33a012d73bc9ebff29ff488058a7e6d9a94e88c4c028094d1efcbec7d94875e9

Sharing

Copy URL Twitter E-mail

General

Target

33a012d73bc9ebff29ff488058a7e6d9a94e88c4c028094d1efcbec7d94875e9
Size

16.1MB
MD5

63f8c13f269b10bc9363b007daaacae6
SHA1

ed4abd417c9847395fd2c6218361d0ae7a52e63b
SHA256

33a012d73bc9ebff29ff488058a7e6d9a94e88c4c028094d1efcbec7d94875e9
SHA512

b0b11260722e998446851a9c2339dd6c9c48b8e6b9bb6ab980e4cafc32c5495ffb2a54be00832872701e86e968219178b4edfd920dc09e814d7c985858351edf
SSDEEP

393216:XpLKmMSqUNuimtPeEnSi5S+ceSlgk0ASKu/Bxx:XpLKmIUNutN0+c/8AjupX

Score

N/A

Malware Config

Signatures

Files

33a012d73bc9ebff29ff488058a7e6d9a94e88c4c028094d1efcbec7d94875e9
.dll regsvr32 windows x86

a37b9d88b764d22279be2b0dec6eaedc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:ed:67:42:55:61:4b:f4:ed:3e:d4:23:cc:93:ca:7d
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b
Signer

Actual PE Digest

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

24/09/2014, 21:27
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

winmm

mixerClose
waveInMessage
waveOutMessage
waveOutGetDevCapsA
waveInGetDevCapsA
mixerGetID
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetNumDevs
waveInGetNumDevs
waveInStart
mixerGetControlDetailsA
waveInStop
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
waveInOpen
timeSetEvent
timeKillEvent
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
waveOutOpen
waveOutGetPosition
timeGetTime
waveOutRestart
waveOutPause
waveInGetPosition
waveInAddBuffer
mixerSetControlDetails

wininet

HttpSendRequestA
InternetReadFile
InternetCloseHandle
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA
HttpQueryInfoA

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCompareCertificateName
CryptFindOIDInfo
CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CertVerifyTimeValidity
CertVerifyRevocation
CertOpenStore
CertAddStoreToCollection
CryptVerifyMessageSignature
CryptGetMessageCertificates
CertCreateCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CertCompareCertificate

rpcrt4

RpcStringFreeA
UuidToStringA

oleaut32

VariantClear
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
SysStringLen
SysFreeString
VariantInit

