General

Malware Config

Signatures

Files

• 2e018df199f8cc0b10a78957ae79ab110b74970574d7525e2f58658607dffb6f

  .exe windows x86

  711bcc1f0bbc9c7ee450baffe46d033e

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:cf:3e:00:00:00:00:00:0f

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  07-12-2009 22:40

  Not After

  07-03-2011 22:40

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:05:a2:30:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:01

  Not After

  25-07-2013 19:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  03:15:ef:40:0e:d5:9e:b7:ae:1d:44:29:05:33:cb:e8:67:ce:95:ce

  Signer

  Actual PE Digest

  03:15:ef:40:0e:d5:9e:b7:ae:1d:44:29:05:33:cb:e8:67:ce:95:ce

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  28-04-2010 21:20

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  RegDeleteKeyW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegOpenKeyExW

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  GetSecurityDescriptorDacl

  GetSecurityDescriptorOwner

  GetUserNameW

  GetTokenInformation

  ConvertSidToStringSidW

  ImpersonateLoggedOnUser

  OpenThreadToken

  RevertToSelf

  DuplicateTokenEx

  DuplicateToken

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  CryptGenRandom

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegisterTraceGuidsW

  GetTraceLoggerHandle

  TraceEvent

  UnregisterTraceGuids

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptAcquireContextW

  CryptReleaseContext

  CreateWellKnownSid

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  OpenProcessToken

  SetNamedSecurityInfoW

  GetSidLengthRequired

  InitializeSid

  GetSidSubAuthority

  SetSecurityInfo

  CopySid

  IsValidSid

  GetLengthSid

  InitializeAcl

  AddAce

  RegQueryValueExW

  kernel32

  GlobalMemoryStatusEx

  GetSystemDefaultUILanguage

  GetSystemDefaultLCID

  GetComputerNameExW

  GetEnvironmentVariableW

  lstrlenA

  OpenProcess

  GetTempPathA

  GetFullPathNameA

  DeleteFileA

  GetFileInformationByHandle

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  GetFileAttributesA

  GetShortPathNameW

  GetLocalTime

  ReadFile

  CreateProcessW

  GetExitCodeProcess

  GetFullPathNameW

  GlobalFree

  CreateWaitableTimerW

  WaitForMultipleObjects

  GetExitCodeThread

  GetTempPathW

  SetWaitableTimer

  TerminateThread

  GetUserDefaultLangID

  QueueUserAPC

  GetVersionExW

  CompareFileTime

  CopyFileW

  GetComputerNameW

  SystemTimeToFileTime

  InterlockedCompareExchange

  GetFileSize

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  ResetEvent

  ReleaseSemaphore

  CreateSemaphoreW

  CreateThread

  LocalAlloc

  GetSystemTime

  InitializeCriticalSectionAndSpinCount

  DuplicateHandle

  FreeLibraryAndExitThread

  SetFileAttributesW

  RemoveDirectoryW

  MoveFileExW

  GetFileAttributesW

  CreateDirectoryW

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  CreateFileW

  DeviceIoControl

  DeleteFileW

  GetTempFileNameW

  FindNextFileW

  FindFirstFileW

  FindClose

  EnumResourceNamesW

  VerifyVersionInfoW

  ExpandEnvironmentStringsW

  FindResourceExW

  LockResource

  SetEnvironmentVariableA

  CompareStringA

  FlushFileBuffers

  CreateFileA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  SetStdHandle

  GetTimeZoneInformation

  GetFileAttributesExW

  GetConsoleCP

  SetFilePointer

  GetStringTypeW

  GetStringTypeA

  LoadLibraryA

  HeapSize

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  LCMapStringW

  WideCharToMultiByte

  LCMapStringA

  GetOEMCP

  GetCPInfo

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  VirtualFree

  HeapCreate

