fc34b6bf28a5482301f3b7441314500577d961594676bf6d77b53af6d45feda0

Sharing

Copy URL Twitter E-mail

General

Target

fc34b6bf28a5482301f3b7441314500577d961594676bf6d77b53af6d45feda0
Size

937KB
MD5

0910a825c31c37d978f2afc66a290650
SHA1

7e16e3a994e48d443abc755768b629c942ce1d94
SHA256

fc34b6bf28a5482301f3b7441314500577d961594676bf6d77b53af6d45feda0
SHA512

51987aa7c2f6fef64f3d4e9ecf581161f7eddf5adb688eea9fb5da173c309a5338d7b3467bd70a7372a5a8d9d643bd17e7a2f771c1e70d33a7bf146e014cc81f
SSDEEP

12288:kUqiQDH4tkxgtpHedl512CIr8rN+PXID+Qh3gf2l6PeT+bf1XE9TAuf0RInN:wiq+AdlJvN+PXWhQsT+bfJE96I

Score

N/A

Malware Config

Signatures

Files

fc34b6bf28a5482301f3b7441314500577d961594676bf6d77b53af6d45feda0
.exe windows x86

fb79fafccb165757e741dfd56c956b98

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:59:2d:ee:e0:7b:b8:d2:d0:80:b4:d9:66:ce:32:3b:38:63:73:86
Signer

Actual PE Digest

d6:59:2d:ee:e0:7b:b8:d2:d0:80:b4:d9:66:ce:32:3b:38:63:73:86

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

03/04/2013, 06:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugBreak
FileTimeToDosDateTime
GetFileInformationByHandle
MapViewOfFile
ResetEvent
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalAlloc
GetSystemTime
SystemTimeToFileTime
FindNextFileW
GetPrivateProfileSectionW
FindResourceExW
GetStartupInfoW
MulDiv
SetProcessWorkingSetSize
GetFileSizeEx
WideCharToMultiByte
CreateDirectoryW
RaiseException
GetTempPathW
GetFileAttributesExW
DeleteFileW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFileEx
SetEndOfFile
ReadFile
UnlockFile
LockFile
Process32FirstW
Process32NextW
lstrlenA
OutputDebugStringW
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
WritePrivateProfileStringW
CopyFileW
SetFilePointer
WriteFile
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
OpenThread
GetThreadTimes
Thread32Next
CreateEventW
CreateThread
GetTickCount
SetEvent
GetProcessTimes
InterlockedDecrement
GlobalFree
InterlockedIncrement
GetSystemDirectoryW
GetFileAttributesW
LocalAlloc
MultiByteToWideChar
GetSystemInfo
GetModuleHandleA
SearchPathW
GetLongPathNameW
lstrlenW
CreateProcessW
LocalFree
GetPrivateProfileStringW
GetPrivateProfileIntW
GetCurrentProcess
FindFirstFileW
FindClose
GetVersionExW
SetLastError
LoadLibraryW
IsBadReadPtr
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RemoveDirectoryW
GetCommandLineW
CreateMutexW
GetLastError
SetProcessShutdownParameters
OpenProcess
FreeLibrary
GetCurrentProcessId
CreateFileW
DeviceIoControl
OpenEventW
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
GetModuleHandleW
GetProcAddress
WaitForMultipleObjects
MoveFileExW
UnlockFileEx
LockFileEx
SetFilePointerEx
GetEnvironmentVariableW
SetEnvironmentVariableW
ReleaseMutex
GetLocalTime
SetEnvironmentVariableA
GetProcessHeap
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FindResourceW
LoadResource
LockResource
SizeofResource
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
FormatMessageW
GetVersionExA
lstrcmpW
LoadLibraryA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetThreadLocale
FileTimeToSystemTime
FlushFileBuffers
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetFileTime
RtlUnwind
ExitThread
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
ExitProcess
HeapSize
VirtualAlloc
VirtualQuery
GetStdHandle

