b383f2050a375a001e894daa3f699db0960a83e13b7d21d0358189ef9d30d8d0

Sharing

Copy URL Twitter E-mail

General

Target

b383f2050a375a001e894daa3f699db0960a83e13b7d21d0358189ef9d30d8d0
Size

299KB
MD5

48f0dcc7d18351912b2ef778a52ccbd0
SHA1

d673887f061dbb6fa739d2db60c323b21e4fd7c5
SHA256

b383f2050a375a001e894daa3f699db0960a83e13b7d21d0358189ef9d30d8d0
SHA512

b3538a9f088089f566029c034110f8a9b5c34ca6c58365c84f1cfe2f5f88a27de47bdea282bb1855be19b0729448ebf843933ee45f8708047d98e66915f852c5
SSDEEP

6144:aXi9J10DOH66bUS/YUrP3w2gEj7YLiC2WJ2cn8DPj921AwuPf3vgZQ9uowCbOGxM:aG10DOH66bUS/YUrP3w2gEj7YLiC2WJH

Score

N/A

Malware Config

Signatures

Files

b383f2050a375a001e894daa3f699db0960a83e13b7d21d0358189ef9d30d8d0
.exe windows x86

5de8475bf007321878dc1f1d18a281b8

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:02:30:7e:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2008, 21:57

Not After

10/06/2009, 22:07

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

38:f5:7b:11:a1:e9:ae:e1:3c:17:61:6d:20:9a:32:6c:ed:41:2b:ab
Signer

Actual PE Digest

38:f5:7b:11:a1:e9:ae:e1:3c:17:61:6d:20:9a:32:6c:ed:41:2b:ab

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/07/2008, 05:10
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
LocalAlloc
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
LeaveCriticalSection
GlobalLock
GlobalReAlloc
GlobalAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GetVersion
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
InterlockedDecrement
FreeLibrary
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
HeapReAlloc
GetStartupInfoA
GetTimeZoneInformation
GetACP
HeapSize
TerminateProcess
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
InterlockedIncrement
GetFileTime
GetFileSize
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
WriteFile
HeapAlloc
HeapFree
GetCurrentThreadId
CreateMutexA
CreateDirectoryA
GetCommandLineA
ReleaseMutex
SetUnhandledExceptionFilter
GetVersionExA
WinExec
GetWindowsDirectoryA
GetModuleHandleA
GetModuleFileNameA
MultiByteToWideChar
GetFileAttributesA
CreateFileA
SetFilePointer
ReadFile
lstrcatA
GetLastError
DeleteFileA
SetLastError
lstrlenA
lstrcpyA
Sleep
ExitProcess
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
lstrcmpiA
CloseHandle

shell32

SHGetFolderPathA

comctl32

ord17

gdi32

ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

comdlg32

GetFileTitleA

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5de8475bf007321878dc1f1d18a281b8

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:02:30:7e:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

38:f5:7b:11:a1:e9:ae:e1:3c:17:61:6d:20:9a:32:6c:ed:41:2b:abSigner

Signature Validations

Verification

19/07/2008, 05:10 Valid: false

Headers

File Characteristics

Imports

kernel32

shell32

comctl32

gdi32

winspool.drv

comdlg32

Sections

.text Size: 260KB - Virtual size: 260KB

.rsrc Size: 3KB - Virtual size: 3KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:02:30:7e:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

38:f5:7b:11:a1:e9:ae:e1:3c:17:61:6d:20:9a:32:6c:ed:41:2b:ab
Signer

19/07/2008, 05:10
Valid: false

.text
Size: 260KB - Virtual size: 260KB

.rsrc
Size: 3KB - Virtual size: 3KB