4f250072054fec7609bb77fb0bf694369f69f7938701fa6df06a2dd8458fbedf

Sharing

Copy URL Twitter E-mail

General

Target

4f250072054fec7609bb77fb0bf694369f69f7938701fa6df06a2dd8458fbedf
Size

76KB
MD5

be4106d3611a33448ba91281bdfea913
SHA1

d4d1f1a0f59eaf01773ddae8e7a547bae99ca1a6
SHA256

4f250072054fec7609bb77fb0bf694369f69f7938701fa6df06a2dd8458fbedf
SHA512

bed8bcea427064cce7d913aa132a4615327b95d6c589739f89df031d11119d7d6aea940782dfb6a5dbc95eae57e1a3a96d68c14427bf249677b21d2c2be7974f
SSDEEP

1536:Kej3Na4Kj+5VHTCXjIg+fv3jBjypOrOaDGINQisKldZ:7NhKi5gXjGtfOaCyd

Score

N/A

Malware Config

Signatures

Files

4f250072054fec7609bb77fb0bf694369f69f7938701fa6df06a2dd8458fbedf
.exe windows x86

4f365a7fd98af24f0dcb49fe6887853a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/02/2009, 00:00

Not After

11/02/2012, 23:59

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc90u

ord5830
ord6741
ord801
ord5548
ord1048
ord296
ord5567
ord600
ord813
ord938
ord4442
ord799
ord2447
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord5680
ord5663
ord6018
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord589
ord794
ord4967
ord4043
ord5572
ord617
ord5573
ord3589
ord341
ord1137
ord4179
ord1272

msvcr90

_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
wcsrchr
__wgetmainargs
_amsg_exit
malloc
_wtoi
wcsncpy
wcslen
wcsstr
wcscmp
free
_wcsicmp
_waccess
wcschr
memset
atoi
strtok_s
_errno
__CxxFrameHandler3
memcpy
wcscpy_s
wcsncat_s
wcsncpy_s
swscanf_s
_filelength
_read
_close
_lseek
_wsopen
strtoul
calloc
realloc
iswspace
iswalnum
wcscpy
wcscat

kernel32

GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
lstrlenW
GetVersionExW
Beep
GetFileSize
Sleep
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
CloseHandle
CreateFileW
GetLastError

user32

MessageBeep
LoadStringW

advapi32

GetUserNameW

winmm

sndPlaySoundW

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4f365a7fd98af24f0dcb49fe6887853a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

mfc90u

msvcr90

kernel32

user32

advapi32

winmm

Sections

.text Size: 47KB - Virtual size: 47KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 16KB

.rsrc Size: 16KB - Virtual size: 16KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 16KB

.rsrc
Size: 16KB - Virtual size: 16KB