15c52fa4dd6e8ccf81ef0a38077a6d215a55e0cd436f5876f7fc2fe9b70e86bf

Sharing

Copy URL Twitter E-mail

General

Target

15c52fa4dd6e8ccf81ef0a38077a6d215a55e0cd436f5876f7fc2fe9b70e86bf
Size

879KB
MD5

23fb707ddf9cec58bb33589d02fe66a0
SHA1

ae598dbe49e3320ddf937b2fc65cb1e88945ed75
SHA256

15c52fa4dd6e8ccf81ef0a38077a6d215a55e0cd436f5876f7fc2fe9b70e86bf
SHA512

4921c2163986138f627b13225041672acd5a1db5402b0c72f65812e6a7231f85973923631d7169298344da9d964bcdeab79d78756b9a08bfef0e34806780d8d1
SSDEEP

12288:9ibZpHZQgvkFcMw0SPu24wocp/OUgO3mILN:9ibzHmicbw9Pu24yODO2I

Score

N/A

Malware Config

Signatures

Files

15c52fa4dd6e8ccf81ef0a38077a6d215a55e0cd436f5876f7fc2fe9b70e86bf
.exe windows x86

bf03659f4a112d2282372261c6c07058

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:b3:af:5d:b1:1e:c9:1d:1c:f0:b3:e1:b8:0c:85:e4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/03/2010, 00:00

Not After

08/03/2013, 23:59

Subject

CN=Kingsoft Security Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Kingsoft Duba,O=Kingsoft Security Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:37:5a:25:72:d7:88:18:97:d3:71:f2:c2:c6:3f:22:94:79:66
Signer

Actual PE Digest

61:02:37:5a:25:72:d7:88:18:97:d3:71:f2:c2:c6:3f:22:94:79:66

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Kingsoft Security Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Kingsoft Duba,O=Kingsoft Security Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

12/10/2011, 17:14
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

urlmon

URLDownloadToFileW

kernel32

GlobalFree
TerminateThread
SetFilePointer
ExpandEnvironmentStringsW
SetThreadLocale
GlobalSize
CreateEventW
SetEvent
LCMapStringW
LCMapStringA
RtlUnwind
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsFree
lstrcpyW
TlsAlloc
TlsGetValue
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetProcessHeap
GetVersionExA
CreateThread
ResumeThread
ExitThread
HeapReAlloc
HeapFree
HeapAlloc
TlsSetValue
FindFirstFileW
VirtualAlloc
HeapDestroy
HeapCreate
ExitProcess
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsProcessorFeaturePresent
InterlockedCompareExchange
GetThreadLocale
LoadLibraryA
CreateFileA
InterlockedExchange
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLastError
MultiByteToWideChar
FindClose
GetFullPathNameW
GlobalLock
LocalFree
RaiseException
DeleteCriticalSection
LeaveCriticalSection
lstrcmpiW
GetModuleHandleW
FlushInstructionCache
GetPrivateProfileStringW
LoadLibraryExW
GetVersion
GetPrivateProfileIntW
FreeResource
EnterCriticalSection
GlobalAlloc
InitializeCriticalSection
UnmapViewOfFile
GetPrivateProfileSectionNamesW
lstrlenA
GlobalUnlock
GetCurrentThreadId
InterlockedDecrement
SetLastError
InterlockedIncrement
WritePrivateProfileStringW
WaitForSingleObject
MapViewOfFileEx
GetModuleFileNameW
GetCurrentProcess
Sleep
GetCurrentProcessId
CreateFileMappingW
GetVersionExW
GetProcAddress
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
SizeofResource
LoadResource
CloseHandle
LockResource
WriteFile
GetFileSize
CreateFileW
FindResourceW
FindResourceExW
SetEndOfFile
WideCharToMultiByte
ReadFile
lstrlenW
VirtualFree