  HeapDestroy

  GetCurrentThread

  GetCurrentThreadId

  SetLastError

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetStartupInfoA

  GetFileType

  SetHandleCount

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  UnhandledExceptionFilter

  GetModuleFileNameA

  GetStdHandle

  WriteFile

  ExitProcess

  VirtualQuery

  OpenFileMappingW

  SetFilePointerEx

  GetFileSizeEx

  GetSystemInfo

  GetModuleHandleA

  GetProcAddress

  VirtualAlloc

  VirtualProtect

  HeapReAlloc

  GetStartupInfoW

  GetProcessHeap

  HeapAlloc

  HeapFree

  GetVersionExA

  GetThreadLocale

  GetLocaleInfoA

  GetACP

  CloseHandle

  ReleaseMutex

  FreeLibrary

  InterlockedExchange

  RaiseException

  InitializeCriticalSection

  DeleteCriticalSection

  InterlockedDecrement

  LocalFree

  GetLastError

  FormatMessageW

  WaitForSingleObject

  OpenMutexW

  CreateMutexW

  GetModuleFileNameW

  lstrlenW

  EnterCriticalSection

  LeaveCriticalSection

  ExitThread

  lstrcmpiW

  LoadLibraryExW

  GetCommandLineW

  LoadLibraryW

  GetSystemDirectoryW

  Sleep

  HeapSetInformation

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  GetModuleHandleW

  CompareStringW

  SetEvent

  OpenEventW

  GetDiskFreeSpaceExW

  MulDiv

  CreateEventW

  QueueUserWorkItem

  GetLongPathNameW

  FileTimeToSystemTime

  SetThreadPriority

  GetThreadPriority

  GetConsoleMode

  InterlockedIncrement

  gdi32

  CreatePen

  CreateSolidBrush

  SaveDC

  RestoreDC

  SetBkColor

  SetLayout

  DeleteObject

  GetObjectW

  CreateFontIndirectW

  SetTextColor

  GetStockObject

  SetBkMode

  BitBlt

  DeleteDC

  SelectObject

  CreateCompatibleBitmap

  CreateCompatibleDC

  ExcludeClipRect

  Rectangle

  IntersectClipRect

  GetClipRgn

  CreateRectRgn

  GetTextMetricsW

  user32

  GetMessageW

  TranslateAcceleratorW

  IsDialogMessageW

  DestroyAcceleratorTable

  GetLayeredWindowAttributes

  SetLayeredWindowAttributes

  EnableWindow

  GetWindowTextLengthW

  GetWindowTextW

  GetClassNameW

  GetDesktopWindow

  FindWindowExW

  SystemParametersInfoW

  CopyRect

  GetSysColor

  MessageBoxIndirectW

  RedrawWindow

  MessageBeep

  SetWindowLongW

  CreateAcceleratorTableW

  InflateRect

  GetWindowLongW

  AdjustWindowRectEx

  GetSystemMetrics

  DrawTextW

  LoadIconW

  EndDialog

  GetParent

  MsgWaitForMultipleObjectsEx

  TranslateMessage

  DispatchMessageW

  PeekMessageW

  UnregisterClassA

  ExitWindowsEx

  SetCursor

  LoadCursorW

  DefWindowProcW

  PostMessageW

  SendMessageW

  DestroyWindow

  IsWindow

  SetRect

  GetWindowRect

  SetTimer

  KillTimer

  PostQuitMessage

  SetForegroundWindow

  GetForegroundWindow

  IsWindowVisible

  GetNextDlgTabItem

  NotifyWinEvent

  IsWindowEnabled

  UpdateWindow

  PtInRect

  RegisterClassExW

  InvalidateRect

  GetFocus

  GetKeyState

  IntersectRect

  SetScrollInfo

  GetScrollInfo

  TrackMouseEvent

  RegisterWindowMessageW

  DefDlgProcW

  EnumChildWindows

  CreateDialogIndirectParamW

  DialogBoxIndirectParamW

  DrawIconEx

  GetClassLongW

  MapWindowPoints

  ScreenToClient

  WindowFromPoint

  GetDCEx

  SetWindowRgn

  PostThreadMessageW

  GetWindowThreadProcessId

  GetShellWindow

  SendMessageTimeoutW

  GetClientRect

  EndPaint

  EnumWindows

  LoadStringW

  MsgWaitForMultipleObjects

  BeginPaint

  SetFocus

  CreateWindowExW

  ReleaseDC

  GetDC

  SetWindowTextW

  SetWindowPos

  GetSystemMenu

  EnableMenuItem

  ShowWindow

  GetDlgItem

  IsDlgButtonChecked

  CheckDlgButton

  CharNextW

  FillRect

  SetProcessDefaultLayout

  sensapi

  IsNetworkAlive

  urlmon

  CreateURLMoniker

  CoInternetGetSession