urlmon

CopyStgMedium

dsound

ord8
ord1

dinput8

DirectInput8Create

kernel32

GetSystemInfo
GetUserDefaultUILanguage
MoveFileExW
VirtualQuery
GetUserDefaultLangID
GetVersionExA
SetFilePointer
VerifyVersionInfoW
VerSetConditionMask
CreateThread
ReadFile
GetFileSize
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
DeviceIoControl
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
GetLongPathNameW
GetTempPathA
GetFileAttributesA
CreateMutexA
SetFilePointerEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
OutputDebugStringA
TlsSetValue
ReleaseMutex
CreateFileMappingA
GetExitCodeThread
DuplicateHandle
TerminateThread
CreateWaitableTimerW
SetThreadPriority
GetSystemDirectoryA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
SwitchToThread
HeapReAlloc
GetCommandLineA
RtlUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcessAffinityMask
HeapSize
HeapFree
GetProcessHeap
HeapAlloc
EnumSystemLocalesW
IsValidLocale
GetUserDefaultLCID
GetTimeFormatW
GetDateFormatW
CompareStringW
GetCurrencyFormatW
GetNumberFormatW
VirtualProtect
SetSystemTime
DebugBreak
CreateSemaphoreA
VirtualFree
VirtualAlloc
GetVersion
CancelWaitableTimer
GlobalAlloc
CreateWaitableTimerA
CreateEventA
FlushFileBuffers
SetEndOfFile
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetNativeSystemInfo
RegisterWaitForSingleObject
UnregisterWaitEx
GlobalMemoryStatusEx
IsDebuggerPresent
FileTimeToSystemTime
TlsAlloc
TlsFree
GetSystemTimeAsFileTime
GetStdHandle
ResumeThread
GetModuleHandleExA
OpenProcess
CreateToolhelp32Snapshot
Thread32First
GetThreadTimes
Thread32Next
InitializeCriticalSectionAndSpinCount
FormatMessageA
CreateProcessW
CreateFileMappingW
CreateMutexW
GetNamedPipeInfo
CreateNamedPipeW
CancelIo
ConnectNamedPipe
InterlockedExchangeAdd
ExitProcess
TerminateProcess
GetConsoleMode
LCMapStringA
SetConsoleCtrlHandler
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetWaitableTimer
GlobalSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
CompareStringA
SetEnvironmentVariableA
LocalAlloc
lstrcpynW
GlobalMemoryStatus
FlushConsoleInputBuffer
lstrlenA
ReadConsoleInputA
SetConsoleMode
TlsGetValue
InitializeCriticalSection
GlobalLock
GlobalUnlock
UnmapViewOfFile
MapViewOfFile
GetProcessTimes
GlobalFree
GetEnvironmentVariableA
CreateDirectoryA
GetCurrentDirectoryA
GetTempFileNameA
CreateFileA
WriteFile
DeleteFileA
GetCurrentProcessId
GetModuleHandleA
CreateProcessA
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetFileSizeEx
GetSystemTime
SystemTimeToFileTime
FindFirstFileW
RemoveDirectoryW
DeleteFileW
FindNextFileW
FindClose
GetModuleFileNameA
FindResourceA
SizeofResource
LoadResource
LockResource
OpenFile
_lwrite
_lclose
FreeResource
GetModuleFileNameW
lstrlenW
SetLastError
GetCurrentProcess
FlushInstructionCache
RaiseException
LCMapStringW
GetTickCount
GetCurrentThreadId
GetLocaleInfoW
TryEnterCriticalSection
LoadLibraryW
GetVersionExW
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
GetLastError
FreeLibrary
WaitForSingleObject
ResetEvent
CloseHandle
CreateEventW
SetEvent
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
ExpandEnvironmentStringsW
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetConsoleCP

user32

GetMonitorInfoA
MonitorFromRect
EnumDisplayMonitors
RegisterWindowMessageA
PostMessageA
SetWindowLongA
GetWindowLongA
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassExA
UnregisterClassW
CallMsgFilterW
MsgWaitForMultipleObjectsEx
WaitMessage
MsgWaitForMultipleObjects
GetClassNameA
CallNextHookEx
GetUpdateRect
ValidateRect
RemovePropW
SetWindowsHookExW
GetUserObjectInformationW
SetActiveWindow
SetParent
UpdateWindow
GetAncestor
IsIconic
ShowWindowAsync
MapWindowPoints
GetWindowTextW
GetWindowPlacement
IsZoomed
GetSystemMenu
FlashWindowEx
GetActiveWindow
MoveWindow
SetCaretPos
CreateCaret
ShowCaret
DestroyCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
GetProcessWindowStation
wsprintfW
GetDesktopWindow
MonitorFromWindow
EnumDisplaySettingsW
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
GetForegroundWindow
SetRect
EnumDisplayDevicesA
CreatePopupMenu
TrackPopupMenu
DestroyMenu
DrawMenuBar
GetMenuInfo
CreateMenu
SetMenuInfo
MapVirtualKeyW
CharUpperW
CharLowerW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CloseWindow
OffsetRect
CreateWindowExW
ShowWindow
SetWindowPlacement
GetWindow
GetWindowTextLengthW
DestroyWindow
GetDoubleClickTime
DeleteMenu
UnhookWindowsHookEx
WaitForInputIdle
MessageBoxA
DialogBoxParamW
SetWindowTextA
RedrawWindow
DialogBoxIndirectParamW
SetWindowTextW
SendMessageTimeoutW
CreateIconIndirect
GetMonitorInfoW
SetRectEmpty
GetCursor
DestroyIcon
LoadImageW
GetPropW
SetPropW
PtInRect
InflateRect
GetClipboardFormatNameA
RegisterClipboardFormatA
SetWindowPos
RegisterClassA
CreateWindowExA
SetCapture
ReleaseCapture
SetCursorPos
GetSubMenu
GetCapture
SystemParametersInfoW
ScreenToClient
GetMessageTime
GetCursorPos
WindowFromPoint
LoadIconW
RegisterClassW
PeekMessageW
GetQueueStatus
KillTimer
SetTimer
IsWindowVisible
PostMessageW
GetFocus
GetParent
GetWindowThreadProcessId
AttachThreadInput
GetDlgItem
IsWindow
EnableWindow
SendMessageW
InvalidateRect
GetKeyState
ReleaseDC
LoadStringW
MessageBoxW
SetCursor
EnableMenuItem
CheckMenuItem
FillRect
GetDC
BeginPaint
GetClientRect
EndPaint
GetSystemMetrics
EndDialog
UnregisterClassA
SetFocus
GetWindowInfo
CopyRect
RegisterClassExW
CallWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
DefWindowProcW
ClientToScreen
SendInput
ActivateKeyboardLayout
GetKeyboardLayout
GetWindowLongW
GetWindowRect
UpdateLayeredWindow

