3de5f8732ba0959ba80909ca24344d6a58cded1792210b146c9d416c524b5371

Sharing

Copy URL

Twitter E-mail

General

Target

3de5f8732ba0959ba80909ca24344d6a58cded1792210b146c9d416c524b5371
Size

11.6MB
MD5

a3d9f6661be0b2f9d6aa446d19f69384
SHA1

f318abc660788d345eebcf9d166856ba35e67931
SHA256

3de5f8732ba0959ba80909ca24344d6a58cded1792210b146c9d416c524b5371
SHA512

f7e940fa46e2a4cd96964b57b421f58f7de26c22d9f3780b62cf69f47cb4c5d71f714ad41209385bc5198d7eb32702bc38c409caaea7782f2423126635dd8b45
SSDEEP

196608:4cNiq58+x13UUgQgmQzVWBZjsKIPHmYNvPWUuLANLL2jAWVNblhb+w3+UM/PqKCr:V48GUgiQz4Bx8HhHz5sNZhbPOUeqzr

Score

N/A

Malware Config

Signatures

Files

3de5f8732ba0959ba80909ca24344d6a58cded1792210b146c9d416c524b5371
.rar
Keygen.exe
.exe windows x86

720f62ecaae027b5c3ec6686644322e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SmartAssembly.exe
.exe windows x86

6431425d501db8fa2f5e44fbd53edaa7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:6b:f8:ed:6e:5b:0c:66:f9:1e:bb:78:b4:b0:62:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

30-03-2010 00:00

Not After

29-03-2013 23:59

Subject

CN=Red Gate Software Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=APPLICATION DEVELOPMENT,O=Red Gate Software Ltd,L=Cambridge,ST=Cambridgeshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d7:ed:34:ea:ab:52:e3:d8:e2:3b:2c:d4:55:f7:1e:62:3f:0e:e3:d1
Signer

Actual PE Digest

d7:ed:34:ea:ab:52:e3:d8:e2:3b:2c:d4:55:f7:1e:62:3f:0e:e3:d1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Red Gate Software Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=APPLICATION DEVELOPMENT,O=Red Gate Software Ltd,L=Cambridge,ST=Cambridgeshire,C=GB

24-05-2012 02:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

GetStartupInfoW
SetEnvironmentVariableW
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
RaiseException
Sleep
ExitProcess
ExitThread
CreateThread
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW
SetErrorMode
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetProcessHeap
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
WaitForSingleObject
TerminateProcess
FindFirstFileExW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
SetEvent
GetEnvironmentVariableW
GetTempPathW
lstrlenW
WideCharToMultiByte
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
GetLastError
GetVersionExW
GetDiskFreeSpaceExW
ResetEvent
GetModuleFileNameW
VirtualFree
GetTickCount
CreateEventW
CreateFileW
GetFileSize
SetFilePointer
ReadFile
lstrlenA
WriteFile
FreeResource
GetFullPathNameW
SetEndOfFile
FlushFileBuffers
GlobalFlags
GetCurrentDirectoryW
WritePrivateProfileStringW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
InterlockedIncrement
GetModuleHandleA
InterlockedDecrement
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
EnumResourceNamesW
GetCurrentProcessId
SuspendThread
ResumeThread
SetThreadPriority
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleW
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
MulDiv
GetCurrentProcess
lstrcmpA
lstrcpyW
VirtualAlloc
LocalFree
LocalAlloc
lstrcpynW

user32

UnregisterClassW
LoadCursorW
GetSysColorBrush
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DestroyMenu
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SystemParametersInfoA
GetWindowPlacement
GetLastActivePopup
MessageBoxW
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetWindowPos
SetFocus
ShowWindow
SetWindowLongW
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetWindow
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
GetWindowRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
DrawIcon
GetClientRect
IsIconic
SendMessageW
AppendMenuW
GetSystemMenu
LoadIconW
EnableWindow
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
PostMessageW
GetWindowThreadProcessId
GetWindowLongW
EnumWindows
GetSystemMetrics

gdi32

DeleteObject
PtVisible
RectVisible
TextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetMapMode
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
RestoreDC
SaveDC
ExtTextOutW
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetDeviceCaps
GetStockObject
SetBkMode
SelectObject
CreateFontIndirectW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegDeleteKeyW
FreeSid
RegCloseKey

shell32

SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
SHGetSpecialFolderLocation

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathFindExtensionW
PathAppendW

ole32

StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantChangeType
VariantInit

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CryptDecodeObject
CertFreeCertificateContext
CertFindCertificateInStore
CryptQueryObject

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
smart assembly.mp4

Sharing

General

Malware Config

Signatures

Files

720f62ecaae027b5c3ec6686644322e9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 102KB - Virtual size: 101KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

6431425d501db8fa2f5e44fbd53edaa7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

69:6b:f8:ed:6e:5b:0c:66:f9:1e:bb:78:b4:b0:62:a5Certificate

Extended Key Usages

Key Usages

d7:ed:34:ea:ab:52:e3:d8:e2:3b:2c:d4:55:f7:1e:62:3f:0e:e3:d1Signer

Signature Validations

Verification

24-05-2012 02:16 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wintrust

crypt32

Sections

.text Size: 184KB - Virtual size: 183KB

.rdata Size: 49KB - Virtual size: 49KB

.data Size: 9KB - Virtual size: 24KB

.rsrc Size: 4.6MB - Virtual size: 4.6MB

.text
Size: 102KB - Virtual size: 101KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

69:6b:f8:ed:6e:5b:0c:66:f9:1e:bb:78:b4:b0:62:a5
Certificate

d7:ed:34:ea:ab:52:e3:d8:e2:3b:2c:d4:55:f7:1e:62:3f:0e:e3:d1
Signer

24-05-2012 02:16
Valid: false

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 49KB - Virtual size: 49KB

.data
Size: 9KB - Virtual size: 24KB

.rsrc
Size: 4.6MB - Virtual size: 4.6MB