  CreateAsyncBindCtx

  msi

  ord96

  ord49

  ord51

  ord80

  ord34

  ord78

  ord150

  ord266

  ord48

  ord195

  ord92

  ord32

  ord159

  ord173

  ord205

  ord113

  ord70

  ord203

  ord141

  ord118

  ord160

  ord8

  ord88

  ord190

  ord115

  ord116

  ord171

  comctl32

  ord17

  ord410

  ord412

  ord413

  wintrust

  WTHelperProvDataFromStateData

  WTHelperGetProvSignerFromChain

  WinVerifyTrustEx

  userenv

  UnloadUserProfile

  setupapi

  SetupIterateCabinetW

  secur32

  GetUserNameExW

  crypt32

  CryptStringToBinaryW

  CertVerifyCertificateChainPolicy

  CryptBinaryToStringW

  uxtheme

  SetWindowTheme

  psapi

  EnumProcesses

  GetModuleFileNameExW

  GetModuleBaseNameW

  EnumProcessModules

  shlwapi

  PathCreateFromUrlW

  PathFindExtensionW

  PathFileExistsW

  UrlCreateFromPathW

  StrRChrW

  StrFormatByteSizeW

  PathFindFileNameW

  PathIsDirectoryW

  ord437

  StrStrNW

  PathAppendW

  SHCreateStreamOnFileEx

  UrlCanonicalizeW

  PathFindFileNameA

  SHCreateStreamOnFileA

  PathStripPathW

  PathRemoveFileSpecW

  PathCombineW

  StrStrIW

  PathIsRelativeW

  SHCreateStreamOnFileW

  StrCmpNW

  wininet

  InternetCrackUrlW

  InternetCreateUrlW

  InternetCombineUrlW

  gdiplus

  GdiplusStartup

  GdipDeleteGraphics

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateFromHDC

  GdiplusShutdown

  GdipDrawImageRectRectI

  GdipFree

  GdipAlloc

  GdipCreateFontFamilyFromName

  GdipDeleteFontFamily

  GdipDeleteFont

  GdipDisposeImage

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromStreamICM

  GdipCreateFromHWND

  GdipCreateFont

  GdipGetLogFontW

  GdipCloneImage

  GdipDrawImageRectRect

  GdipDrawImageI

  GdipDrawImagePointRectI

  GdipDrawImageRectI

  winhttp

  WinHttpOpen

  WinHttpCloseHandle

  WinHttpWriteData

  WinHttpAddRequestHeaders

  WinHttpTimeFromSystemTime

  WinHttpSetCredentials

  WinHttpGetProxyForUrl

  WinHttpDetectAutoProxyConfigUrl

  WinHttpGetDefaultProxyConfiguration

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpCrackUrl

  WinHttpConnect

  WinHttpOpenRequest

  WinHttpSendRequest

  WinHttpReadData

  WinHttpQueryHeaders

  WinHttpSetStatusCallback

  WinHttpQueryOption

  WinHttpSetOption

  WinHttpQueryDataAvailable

  WinHttpReceiveResponse

  cabinet

  ord11

  ord14

  ord13

  ord10

  ntdll

  VerSetConditionMask

  RtlUnwind

  oleacc

  LresultFromObject

  AccessibleObjectFromWindow

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  wsock32

  WSAStartup

  inet_addr

  WSAGetLastError

  gethostbyname

  WSACleanup

  shell32

  SHFileOperationW

  ShellExecuteExW

  SHCreateDirectoryExW

  CommandLineToArgvW

  SHGetFolderPathW

  ord165

  SHGetSpecialFolderPathW

  SHGetFolderPathAndSubDirW

  ole32

  CoCreateFreeThreadedMarshaler

  CreateStreamOnHGlobal

  CoUninitialize

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoCreateInstance

  CoTaskMemFree

  StringFromGUID2

  CoRevokeClassObject

  CoRegisterClassObject

  CoInitializeEx

  CoSetProxyBlanket

  CoCopyProxy

  CoQueryProxyBlanket

  CoCreateGuid

  OleRun

  OleLockRunning

  oleaut32

  LoadTypeLi

  LoadRegTypeLi

  VariantCopy

  SysAllocStringLen

  VariantChangeType

  SysAllocString

  SysStringLen

  SysFreeString

  LoadTypeLibEx

  VariantClear

  VariantInit

  VarUI4FromStr

  Sections

  .text

  Size: 721KB - Virtual size: 721KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 15KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 463KB - Virtual size: 463KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 48KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