gdi32

EnumFontFamiliesExW
CreateDCW
GetFontData
RestoreDC
SaveDC
SelectClipPath
PolyBezierTo
SetPolyFillMode
EndPath
BeginPath
EndPage
StartPage
FillPath
ExtCreatePen
StrokePath
EndDoc
StartDocW
CreatePalette
GetWorldTransform
SetGraphicsMode
SetWorldTransform
GetTextCharacterExtra
DPtoLP
EnumFontFamiliesA
GetCurrentObject
CreatePen
MoveToEx
LineTo
SetTextCharacterExtra
GetBkColor
SelectClipRgn
GetTextColor
GetBkMode
GetTextAlign
SetBkMode
SetTextAlign
CreateRectRgn
GetClipRgn
IntersectClipRect
CreateFontIndirectA
SetTextColor
GetTextMetricsW
GetTextExtentPoint32W
ExtTextOutA
GetTextExtentPoint32A
CreateFontIndirectW
CreateBitmap
SetPixel
CreateDCA
GetICMProfileA
SelectPalette
RealizePalette
RectVisible
LPtoDP
StretchDIBits
GetStockObject
Rectangle
GetDeviceCaps
GetSystemPaletteEntries
GetClipBox
CreateSolidBrush
EnumFontFamiliesW
GetStretchBltMode
CreateCompatibleBitmap
SetStretchBltMode
SetBkColor
ExtTextOutW
BitBlt
StretchBlt
GdiAlphaBlend
CreateDIBSection
GetObjectW
SelectObject
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PrintDlgW

advapi32

CryptDecrypt
CryptSetKeyParam
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
RegisterEventSourceA
ReportEventA
DeregisterEventSource
IsValidSid
CryptImportKey
CryptGenKey
CryptDestroyKey
CryptExportKey
CryptEncrypt
RegOpenKeyA
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteValueA
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
RegQueryValueExW

shell32

SHGetFolderPathW
SHGetFolderPathA
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
SHGetFolderLocation
SHGetSettings
ord165
ShellExecuteW
SHGetDiskFreeSpaceExW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

OleGetClipboard
OleInitialize
CoUninitialize
CoSetProxyBlanket
CoInitializeEx
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
PropVariantClear
CoFreeUnusedLibraries
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
OleUninitialize
ReleaseStgMedium
CreateBindCtx
MkParseDisplayName
CoInitialize

ws2_32

WSAAsyncSelect
closesocket
WSACleanup
WSAStartup
WSASocketA
ntohl
select
gethostname
connect
WSAGetLastError
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
setsockopt
recv
send
ntohs
getsockname
WSAIoctl
socket
ioctlsocket
WSASocketW
htons
WSACloseEvent
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
inet_addr

