoints
GetSysColor
SetActiveWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetClientRect
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
SetScrollRange
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
TrackPopupMenu
SetWindowPlacement
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
SetForegroundWindow
UpdateWindow
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
ShowWindow
SetWindowPos
MoveWindow
SetWindowLongA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
GetWindowRect
GetClassNameA
CloseDesktop
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
GrayStringA
GetSysColorBrush
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ScreenToClient
DeleteMenu
LoadIconA
RegisterWindowMessageA
LoadCursorA
GetScrollPos
SetScrollPos
OpenInputDesktop
GetUserObjectInformationA
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
MessageBoxA
MessageBoxW
GetDlgItemTextA
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
EnumDesktopWindows
GetWindowThreadProcessId
GetWindowLongA
GetParent
IsWindowVisible
EnumWindows
GetWindowTextA
wvsprintfA
SetFocus
GetDesktopWindow
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
PtInRect
RemoveMenu
GetMenuItemCount
GetSubMenu
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
LoadStringA
UnregisterClassA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
CharUpperA
DestroyMenu
DrawTextA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
ShowOwnedPopups
SendMessageA
PostMessageA
PostQuitMessage
wsprintfA
GetWindowTextLengthA
OemToCharA
CharToOemA
GetForegroundWindow
FindWindowExA
IsWindow
GetWindowTextW

gdi32

GetObjectA
ExtTextOutA
TextOutA
RectVisible
PolylineTo
PtVisible
CreateDIBPatternBrushPt
CreatePatternBrush
GetDCOrgEx
CreateSolidBrush
ExtCreatePen
CreatePen
GetWindowExtEx
GetViewportExtEx
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
CreateHatchBrush
SelectClipPath
PolyDraw
SetArcDirection
ArcTo
GetCurrentPositionEx
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
CreateBitmap
CopyMetaFileA
CreateDCA
GetDeviceCaps
DeleteObject
DeleteDC
StartDocA
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
GetClipRgn
PolyBezierTo
Escape
SelectPalette
SaveDC
RestoreDC
SelectObject
GetStockObject
SetColorAdjustment

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegisterEventSourceA
DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ReportEventA
RegCreateKeyExA
RegSetValueA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
GetUserNameA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegCloseKey

shell32

DragAcceptFiles
SHGetFileInfoA

comctl32

ord17

ole32

ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
CoTaskMemFree
ReadClassStg
CoTaskMemAlloc
OleDuplicateData
CoCreateInstance
CoInitialize
CoUninitialize
StringFromCLSID
CoTreatAsClass
ReleaseStgMedium
CoDisconnectObject
CreateBindCtx
SetConvertStg

oleaut32

SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantCopy
SysAllocString
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VarCyFromStr
SafeArrayUnaccessData
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysStringLen
SysFreeString
VariantInit
VarBstrFromCy
SysAllocStringLen
SysReAllocStringLen
GetErrorInfo
SetErrorInfo
CreateErrorInfo

oleacc

AccessibleObjectFromWindow

mpr

WNetGetConnectionA

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

Exports

Exports

UserModuleStart
UserModuleStop

Sections

.text
Size: 528KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e04d0d86315f2e96f373cd76f245ef43

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4aCertificate

Extended Key Usages

Key Usages

9e:d8:34:f0:30:17:03:de:e5:4b:ba:c0:46:ee:23:45:84:8a:65:e3Signer

Signature Validations

Verification

22/02/2011, 11:54 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oleacc

mpr

rpcrt4

Exports

Exports

Sections

.text Size: 528KB - Virtual size: 525KB

.rdata Size: 68KB - Virtual size: 65KB

.data Size: 56KB - Virtual size: 111KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 40KB - Virtual size: 36KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

9e:d8:34:f0:30:17:03:de:e5:4b:ba:c0:46:ee:23:45:84:8a:65:e3
Signer

22/02/2011, 11:54
Valid: false

.text
Size: 528KB - Virtual size: 525KB

.rdata
Size: 68KB - Virtual size: 65KB

.data
Size: 56KB - Virtual size: 111KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 40KB - Virtual size: 36KB