user32

SetPropW
GetClassNameW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckMenuItem
EnableMenuItem
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
MoveWindow
IsWindowEnabled
PostQuitMessage
ValidateRect
GetActiveWindow
TranslateMessage
GetMessageW
RegisterClipboardFormatW
MapDialogRect
SetWindowContextHelpId
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
DestroyMenu
GetSysColorBrush
UnregisterClassW
CharUpperW
MessageBeep
PostThreadMessageW
CharNextW
IsRectEmpty
CopyAcceleratorTableW
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem
CreateWindowExW
GetClassInfoExW
GetTopWindow
LoadBitmapW
CopyRect
SendMessageW
wvsprintfW
GetWindowRect
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
CallWindowProcW
GetMenu
SetWindowPos
GetIconInfo
GetSysColor
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetRect
RedrawWindow
UpdateWindow
GetForegroundWindow
GetWindow
GetWindowInfo
GetShellWindow
WindowFromPoint
GetAncestor
GetWindowThreadProcessId
GetMenuItemID
GetDC
DrawIconEx
InflateRect
GetCursorPos
RegisterWindowMessageW
LoadMenuW
ModifyMenuW
GetSubMenu
SetMenuDefaultItem
DeleteMenu
DestroyIcon
SetClassLongW
GetParent
GetDesktopWindow
IsWindow
SystemParametersInfoW
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
SetWindowRgn
EqualRect
SetCursor
PtInRect
GetClientRect
InvalidateRect
EnableWindow
LoadIconW
LoadCursorW
FrameRect
KillTimer
SetTimer
ReleaseDC
GetWindowDC
DrawIcon
MessageBoxW
OffsetRect
SetWindowTextW
LoadImageW
PostMessageW
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
EndPaint
DefWindowProcW
AppendMenuW
FillRect
SendMessageTimeoutW
FindWindowW
GetSystemMetrics
ShowWindow
SetForegroundWindow
WaitForInputIdle
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
TrackPopupMenu
GetKeyState
SetMenu
IsWindowVisible
GetMenuItemCount
GetMenuStringW
GetMenuState
UnhookWindowsHookEx
ScreenToClient
ClientToScreen
BeginPaint

gdi32

MoveToEx
LineTo
GetClipBox
SetMapMode
Escape
SetTextColor
TextOutW
RectVisible
PtVisible
DeleteDC
EnumFontFamiliesW
GetDeviceCaps
GetStockObject
CreateRoundRectRgn
CreateFontIndirectW
GetTextExtentExPointW
CreateSolidBrush
CreatePen
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
DeleteObject
GetWindowExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
Rectangle
GetViewportExtEx
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
ExtTextOutW
GetMapMode
GetRgnBox
GetTextColor
GetBkColor
CreateRectRgnIndirect
ExtSelectClipRgn

advapi32

RegQueryValueExW
RegDeleteKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExA
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
DuplicateTokenEx
SetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
ChangeServiceConfigW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyW
GetTokenInformation
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceStatus
RegDeleteValueW
ControlService

shell32

SHCreateDirectoryExW
Shell_NotifyIconW
ord680
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW

ole32

CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoInitializeEx
CoGetClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
VariantCopy

comctl32

_TrackMouseEvent

shlwapi

PathIsPrefixW
StrCmpNIW
PathFindExtensionW
PathIsRelativeW
StrCmpIW
PathFindFileNameW
StrRStrIW
PathStripToRootW
PathIsUNCW
StrRChrW
StrCmpW
SHDeleteValueW
PathRemoveFileSpecW
SHSetValueW
PathFileExistsW
PathAppendW
SHGetValueW
StrChrW
StrStrIW
StrStrW
PathCombineW
PathIsDirectoryW

oledlg

OleUIBusyW

imm32

ImmDisableIME

setupapi

SetupIterateCabinetW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetReadFileExA
InternetWriteFile
HttpEndRequestA
HttpSendRequestExA
InternetSetStatusCallbackA
HttpAddRequestHeadersA
InternetQueryOptionW
InternetSetOptionA
InternetOpenW
HttpQueryInfoA
HttpOpenRequestW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
InternetErrorDlg
HttpQueryInfoW
InternetSetOptionW
InternetCrackUrlW
InternetGetConnectedState
HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetConnectW

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
NdrClientCall2
RpcBindingFree
RpcBindingFromStringBindingW

psapi

GetModuleFileNameExW

oleacc

CreateStdAccessibleObject
LresultFromObject

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

comdlg32

GetFileTitleW

netapi32

Netbios

ws2_32

WSAStartup
WSACleanup
inet_ntoa
ntohl
getpeername

crypt32

CertGetCertificateContextProperty
CertGetNameStringW
CryptMsgClose
CertCloseStore
CryptMsgUpdate
CryptMsgOpenToDecode
CertOpenStore

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

winmm

timeGetTime

Sections

.text
Size: 521KB - Virtual size: 520KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 17KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb79fafccb165757e741dfd56c956b98

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d6:59:2d:ee:e0:7b:b8:d2:d0:80:b4:d9:66:ce:32:3b:38:63:73:86Signer

Signature Validations

Verification

03/04/2013, 06:24 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

oledlg

imm32

setupapi

iphlpapi

version

wininet

rpcrt4

psapi

oleacc

winspool.drv

comdlg32

netapi32

ws2_32

crypt32

wintrust

winmm

Sections

.text Size: 521KB - Virtual size: 520KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 17KB - Virtual size: 46KB

.rsrc Size: 246KB - Virtual size: 246KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d6:59:2d:ee:e0:7b:b8:d2:d0:80:b4:d9:66:ce:32:3b:38:63:73:86
Signer

03/04/2013, 06:24
Valid: false

.text
Size: 521KB - Virtual size: 520KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 17KB - Virtual size: 46KB

.rsrc
Size: 246KB - Virtual size: 246KB