5d8a6a505a909150fc7d7d9c041c8d8decb7a5212dccf8f5560c78b3e0e34abc

Sharing

Copy URL Twitter E-mail

General

Target

5d8a6a505a909150fc7d7d9c041c8d8decb7a5212dccf8f5560c78b3e0e34abc
Size

294KB
MD5

1b26a503856b16a4712842150cc1dfd6
SHA1

37c3a28700683f15a2c9abf60edcb36a70482e3c
SHA256

5d8a6a505a909150fc7d7d9c041c8d8decb7a5212dccf8f5560c78b3e0e34abc
SHA512

6262fe7ca501f4faeb99df5c134faa847f1be07173b237a98fcd306e216d4504866bd6aadef70eedeb22a04aace1ea5790ef67b750e6f3daad5497d934f571dd
SSDEEP

6144:SYRSHZhym26k9Ym4zdr9GNJUCoFMAD2tI5ZJqt:Zijy74zd9PFb2tLt

Score

N/A

Malware Config

Signatures

Files

5d8a6a505a909150fc7d7d9c041c8d8decb7a5212dccf8f5560c78b3e0e34abc
.exe windows x86

3323852f45380f63e2ed7ef35f19145d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/01/2010, 00:00

Not After

30/01/2012, 23:59

Subject

CN=VIRUSBLOKADA LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VIRUSBLOKADA LTD.,L=Minsk,ST=none,C=BY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:53:70:f6:ff:36:cd:5a:70:a4:9d:9d:e4:23:a6:60:ba:0c:f7:04
Signer

Actual PE Digest

0b:53:70:f6:ff:36:cd:5a:70:a4:9d:9d:e4:23:a6:60:ba:0c:f7:04

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VIRUSBLOKADA LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VIRUSBLOKADA LTD.,L=Minsk,ST=none,C=BY

18/10/2010, 06:19
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
ord692
ord585
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
ord588
ord589
ord697
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaR8Sgn
ord517
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
ord631
ord525
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaI2Var
_CIlog
ord646
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
_adj_fdivr_m32
ord577
_adj_fdiv_r
ord100
ord689
__vbaVarDup
_CIatan
__vbaStrMove
ord618
_allmul
ord545
_CItan
ord546
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3323852f45380f63e2ed7ef35f19145d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

0b:53:70:f6:ff:36:cd:5a:70:a4:9d:9d:e4:23:a6:60:ba:0c:f7:04Signer

Signature Validations

Verification

18/10/2010, 06:19 Valid: false

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 272KB - Virtual size: 270KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 8KB - Virtual size: 5KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

0b:53:70:f6:ff:36:cd:5a:70:a4:9d:9d:e4:23:a6:60:ba:0c:f7:04
Signer

18/10/2010, 06:19
Valid: false

.text
Size: 272KB - Virtual size: 270KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 8KB - Virtual size: 5KB