user32

SetCursor
GetClassInfoExW
LoadIconW
SetScrollPos
DispatchMessageW
TranslateMessage
MapWindowPoints
EndPaint
CharNextW
GetWindowRect
PostThreadMessageW
CreateMenu
GetMenuStringW
DestroyMenu
GetMenuItemCount
PtInRect
GetKeyState
EnableWindow
LoadCursorW
GetClientRect
CreateWindowExW
DestroyIcon
MonitorFromWindow
SetActiveWindow
GetScrollInfo
SystemParametersInfoW
GetActiveWindow
GetWindowDC
SetWindowRgn
DrawFrameControl
ValidateRect
SetWindowLongW
IsWindowEnabled
wsprintfW
SetCapture
ReleaseDC
IsWindow
GetParent
EqualRect
SetScrollInfo
ClientToScreen
DrawTextW
InflateRect
MoveWindow
GetWindowLongW
GetDlgCtrlID
RegisterClassExW
DestroyWindow
GetDC
OffsetRect
SetRect
DrawIconEx
CopyRect
PeekMessageW
LoadBitmapW
GetWindow
BeginPaint
GetMonitorInfoW
GetDlgItem
SetLayeredWindowAttributes
InvalidateRect
CallWindowProcW
GetDesktopWindow
LoadImageW
GetMessageW
ScreenToClient
ReleaseCapture
DefWindowProcW
IsWindowVisible
SetWindowPos
ShowWindow
SendMessageW
SetFocus
MessageBoxW
IsIconic
SetForegroundWindow
UnregisterClassA

gdi32

Rectangle
CreateDIBSection
GetStockObject
RectInRegion
CreateFontIndirectW
RestoreDC
SetBkMode
CreateBitmap
SelectObject
CreateCompatibleBitmap
SetBkColor
OffsetRgn
GetObjectW
StretchBlt
ExtTextOutW
GetTextExtentPoint32W
DeleteDC
GetClipRgn
DeleteObject
CombineRgn
SelectClipRgn
SetTextColor
CreateRectRgn
RoundRect
CreateCompatibleDC
CreatePen
MoveToEx
BitBlt
SaveDC
TextOutW
SetRectRgn
CreateRectRgnIndirect
LineTo

advapi32

RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
GetLengthSid
RegCreateKeyExW
InitializeAcl
RegDeleteKeyW
GetNamedSecurityInfoW
RegOpenKeyExW
CopySid
GetTokenInformation
RegQueryInfoKeyW
GetSidLengthRequired
GetSidSubAuthority
IsValidSid
InitializeSid
RegEnumKeyExW
GetAclInformation
SetNamedSecurityInfoW
AddAce
RegDeleteValueW
GetAce

shell32

ShellExecuteExW
SHGetFileInfoA
ShellExecuteW

ole32

CoInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoGetClassObject
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
VarUI4FromStr
SysFreeString

shlwapi

PathFileExistsA
SHSetValueW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
StrToIntW
SHDeleteKeyW
StrStrIA
SHGetValueW
StrToIntA

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipSetPageScale
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipGetImageHeight
GdipAlloc
GdipDrawImageRectI
GdipFree
GdipCreateFromHDC
GdipLoadImageFromStream
GdipSetPageUnit
GdipDrawImageI
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDeleteGraphics
GdipSetSmoothingMode
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipGetImageWidth
GdipCloneImage

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 450KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vahibqf
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf03659f4a112d2282372261c6c07058

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

11:b3:af:5d:b1:1e:c9:1d:1c:f0:b3:e1:b8:0c:85:e4Certificate

Extended Key Usages

Key Usages

61:02:37:5a:25:72:d7:88:18:97:d3:71:f2:c2:c6:3f:22:94:79:66Signer

Signature Validations

Verification

12/10/2011, 17:14 Valid: false

Headers

File Characteristics

Imports

version

urlmon

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

iphlpapi

Sections

.text Size: 251KB - Virtual size: 251KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 10KB - Virtual size: 18KB

.rsrc Size: 450KB - Virtual size: 451KB

vahibqf Size: 114KB - Virtual size: 114KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

11:b3:af:5d:b1:1e:c9:1d:1c:f0:b3:e1:b8:0c:85:e4
Certificate

61:02:37:5a:25:72:d7:88:18:97:d3:71:f2:c2:c6:3f:22:94:79:66
Signer

12/10/2011, 17:14
Valid: false

.text
Size: 251KB - Virtual size: 251KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 10KB - Virtual size: 18KB

.rsrc
Size: 450KB - Virtual size: 451KB

vahibqf
Size: 114KB - Virtual size: 114KB