1a3f96d66db7e7ce02840b5f6617eddfda46e4e20e380e70dde748b57608dcb2

Sharing

Copy URL Twitter E-mail

General

Target

1a3f96d66db7e7ce02840b5f6617eddfda46e4e20e380e70dde748b57608dcb2
Size

453KB
MD5

01011ccfc1de4de554b33d6e9f772ffd
SHA1

8964f732425ed9f6fb4b5d4c2b7a4a6dfb1c4ff7
SHA256

1a3f96d66db7e7ce02840b5f6617eddfda46e4e20e380e70dde748b57608dcb2
SHA512

2e02e1061035832c7a1f747df222d5b253a061a087996dba0bf938cf6dd2513dbe9358b76ed2d9516d2c3bb376a696292e432331349e6b042da6a5e13a3f3bf3
SSDEEP

12288:4QUwe7QbXs0DcW+smXWvbSed/T7Sdabv8LhbQ:4QUWXBDcs/eeN6y+hbQ

Score

N/A

Malware Config

Signatures

Files

1a3f96d66db7e7ce02840b5f6617eddfda46e4e20e380e70dde748b57608dcb2
.exe windows x86

114b0f90b2c3ef165bbd52d89f7fcec4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

17/08/2009, 00:00

Not After

05/09/2012, 23:59

Subject

CN=IncrediMail Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=IncrediMail Ltd.,L=Tel-Aviv,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b5:ff:a7:b4:e0:8a:84:f1:51:b3:05:b6:57:c5:07:7c:84:6d:e2:ef
Signer

Actual PE Digest

b5:ff:a7:b4:e0:8a:84:f1:51:b3:05:b6:57:c5:07:7c:84:6d:e2:ef

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IncrediMail Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=IncrediMail Ltd.,L=Tel-Aviv,ST=Israel,C=IL

24/07/2011, 12:52
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
DeleteFileW
EnumResourceNamesW
LocalFree
lstrlenW
GetModuleFileNameW
GetCurrentProcessId
SetCurrentDirectoryW
GetCommandLineW
ExitProcess
FindResourceW
SizeofResource
WriteFile
CreateFileW
LockResource
LoadResource
GlobalFree
GlobalAlloc
lstrcatW
SetEvent
GetCurrentDirectoryW
CreateEventW
GetExitCodeProcess
GetProcessId
GetCurrentProcess
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindClose
FindFirstFileW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
ReadFile
SetFilePointer
LoadLibraryW
GetProcAddress
FreeLibrary
WaitForSingleObject
CreateThread
OpenFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
GetVersionExW
CloseHandle

user32

GetWindowThreadProcessId
EnumWindows
MoveWindow
LoadStringW
PostMessageW
SetWindowPos
CreateWindowExW
TranslateMessage
DispatchMessageW
GetMessageW
DestroyWindow
UnregisterClassW
DefWindowProcW
SetForegroundWindow
GetSystemMetrics
RegisterClassW
SetLayeredWindowAttributes

advapi32

RegCloseKey
RegOpenKeyExW
CreateProcessAsUserW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
RegQueryValueExW

shell32

CommandLineToArgvW
ShellExecuteExW
SHFileOperationW

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MAIN
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SPLASH
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

114b0f90b2c3ef165bbd52d89f7fcec4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

b5:ff:a7:b4:e0:8a:84:f1:51:b3:05:b6:57:c5:07:7c:84:6d:e2:efSigner

Signature Validations

Verification

24/07/2011, 12:52 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 33KB - Virtual size: 33KB

.data Size: 512B - Virtual size: 5KB

.MAIN Size: 1024B - Virtual size: 524B

.CRT Size: 512B - Virtual size: 8B

.SPLASH Size: 512B - Virtual size: 4B

.rsrc Size: 410KB - Virtual size: 410KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2d:a9:db:2d:3d:25:6c:11:46:85:cb:b3:5c:1b:55:1d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

b5:ff:a7:b4:e0:8a:84:f1:51:b3:05:b6:57:c5:07:7c:84:6d:e2:ef
Signer

24/07/2011, 12:52
Valid: false

.text
Size: 33KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 5KB

.MAIN
Size: 1024B - Virtual size: 524B

.CRT
Size: 512B - Virtual size: 8B

.SPLASH
Size: 512B - Virtual size: 4B

.rsrc
Size: 410KB - Virtual size: 410KB