dbe13887fabe20ebb69010d4cdf8b12e18fe0d6fd5d2896714c56795797c78b0

Sharing

Copy URL Twitter E-mail

General

Target

dbe13887fabe20ebb69010d4cdf8b12e18fe0d6fd5d2896714c56795797c78b0
Size

126KB
MD5

2029fd7418ab5a938d120bbdbec46ece
SHA1

cc1d8cc4d6aeecd6922015bc8ff1f42ed4986dbc
SHA256

dbe13887fabe20ebb69010d4cdf8b12e18fe0d6fd5d2896714c56795797c78b0
SHA512

d4660efa6dab7938be510be39106edb6af009eb48c977932e59f91dc2fe432a3b40ecdaebe21bf5a19b8bb3189084050d9bc7f1b809179238a4c37772697c72e
SSDEEP

3072:eCkjBjOy5VM30QSPwUqgHiAXqkxICwbUo:+n5VSzQiFd

Score

N/A

Malware Config

Signatures

Files

dbe13887fabe20ebb69010d4cdf8b12e18fe0d6fd5d2896714c56795797c78b0
.exe windows x86

a0a334a462d89f1c72af38409b53f37a

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

b9:06:4d:83:86:ea:e2:6d:c1:c1:99:46:98:ec:30:53:5f:f0:03:2f
Signer

Actual PE Digest

b9:06:4d:83:86:ea:e2:6d:c1:c1:99:46:98:ec:30:53:5f:f0:03:2f

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/09/2010, 11:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetLogicalDrives
GetTempPathA
GetLocaleInfoW
GetTimeFormatW
FileTimeToLocalFileTime
GetLocaleInfoA
GetDiskFreeSpaceW
lstrcmpiA
SetLastError
LoadLibraryW
BeginUpdateResourceA
IsBadCodePtr
lstrcmpi
GetEnvironmentStringsA
SetPriorityClass
SetEvent
EnumCalendarInfoA
IsValidLocale
GetLongPathNameW
GetNamedPipeInfo
GetModuleFileNameA
GetAtomNameA
EnumDateFormatsA
ExitProcess
GetProcAddress
IsBadWritePtr
GetShortPathNameW
SetComputerNameA
WaitForMultipleObjects
lstrcmpiW
LoadLibraryA
GetModuleFileNameW
GetFileAttributesW
OpenSemaphoreW
OpenFile
GetCurrentProcess
lstrcmpA
lstrlenW
GetWindowsDirectoryA
GetFullPathNameA
QueryPerformanceFrequency
SetUnhandledExceptionFilter
GetTickCount
GetCommandLineA
GetVersion
GetVersionExW
GetDateFormatA

user32

CreateDesktopA
MonitorFromPoint
InsertMenuA
IsMenu
GetKeyboardType
SetCursor
MessageBeep
GetIconInfo
DefFrameProcA
SetWindowTextA
GetDesktopWindow
UnregisterClassA
FindWindowW
IsWindow
FindWindowA
IsChild
AppendMenuA
GetMenuItemCount
GetMenuItemID
EnumWindows
CreateCaret
EnumDesktopsW
SetCursorPos
CharPrevW
SetWindowPos
EnableWindow
RegisterWindowMessageA
InvalidateRgn
GetParent
GetActiveWindow
InvalidateRect
GetClassInfoExA
DefWindowProcA
DialogBoxIndirectParamA
DefFrameProcW
CopyImage
FlashWindow
GetMenuStringW
MessageBoxW
CallWindowProcW

gdi32

SetICMProfileA
GetCurrentPositionEx
CreateBrushIndirect
ExcludeClipRect
WidenPath
ScaleViewportExtEx
GetTextFaceA
ColorMatchToTarget
GetObjectType
GetCharWidth32W
DrawEscape
OffsetWindowOrgEx
GetSystemPaletteUse
CreateMetaFileA
GetGlyphIndicesA
SetViewportExtEx
GetCharABCWidthsW
GetNearestColor
RemoveFontResourceW
CreatePen
GetTextExtentExPointW
GetCharacterPlacementW
SetColorSpace

advapi32

RegReplaceKeyA
RegDeleteKeyA

comdlg32

PrintDlgExA

ole32

OleIsRunning

winspool.drv

EnumPortsA
DeletePrinterConnectionA
GetPrintProcessorDirectoryA
DeletePrinterIC
AbortPrinter

Sections

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.mH
Size: 1KB - Virtual size: 33KB

IMAGE_SCN_MEM_READ

.&3Q
Size: 1KB - Virtual size: 40KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.~=+0<+
Size: 1KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.-;l>
Size: 1KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.@]<-
Size: 1KB - Virtual size: 26KB

IMAGE_SCN_MEM_READ

.T
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tN4
Size: 1024B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0a334a462d89f1c72af38409b53f37a

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

b9:06:4d:83:86:ea:e2:6d:c1:c1:99:46:98:ec:30:53:5f:f0:03:2fSigner

Signature Validations

Verification

15/09/2010, 11:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comdlg32

ole32

winspool.drv

Sections

.rdata Size: 3KB - Virtual size: 3KB

.text Size: 13KB - Virtual size: 13KB

.mH Size: 1KB - Virtual size: 33KB

.&3Q Size: 1KB - Virtual size: 40KB

.~=+0<+ Size: 1KB - Virtual size: 27KB

.-;l> Size: 1KB - Virtual size: 15KB

.@]<- Size: 1KB - Virtual size: 26KB

.T Size: 9KB - Virtual size: 9KB

.tN4 Size: 1024B - Virtual size: 13KB

.rsrc Size: 74KB - Virtual size: 74KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

b9:06:4d:83:86:ea:e2:6d:c1:c1:99:46:98:ec:30:53:5f:f0:03:2f
Signer

15/09/2010, 11:34
Valid: false

.rdata
Size: 3KB - Virtual size: 3KB

.text
Size: 13KB - Virtual size: 13KB

.mH
Size: 1KB - Virtual size: 33KB

.&3Q
Size: 1KB - Virtual size: 40KB

.~=+0<+
Size: 1KB - Virtual size: 27KB

.-;l>
Size: 1KB - Virtual size: 15KB

.@]<-
Size: 1KB - Virtual size: 26KB

.T
Size: 9KB - Virtual size: 9KB

.tN4
Size: 1024B - Virtual size: 13KB

.rsrc
Size: 74KB - Virtual size: 74KB