shlwapi

StrStrIW
StrRStrIW
UrlCanonicalizeW
AssocQueryStringW
PathRemoveFileSpecA

mscms

OpenColorProfileW
CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform

iphlpapi

GetAdaptersAddresses

winspool.drv

GetPrinterW
ClosePrinter
OpenPrinterW

Exports

Exports

AdobeCPGetAPI
BrokerMainW
DllRegisterServer
DllUnregisterServer
FlashPlayer_15_0_0_189_FlashPlayer
Flash_DisableLocalSecurity
Flash_EnforceLocalSecurity
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
Java_ShockwaveFlash_CurrentFrame_stub
Java_ShockwaveFlash_FlashVersion_stub
Java_ShockwaveFlash_FrameLoaded_stub
Java_ShockwaveFlash_GetVariable_stub
Java_ShockwaveFlash_GotoFrame_stub
Java_ShockwaveFlash_IsPlaying_stub
Java_ShockwaveFlash_LoadMovie_stub
Java_ShockwaveFlash_Pan_stub
Java_ShockwaveFlash_PercentLoaded_stub
Java_ShockwaveFlash_Play_stub
Java_ShockwaveFlash_SetVariable_stub
Java_ShockwaveFlash_SetZoomRect_stub
Java_ShockwaveFlash_StopPlay_stub
Java_ShockwaveFlash_TCallFrame_stub
Java_ShockwaveFlash_TCallLabel_stub
Java_ShockwaveFlash_TCurrentFrame_stub
Java_ShockwaveFlash_TCurrentLabel_stub
Java_ShockwaveFlash_TGetProperty_stub
Java_ShockwaveFlash_TGotoFrame_stub
Java_ShockwaveFlash_TGotoLabel_stub
Java_ShockwaveFlash_TPlay_stub
Java_ShockwaveFlash_TSetProperty_stub
Java_ShockwaveFlash_TStopPlay_stub
Java_ShockwaveFlash_TotalFrames_stub
Java_ShockwaveFlash_Zoom_stub
NP_Acrobat_GetEntryPoints
NP_Acrobat_Initialize
NP_GetEntryPoints
NP_Initialize
NP_SetBrokerClient
NP_SetNPAPIHostProxy
NP_Shutdown
native_ShockwaveFlash_CurrentFrame
native_ShockwaveFlash_FlashVersion
native_ShockwaveFlash_FrameLoaded
native_ShockwaveFlash_GetVariable
native_ShockwaveFlash_GotoFrame
native_ShockwaveFlash_IsPlaying
native_ShockwaveFlash_LoadMovie
native_ShockwaveFlash_Pan
native_ShockwaveFlash_PercentLoaded
native_ShockwaveFlash_Play
native_ShockwaveFlash_SetVariable
native_ShockwaveFlash_SetZoomRect
native_ShockwaveFlash_StopPlay
native_ShockwaveFlash_TCallFrame
native_ShockwaveFlash_TCallLabel
native_ShockwaveFlash_TCurrentFrame
native_ShockwaveFlash_TCurrentLabel
native_ShockwaveFlash_TGetProperty
native_ShockwaveFlash_TGotoFrame
native_ShockwaveFlash_TGotoLabel
native_ShockwaveFlash_TPlay
native_ShockwaveFlash_TSetProperty
native_ShockwaveFlash_TStopPlay
native_ShockwaveFlash_TotalFrames
native_ShockwaveFlash_Zoom
register_ShockwaveFlash
unregister_ShockwaveFlash
unuse_ShockwaveFlash
unuse_netscape_plugin_Plugin
use_ShockwaveFlash
use_netscape_plugin_Plugin

Sections

.text
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 801KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 586KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a37b9d88b764d22279be2b0dec6eaedc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

50:ed:67:42:55:61:4b:f4:ed:3e:d4:23:cc:93:ca:7dCertificate

Extended Key Usages

Key Usages

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0bSigner

Signature Validations

Verification

24/09/2014, 21:27 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

winmm

wininet

crypt32

rpcrt4

oleaut32

urlmon

dsound

dinput8

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

ws2_32

shlwapi

mscms

iphlpapi

winspool.drv

Exports

Exports

Sections

.text Size: 11.4MB - Virtual size: 11.4MB

.rodata Size: 4KB - Virtual size: 4KB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 801KB - Virtual size: 1.7MB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 108KB - Virtual size: 107KB

.reloc Size: 586KB - Virtual size: 585KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

50:ed:67:42:55:61:4b:f4:ed:3e:d4:23:cc:93:ca:7d
Certificate

1f:7d:ff:66:ce:ab:15:8c:9e:42:e0:f9:de:5d:db:7a:b3:4d:93:0b
Signer

24/09/2014, 21:27
Valid: false

.text
Size: 11.4MB - Virtual size: 11.4MB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 801KB - Virtual size: 1.7MB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 108KB - Virtual size: 107KB

.reloc
Size: 586KB - Virtual size: 585KB