fa16629b7c112c2a22fad27c2d5e5867866fd49e534f4a5161f97467c09698c3

Sharing

Copy URL

Twitter E-mail

General

Target

fa16629b7c112c2a22fad27c2d5e5867866fd49e534f4a5161f97467c09698c3
Size

65KB
MD5

6c12d8b1aa5e44af62efac5a5b25c6da
SHA1

00b614ac1eb075bc529afa56a086e8cdf05939a1
SHA256

fa16629b7c112c2a22fad27c2d5e5867866fd49e534f4a5161f97467c09698c3
SHA512

bac5f7276a3b06949adc1a88502273e6e700639668ff86e4adb6c4abe47fa0a4946729becf900e9724b2d0f7a1d28a5536a8f1dfd41576a232ba87b0a21675e1
SSDEEP

1536:xy9hmU73cXNX2lXKSabMpgoPnD2f1MW05ageC+yi1bW:xQmUuXYWMprC05ZMm

Score

N/A

Malware Config

Signatures

Files

fa16629b7c112c2a22fad27c2d5e5867866fd49e534f4a5161f97467c09698c3
.dll windows x86

fccca3a29bc571e0dc4c98f1af4a146c

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28-01-1999 13:00

Not After

27-01-2017 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18-03-2009 11:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21-12-2009 09:32

Not After

22-12-2020 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:00:00:00:00:01:29:6e:a8:ed:a8
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

25-06-2010 10:05

Not After

26-06-2011 10:05

Subject

CN=Akeo Consulting,OU=libusb.org,O=Akeo Consulting,ST=Co. Donegal,C=IE,1.2.840.113549.1.9.1=#0c117062617461726440676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22-01-2004 10:00

Not After

27-01-2017 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:00

Not After

23-05-2016 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:9e:63:c9:a7:1e:3a:0a:3e:8d:01:b7:a2:1c:72:e2:59:11:f7:20
Signer

Actual PE Digest

76:9e:63:c9:a7:1e:3a:0a:3e:8d:01:b7:a2:1c:72:e2:59:11:f7:20

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Akeo Consulting,OU=libusb.org,O=Akeo Consulting,ST=Co. Donegal,C=IE,1.2.840.113549.1.9.1=#0c117062617461726440676d61696c2e636f6d

02-10-2010 16:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memmove
_stricmp
realloc
_iob
fprintf
mbstowcs
_getch
_beginthread
_endthread
wcstombs
sscanf
_strlwr
strncmp
_wcsnicmp
_wcsicmp
printf
fopen
fgetws
wcsstr
fclose
fputws
fgets
fputs
_strdup
sprintf
_vsnprintf
strncpy
strerror
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
getenv
atoi
strstr
_snprintf
memcpy
memset
malloc
free

setupapi

SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
SetupDiSetClassInstallParamsA
SetupDiCallClassInstaller
SetupDiOpenDevRegKey
SetupOpenInfFileA
SetupDiGetDeviceRegistryPropertyA
SetupDiRemoveDevice
CM_Get_DevNode_Status
SetupDiSetDeviceRegistryPropertyA
SetupFindNextLine
SetupCloseInfFile
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupGetStringFieldA
SetupFindFirstLineA
SetupDiGetDeviceInstallParamsA

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
InterlockedExchange
GetVersion
InterlockedIncrement
LocalFree
GetFullPathNameA
GetStdHandle
FindResourceA
SizeofResource
LoadResource
LockResource
WriteConsoleA
GetModuleHandleA
GetCurrentProcess
SetEnvironmentVariableA
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
CreateSemaphoreA
GetVersionExA
OutputDebugStringA
FormatMessageA
WaitForSingleObject
CreateFileA
GetOverlappedResult
CloseHandle
ResetEvent
DeviceIoControl
GetLastError
CreateEventA

advapi32

RegEnumKeyExA
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
FreeSid

user32

DrawEdge
SetTimer
GetParent
DestroyWindow
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
RegisterClassExA
LoadCursorA
LoadIconA
GetClassInfoExA
FillRect
GetSysColorBrush
EnableWindow
SetWindowTextA
GetWindowLongA
SetWindowLongA
RedrawWindow
InvalidateRect
DefWindowProcA
PostMessageA
CreateWindowExA
GetSysColor
GetSystemMetrics
GetClientRect
OffsetRect
InflateRect
GetDlgItem
GetWindowTextLengthA
SendMessageA
GetDesktopWindow
GetWindowRect
SetWindowPos
MessageBoxA

gdi32

BitBlt
CreateSolidBrush
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC

Exports

Exports

usb_bulk_read
usb_bulk_setup_async
usb_bulk_write
usb_cancel_async
usb_claim_interface
usb_clear_halt
usb_close
usb_control_msg
usb_device
usb_find_busses
usb_find_devices
usb_free_async
usb_get_busses
usb_get_descriptor
usb_get_descriptor_by_endpoint
usb_get_string
usb_get_string_simple
usb_get_version
usb_init
usb_install_driver_np
usb_install_driver_np_rundll
usb_install_needs_restart_np
usb_install_npA
usb_install_npW
usb_install_np_rundll
usb_install_service_np
usb_install_service_np_rundll
usb_interrupt_read
usb_interrupt_setup_async
usb_interrupt_write
usb_isochronous_setup_async
usb_open
usb_reap_async
usb_reap_async_nocancel
usb_release_interface
usb_reset
usb_resetep
usb_set_altinterface
usb_set_configuration
usb_set_debug
usb_strerror
usb_submit_async
usb_touch_inf_file_np
usb_touch_inf_file_np_rundll
usb_uninstall_service_np
usb_uninstall_service_np_rundll

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fccca3a29bc571e0dc4c98f1af4a146c

Code Sign

04:00:00:00:00:01:23:9e:0f:ac:b3Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:29:6e:a8:ed:a8Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:23:9e:0f:af:24Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

76:9e:63:c9:a7:1e:3a:0a:3e:8d:01:b7:a2:1c:72:e2:59:11:f7:20Signer

Signature Validations

Verification

02-10-2010 16:09 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

setupapi

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 4KB - Virtual size: 3KB

04:00:00:00:00:01:23:9e:0f:ac:b3
Certificate

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

01:00:00:00:00:01:29:6e:a8:ed:a8
Certificate

04:00:00:00:00:01:23:9e:0f:af:24
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

76:9e:63:c9:a7:1e:3a:0a:3e:8d:01:b7:a2:1c:72:e2:59:11:f7:20
Signer

02-10-2010 16:09
Valid: false

.text
Size: 50KB - Virtual size: 49KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 4KB - Virtual size: 3KB