General

Malware Config

Signatures

Files

• 28d78e52420906794e4059a603fa9f22d5d6e4479d91e9046a97318c83998679.7z

  .7z

  Password: infected

• 28d78e52420906794e4059a603fa9f22d5d6e4479d91e9046a97318c83998679

  .exe windows x64

  Password: infected

  a2ad5f313e863b273d1b8af86c8a1822

  
  

  Code Sign

  61:05:f7:1e:00:00:00:00:00:32

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  13-07-2009 23:00

  Not After

  13-10-2010 23:10

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:03:dc:f6:00:00:00:00:00:0c

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:12

  Not After

  25-07-2011 19:22

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:15:08:27:00:00:00:00:00:0c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  25-01-2006 23:22

  Not After

  25-01-2017 23:32

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:c1:47:a6:ce:dd:d7:41:ba:63:5a:ca:ad:70:85:b1:f0:ee:31

  Signer

  Actual PE Digest

  0f:a8:c1:47:a6:ce:dd:d7:41:ba:63:5a:ca:ad:70:85:b1:f0:ee:31

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  01-02-2010 20:27

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  HeapAlloc

  HeapFree

  WaitForSingleObject

  GetProcessHeap

  WideCharToMultiByte

  ReadProcessMemory

  CreateEventA

  CreateProcessA

  GetLastError

  SetLastError

  GetProcAddress

  FreeLibrary

  ContinueDebugEvent

  WaitForDebugEvent

  GetVersionExA

  CreateThread

  SetEvent

  OutputDebugStringA

  Sleep

  LoadLibraryA

  lstrlenA

  GetCurrentProcess

  TerminateProcess

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetCurrentThreadId

  GetTickCount

  QueryPerformanceCounter

  GetModuleHandleW

  SetUnhandledExceptionFilter

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  GetStartupInfoW

  UnhandledExceptionFilter

  gdi32

  CreateFontA

  user32

  SetDlgItemTextA

  MessageBoxA

  SendDlgItemMessageA

  DialogBoxParamA

  SetWindowTextA

  SetWindowPos

  GetDesktopWindow

  EndDialog

  GetDlgItem

  SendMessageA

  GetDlgItemTextA

  msvcrt

  _ismbblead

  _cexit

  exit

  _acmdln

  _initterm

  _amsg_exit

  __setusermatherr

  _commode

  __set_app_type

  ?terminate@@YAXXZ

  _exit

  _vsnprintf

  _XcptFilter

  __C_specific_handler

  __getmainargs

  _errno

  _fmode

  Sections

  .text

  Size: 17KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 144B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