4f8e683a3b3a8539c518388784b439547c160530ec04deacddb22dade9ecaa3b

Sharing

Copy URL Twitter E-mail

General

Target

4f8e683a3b3a8539c518388784b439547c160530ec04deacddb22dade9ecaa3b
Size

178KB
MD5

05427bbfbab217d136f67e4637e2e9c0
SHA1

be4b12800629e9d909a33f1503d3d1631d81f5f8
SHA256

4f8e683a3b3a8539c518388784b439547c160530ec04deacddb22dade9ecaa3b
SHA512

514d0f77f24612b1b4e7a75d551882f6ff5d90438ef7f61c927baece3c034e8717e874db2e963c829f2a2421b275e4a3484f8fe27c57fc822b11cf57ac0c0772
SSDEEP

3072:KSPz2Xirw+UXWvvEDPu0ttC62mNRuT4VhyriPdzfr6pZyG5g46CCEtmj:Fz0hWnEDn3C6lacVhOK6pZyf4vtm

Score

N/A

Malware Config

Signatures

Files

4f8e683a3b3a8539c518388784b439547c160530ec04deacddb22dade9ecaa3b
.exe windows x64

adcb243d864549a118c4d913fd5f327f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:a1:c3:88:78:92:bf:f6:5d:b0:41:aa:a3:a6:ef:b3:2f:f6:8b:b7
Signer

Actual PE Digest

7e:a1:c3:88:78:92:bf:f6:5d:b0:41:aa:a3:a6:ef:b3:2f:f6:8b:b7

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

17/12/2011, 09:11
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

lstrlenW
GetLastError
lstrcmpiW
SetLastError
GetProcAddress
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
LoadLibraryW
GetCurrentThreadId
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
GetCurrentProcessId
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetACP
CreateFileW
DeviceIoControl
CloseHandle
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
LCMapStringA
RaiseException
InterlockedPushEntrySList
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
LocalFree
GetSystemTime
FormatMessageW
OutputDebugStringW
GetSystemTimeAsFileTime
CreateFileA
WaitForSingleObject
ReleaseMutex
TlsGetValue
TlsSetValue
OpenThread
TlsAlloc
TlsFree
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateMutexW
ReadFile
SetFilePointerEx
WriteFile
GetFileSizeEx
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFilePointer
GetFileType
RtlUnwindEx
GetStartupInfoW
RtlPcToFileHeader
RtlLookupFunctionEntry
HeapReAlloc
Sleep
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
GetModuleFileNameA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate

user32

GetClientRect
ShowWindow
DispatchMessageW
MessageBoxW
DefWindowProcW
GetActiveWindow
GetSystemMetrics
LoadImageW
CreateDialogParamW
DialogBoxParamW
EndDialog
PostQuitMessage
GetParent
UnregisterClassA
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetWindow
MapWindowPoints
SetWindowPos
IsDialogMessageW
SendMessageW
GetWindowLongW
DestroyWindow
SetWindowLongPtrW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage

advapi32

RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW
StrStrIW

comctl32

InitCommonControlsEx

shell32

ShellExecuteW

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

}g
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adcb243d864549a118c4d913fd5f327f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

7e:a1:c3:88:78:92:bf:f6:5d:b0:41:aa:a3:a6:ef:b3:2f:f6:8b:b7Signer

Signature Validations

Verification

17/12/2011, 09:11 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

shell32

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 8KB - Virtual size: 17KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 12KB - Virtual size: 11KB

}g Size: 2KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

7e:a1:c3:88:78:92:bf:f6:5d:b0:41:aa:a3:a6:ef:b3:2f:f6:8b:b7
Signer

17/12/2011, 09:11
Valid: false

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 8KB - Virtual size: 17KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 12KB - Virtual size: 11KB

}g
Size: 2KB - Virtual size: 1KB