General

Malware Config

Signatures

Files

• af300f7416cec20a6de2129f132de30826b546b19a69231fcc94ee716f55908c

  .exe windows x86

  79f6656653bb3cf0dcf416a2e7f68375

  
  

  Code Sign

  33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  11-11-2013 22:11

  Not After

  11-02-2015 22:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:00:ba:c6:10:40:32:d6:dd:18:90:00:01:00:00:00:ba

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  13-03-2013 20:31

  Not After

  13-06-2014 20:31

  Subject

  CN=Skype Software Sarl,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:0e:3f:65:71:72:dc:d1:6f:d6:00:00:00:00:00:0e

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-02-2013 21:14

  Not After

  22-05-2014 21:14

  Subject

  CN=Skype Software Sarl,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  88:12:e9:e4:66:3b:f2:cf:d6:75:48:32:64:b1:8c:ff:66:f1:83:5f:41:e8:da:d9:08:b6:93:0b:89:d7:a7:b0

  Signer

  Actual PE Digest

  88:12:e9:e4:66:3b:f2:cf:d6:75:48:32:64:b1:8c:ff:66:f1:83:5f:41:e8:da:d9:08:b6:93:0b:89:d7:a7:b0

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Skype Software Sarl,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  24-11-2022 14:54

  Valid: false

  8d:20:b7:89:de:4c:0e:94:04:0f:9b:da:98:f6:84:14:f4:9c:a5:31

  Signer

  Actual PE Digest

  8d:20:b7:89:de:4c:0e:94:04:0f:9b:da:98:f6:84:14:f4:9c:a5:31

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Skype Software Sarl,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  08-05-2014 10:16

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvbvm60

  ord589

  ord697

  MethCallEngine

  ord517

  __vbaCopyBytes

  ord666

  ord595

  ord631

  ord525

  ord632

  EVENT_SINK_AddRef

  DllFunctionCall

  EVENT_SINK_Release

  EVENT_SINK_QueryInterface

  __vbaExceptHandler

  ord711

  ord608

  ord717

  ord186

  ord644

  ord685

  ord578

  ord100

  ord614

  ord616

  ord618

  ord619

  Sections

  .text

  Size: 68KB - Virtual size: 64KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 276KB - Virtual size: 274KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