47957339a0c5f7b6359867a5bfe74939e15571897a1b58db9de1cc4dae5d7e2c

Sharing

Copy URL

Twitter E-mail

General

Target

47957339a0c5f7b6359867a5bfe74939e15571897a1b58db9de1cc4dae5d7e2c
Size

1.2MB
MD5

298ea3914420a6130a35ccdf15eb14a1
SHA1

e9b1e8feeda8c852a3c92dd68567f875ac071281
SHA256

47957339a0c5f7b6359867a5bfe74939e15571897a1b58db9de1cc4dae5d7e2c
SHA512

f569ffb1e4b567b8b567d7dab58c3977105b2f6b8e8d54e3b578562775aa559cd1dec929736d4da0656125a15fee2369d2a71c1b7753d8b57afdba3612f14d2e
SSDEEP

24576:9PcotLednK8ZEGfzvMxGIDrJKkb+dVBNTnn:SotLN6fcQr7Tnn

Score

N/A

Malware Config

Signatures

Files

47957339a0c5f7b6359867a5bfe74939e15571897a1b58db9de1cc4dae5d7e2c
.exe windows x86

14e80b9a682f24ae67de3031bb74c39d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:07:c2:09:fd:c7:8f:57:4d:4b:9b:f2:40:68:88:13
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

26/01/2013, 00:00

Not After

16/02/2015, 23:59

Subject

CN=Bitvise Limited,OU=Software Development,O=Bitvise Limited,L=Gibraltar,ST=Gibraltar,C=GI

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

00:f9:2a:f0:81:d9:4e:98:19:77:51:95:5b:33:e8:f6:f4:1b:f5:9d
Signer

Actual PE Digest

00:f9:2a:f0:81:d9:4e:98:19:77:51:95:5b:33:e8:f6:f4:1b:f5:9d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Bitvise Limited,OU=Software Development,O=Bitvise Limited,L=Gibraltar,ST=Gibraltar,C=GI

04/02/2013, 00:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
HeapReAlloc
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
Sleep
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
HeapAlloc
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
SetStdHandle
GetLocaleInfoW
CompareStringA
CompareStringW
GetOEMCP
SetEnvironmentVariableA
InterlockedIncrement
GetTimeZoneInformation
CreateThread
HeapFree
RaiseException
RtlUnwind
ExitProcess
GetStartupInfoW
FormatMessageW
GetFileAttributesW
GetTickCount
FileTimeToLocalFileTime
GetVolumeInformationW
FindFirstFileW
FindClose
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
SetErrorMode
GetThreadLocale
WritePrivateProfileStringW
GetProcessVersion
TlsGetValue
LocalReAlloc
InterlockedExchange
GetProfileStringA
GlobalAddAtomA
FindResourceA
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
SizeofResource
GlobalFlags
lstrcpynW
lstrcmpW
GlobalAlloc
lstrcmpA
GetCurrentThread
lstrcatW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrcpyW
lstrlenW
GlobalFree
LockResource
FindResourceW
LoadResource
GetComputerNameW
GetCurrentProcess
WaitForSingleObject
LocalFree
InterlockedExchangeAdd
GetCurrentProcessId
ExitThread
LeaveCriticalSection
LoadLibraryA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
SetEvent
CreateEventW
GetSystemTimeAsFileTime
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetFullPathNameW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetModuleHandleW
MulDiv
GlobalLock
GlobalUnlock
lstrlenA
SetLastError
lstrcmpiA
GetVersionExW
ExpandEnvironmentStringsW
GetVersion
GetFileType
SetFilePointer
SetEndOfFile
SystemTimeToFileTime
FileTimeToSystemTime
GetFileTime
GetFileSize
WriteFile
ReadFile
CreateFileA
CreateFileW
GetLastError
CloseHandle
GetModuleHandleA
GetACP
InterlockedDecrement
IsBadReadPtr

