3f80a10502d6870ef7dd4a9bf75f58d07bcb3649c096adc2488b65dd34d4a3ff

Sharing

Copy URL Twitter E-mail

General

Target

3f80a10502d6870ef7dd4a9bf75f58d07bcb3649c096adc2488b65dd34d4a3ff
Size

405KB
MD5

14d2393767b28155561d3d7505861c90
SHA1

9e2e5f67ba853aad3a1768742ec18a108ac32f68
SHA256

3f80a10502d6870ef7dd4a9bf75f58d07bcb3649c096adc2488b65dd34d4a3ff
SHA512

0389ab75d301521106f6ad4db2aa87da49c653b66464f9b9c76e50e6dd2b885d83bd04671965b71582163febe870008a2f267a586452fba6c2dd26bd22690332
SSDEEP

12288:AR3OVMXmwXpC1Rr9qDaKXokygjJIHGKQApbzMwYMqOpGyg5ht:AV5XJdVIH5/NQ/ipGyUt

Score

N/A

Malware Config

Signatures

Files

3f80a10502d6870ef7dd4a9bf75f58d07bcb3649c096adc2488b65dd34d4a3ff
.dll regsvr32 windows x86

b68663b0bd728d5177529abb56818c4b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:ba:a1:10:b3:5d:98:65:83:3d:2d:3f:38:6b:8f:44
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

03/07/2009, 00:00

Not After

03/07/2011, 23:59

Subject

CN=SHANGHAI ZHONGYUAN NETWORKS LIMITED,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SHANGHAI ZHONGYUAN NETWORKS LIMITED,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
InterlockedExchangeAdd
TlsAlloc
PostQueuedCompletionStatus
TlsFree
MultiByteToWideChar
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
FreeLibrary
GetVersionExW
GetPrivateProfileIntW
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
DeleteCriticalSection
SetLastError
TerminateThread
ResetEvent
lstrcpyW
LocalFree
CreateThread
ResumeThread
GetFileAttributesW
CreateFileW
SetFilePointer
SetEndOfFile
GetFileSizeEx
lstrlenW
SetFilePointerEx
ReadFile
LockFile
WriteFile
UnlockFile
lstrcpynW
GetTickCount
FileTimeToSystemTime
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
CreateEventW
SleepEx
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
Sleep
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
TlsGetValue
TlsSetValue
GetFileTime
WideCharToMultiByte
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
FormatMessageA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
InterlockedExchange
GetLastError
SetEvent
CreateEventA
WaitForSingleObject
CloseHandle
CreateDirectoryW
GetModuleFileNameW
GetProcAddress
LoadLibraryW
GetLocaleInfoA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStartupInfoA
SetHandleCount
CreateFileA
GetFileType
LoadLibraryA
LCMapStringW
LCMapStringA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
OpenEventA
SystemTimeToFileTime
CreateWaitableTimerA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
GetModuleHandleW
ExitProcess
GetCommandLineA
GetModuleHandleA

user32

IsWindow
GetParent
wsprintfW
PostMessageW

advapi32

RegDeleteKeyW
RegSetValueExW
RegCreateKeyW
RegCloseKey
RegOpenKeyW
RegQueryValueExW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ws2_32

htonl
ntohl
WSAGetLastError
ntohs
htons
WSAAddressToStringA
select
inet_addr
WSASocketW
WSASend
WSARecv
listen
shutdown
ioctlsocket
closesocket
WSASetLastError
inet_ntoa
WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
connect
getsockopt
getpeername
getsockname
gethostbyname
socket
send
recv
setsockopt

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

DllRegisterServer
DllUnregisterServer
initialize
initialize_v2
uninitialize
uninitialize_v2

Sections

.text
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b68663b0bd728d5177529abb56818c4b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

3f:ba:a1:10:b3:5d:98:65:83:3d:2d:3f:38:6b:8f:44Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

version

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 313KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 12KB - Virtual size: 21KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 22KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

3f:ba:a1:10:b3:5d:98:65:83:3d:2d:3f:38:6b:8f:44
Certificate

.text
Size: 313KB - Virtual size: 313KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 12KB - Virtual size: 21KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 22KB