3a41a5780ebb3b6ccec3fe26ccd883dd91da85e6fd7eab0e3e391552dafab1ad

Sharing

Copy URL

Twitter E-mail

General

Target

3a41a5780ebb3b6ccec3fe26ccd883dd91da85e6fd7eab0e3e391552dafab1ad
Size

187KB
MD5

4a07d406ccb68caee6563b208c917025
SHA1

b79370b2666340535ed11ba597b1b8d8baaad81d
SHA256

3a41a5780ebb3b6ccec3fe26ccd883dd91da85e6fd7eab0e3e391552dafab1ad
SHA512

dc4f719d7dad5a554cf0f362cc541c746f57a12180f2220dae69756b33a6dfa33baf3e7cc43c7afbbba1836080a42e78e5413625856193b08d3dc53497561d4f
SSDEEP

3072:pCdRYVTk68jIV6dFss//mgJ4y1O9eRc34ISfDEaIz7L9QPhtzgzhthhL+I6HZBTg:pORp68jIV6jse/VJfwQCHSfDEzz7ZQPi

Score

N/A

Malware Config

Signatures

Files

3a41a5780ebb3b6ccec3fe26ccd883dd91da85e6fd7eab0e3e391552dafab1ad
.exe windows x86

eb397f2ad00dd9f42276dbd3def31009

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01-09-1998 12:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28-01-1999 13:00

Not After

27-01-2017 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18-03-2009 11:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21-12-2009 09:32

Not After

22-12-2020 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:00:00:00:00:01:30:26:93:cb:45
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

25-05-2011 09:43

Not After

25-05-2014 09:43

Subject

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,ST=West Midlands,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22-01-2004 10:00

Not After

27-01-2017 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ac:1b:40:7f:f3:24:a1:74:c8:22:24:b0:99:58:2a:61:e7:51:2a:a6
Signer

Actual PE Digest

ac:1b:40:7f:f3:24:a1:74:c8:22:24:b0:99:58:2a:61:e7:51:2a:a6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AutoIt Consulting Ltd,O=AutoIt Consulting Ltd,L=Birmingham,ST=West Midlands,C=GB

29-01-2012 21:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

kernel32

VirtualAllocEx
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
HeapReAlloc
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
HeapSize
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
LCMapStringW
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
HeapFree
GetLastError
RaiseException
HeapAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCommandLineW
GetCurrentThreadId
CloseHandle
VirtualFreeEx
ReadProcessMemory
FlushFileBuffers
OpenProcess
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
GetProcAddress
GetModuleHandleW
MulDiv

user32

GetCursorPos
GetDC
ReleaseDC
DestroyIcon
CreateWindowExW
SendMessageW
RegisterHotKey
RegisterWindowMessageW
GetCursor
AttachThreadInput
MoveWindow
GetDesktopWindow
RedrawWindow
InvalidateRect
GetParent
GetWindowDC
IsWindow
GetWindowThreadProcessId
IsWindowVisible
GetWindow
ChildWindowFromPointEx
ClientToScreen
EnumChildWindows
GetWindowTextW
SendMessageTimeoutW
GetDlgCtrlID
GetWindowLongW
GetWindowRect
GetClassNameW
GetForegroundWindow
WindowFromPoint
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
ReleaseCapture
SendDlgItemMessageW
SetCapture
SetCursor
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DefWindowProcW
MessageBoxW
DestroyWindow
KillTimer
PostQuitMessage
GetWindowPlacement
RegisterClassExW
LoadIconW
EnableWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
SetTimer
ShowWindow
GetClientRect
SetWindowTextW
SetWindowPos
GetMenu
CheckMenuItem
LoadCursorW
LoadImageW

gdi32

DeleteDC
BitBlt
LineTo
MoveToEx
StretchBlt
PatBlt
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
SetROP2
GetStockObject
SelectObject
CreatePen
GetPixel
DeleteObject
CreateFontW

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb397f2ad00dd9f42276dbd3def31009

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94Certificate

Key Usages

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:30:26:93:cb:45Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

ac:1b:40:7f:f3:24:a1:74:c8:22:24:b0:99:58:2a:61:e7:51:2a:a6Signer

Signature Validations

Verification

29-01-2012 21:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 828KB

.rsrc Size: 91KB - Virtual size: 90KB

.reloc Size: 9KB - Virtual size: 9KB

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

01:00:00:00:00:01:30:26:93:cb:45
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

ac:1b:40:7f:f3:24:a1:74:c8:22:24:b0:99:58:2a:61:e7:51:2a:a6
Signer

29-01-2012 21:34
Valid: false

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 828KB

.rsrc
Size: 91KB - Virtual size: 90KB

.reloc
Size: 9KB - Virtual size: 9KB