user32

SetRect
CopyAcceleratorTableW
CharNextW
DestroyMenu
GetSysColorBrush
GetDesktopWindow
GetClassNameW
SetWindowContextHelpId
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
GrayStringW
TabbedTextOutW
LoadStringW
wvsprintfW
IsDialogMessageW
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
LoadIconW
UpdateWindow
SendDlgItemMessageW
SendDlgItemMessageA
PeekMessageW
DispatchMessageW
AdjustWindowRectEx
GetTopWindow
IsChild
GetNextDlgGroupItem
WinHelpW
wsprintfW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetMenuItemID
GetKeyState
DefWindowProcW
SetWindowsHookExW
CallNextHookEx
SetPropW
UnhookWindowsHookEx
GetPropW
RemovePropW
GetMessagePos
GetLastActivePopup
RegisterWindowMessageW
IntersectRect
GetActiveWindow
SetActiveWindow
MessageBoxA
wsprintfA
GetMenuState
GetWindowDC
UnregisterClassW
GetWindowTextLengthA
HideCaret
ShowCaret
ExcludeUpdateRgn
GetWindowTextA
EndDialog
DestroyWindow
CreateDialogIndirectParamW
GetFocus
SetFocus
GetSystemMetrics
InflateRect
MapWindowPoints
MessageBeep
SetWindowTextW
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
GetCursor
GetDlgCtrlID
BeginPaint
IsWindowEnabled
GetWindowTextLengthW
GetWindowTextW
CharUpperW
RegisterClipboardFormatW
GetCapture
PostThreadMessageW
DrawTextW
OffsetRect
FrameRect
EndPaint
PtInRect
GetMessageTime
SetCapture
ReleaseCapture
CreateWindowExW
LoadCursorW
DrawTextA
DrawFocusRect
GetClassInfoA
DefDlgProcA
DefWindowProcA
CharNextA
CallWindowProcA
SetWindowsHookExA
GetWindowLongA
SendMessageA
IsWindowUnicode
SetWindowLongA
TrackMouseEvent
SetCursor
SetPropA
SetWindowLongW
GetPropA
RemovePropA
CallWindowProcW
GetIconInfo
LoadImageW
GetWindowLongW
GetClassNameA
GetDC
ReleaseDC
GetWindowPlacement
GetCursorPos
SetWindowPos
ClientToScreen
ScreenToClient
GetParent
FillRect
SetTimer
GetForegroundWindow
CharLowerBuffW
GetNextDlgTabItem
GetSysColor
FindWindowW
IsIconic
ShowWindow
SetForegroundWindow
PostMessageW
KillTimer
GetDlgItem
MessageBoxW
IsWindow
MoveWindow
InvalidateRect
GetWindow
IsWindowVisible
GetWindowRect
CopyRect
SystemParametersInfoW
GetClientRect
MapDialogRect
SendMessageW
EnableWindow
GetSubMenu

gdi32

ExtSelectClipRgn
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
Escape
GetMapMode
GetTextColor
GetBkColor
GetTextExtentPointA
ExtTextOutA
IntersectClipRect
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
PatBlt
DeleteDC
GetClipBox
DPtoLP
SetBkColor
BitBlt
GetNearestColor
CreateSolidBrush
CreateBitmap
CreateFontIndirectW
SetTextColor
SetBkMode
CreateBitmapIndirect
CreateBrushIndirect
GetObjectW
GetStockObject
DeleteObject
CreateDIBitmap
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetTextMetricsW
GetDeviceCaps
GetPixel
SetPixel
CreateRectRgn
LPtoDP
ExtTextOutW

comdlg32

GetSaveFileNameW
GetFileTitleW
GetOpenFileNameW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

GetUserNameW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
LookupAccountSidW
RegNotifyChangeKeyValue
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

shell32

ShellExecuteW

comctl32

ImageList_Destroy
ImageList_Create
ord17

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
CreateILockBytesOnHGlobal
CoTaskMemAlloc
CLSIDFromString
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree

olepro32

ord253

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
VariantClear
VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysAllocString

ws2_32

ntohl
inet_addr
inet_ntoa
htonl

Sections

.text
Size: 880KB - Virtual size: 878KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14e80b9a682f24ae67de3031bb74c39d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

24:07:c2:09:fd:c7:8f:57:4d:4b:9b:f2:40:68:88:13Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

00:f9:2a:f0:81:d9:4e:98:19:77:51:95:5b:33:e8:f6:f4:1b:f5:9dSigner

Signature Validations

Verification

04/02/2013, 00:30 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

ws2_32

Sections

.text Size: 880KB - Virtual size: 878KB

.rdata Size: 196KB - Virtual size: 195KB

.data Size: 48KB - Virtual size: 68KB

.rsrc Size: 124KB - Virtual size: 123KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

24:07:c2:09:fd:c7:8f:57:4d:4b:9b:f2:40:68:88:13
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

00:f9:2a:f0:81:d9:4e:98:19:77:51:95:5b:33:e8:f6:f4:1b:f5:9d
Signer

04/02/2013, 00:30
Valid: false

.text
Size: 880KB - Virtual size: 878KB

.rdata
Size: 196KB - Virtual size: 195KB

.data
Size: 48KB - Virtual size: 68KB

.rsrc
Size: 124KB - Virtual size: 123KB