61296a20df349fed35c0522076007d7c5ec1160a4ebccc4195db823e09299f59

Sharing

Copy URL

Twitter E-mail

General

Target

61296a20df349fed35c0522076007d7c5ec1160a4ebccc4195db823e09299f59
Size

428KB
MD5

0b7e54d77f500992ca8163886bf4617d
SHA1

ba87e1f02e95c44ec98141aca5d3a668cb0ba810
SHA256

61296a20df349fed35c0522076007d7c5ec1160a4ebccc4195db823e09299f59
SHA512

81ff30e911957d75c6470851ec717bf7fb28e4335fa2f54c270cd1d428ea41a4f3312cd218bde35fe67ff254e728c76436ea9cd2f81ca0648464e4729cda257d
SSDEEP

12288:dsxUovjYcBfeWpnA5MAgyGQJLHZ4FKdhn4zkR:G2EUcBeenA5MAbjLHZ46h4kR

Score

N/A

Malware Config

Signatures

Files

61296a20df349fed35c0522076007d7c5ec1160a4ebccc4195db823e09299f59
.exe windows x86

974c1b68edf71f9dfb3f38835293c1e8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08-09-2010 00:00

Not After

23-11-2013 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:bf:8c:55:b1:1b:94:14:f1:88:56:33:02:a4:17:88:7f:90:24:d8
Signer

Actual PE Digest

d2:bf:8c:55:b1:1b:94:14:f1:88:56:33:02:a4:17:88:7f:90:24:d8

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

15-11-2010 17:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

secur32

GetUserNameExW

urlmon

URLDownloadToFileW

user32

EnableWindow

gdi32

BitBlt

advapi32

RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

StringFromGUID2

oleaut32

SafeArrayCreate

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup

wininet

InternetCheckConnectionW

userenv

UnloadUserProfile

Sections

.text
Size: 309KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

974c1b68edf71f9dfb3f38835293c1e8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bfCertificate

Extended Key Usages

Key Usages

d2:bf:8c:55:b1:1b:94:14:f1:88:56:33:02:a4:17:88:7f:90:24:d8Signer

Signature Validations

Verification

15-11-2010 17:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

secur32

urlmon

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wininet

userenv

Sections

.text Size: 309KB - Virtual size: 1.3MB

.rsrc Size: 19KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 512B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

d2:bf:8c:55:b1:1b:94:14:f1:88:56:33:02:a4:17:88:7f:90:24:d8
Signer

15-11-2010 17:00
Valid: false

.text
Size: 309KB - Virtual size: 1.3MB

.rsrc
Size: 19KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 512B