dcb67b98f7f5b9f5870a3a17531b40bd310f2629c11106a93daa726f24c44914

Sharing

Copy URL Twitter E-mail

General

Target

dcb67b98f7f5b9f5870a3a17531b40bd310f2629c11106a93daa726f24c44914
Size

1.4MB
MD5

7a774cb88a89708994d50fe6a8c5ff49
SHA1

4e7d6a666f2476c9c39d077eb6a0991419eea925
SHA256

dcb67b98f7f5b9f5870a3a17531b40bd310f2629c11106a93daa726f24c44914
SHA512

a0118922af86f1512d2cdc43bd120fc86711bb9f1dffd262ae33f904103cf22c1d00c4d0bc751a7ac4a9068344f423f0b97b97d7d0f74a170abd8499871c8045
SSDEEP

24576:/mbv2Z6pwCck1ociYmShx39UyqygmfCJrIIKemv1glGKQ:6dHZhmSHM/1KesglGB

Score

N/A

Malware Config

Signatures

Files

dcb67b98f7f5b9f5870a3a17531b40bd310f2629c11106a93daa726f24c44914
.dll windows x86

474310626c8a3520f4647899982144dc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:a7:23:c5:b3:ea:71:a9:09:23:ea:0e:5f:22:09:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/04/2011, 00:00

Not After

14/04/2012, 23:59

Subject

CN=Suzhou Shijie Software Co.\, LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Suzhou Shijie Software Co.\, LTD,L=SuZhou,ST=JiangSu,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:c3:27:bb:ea:1b:0a:6b:7b:8e:b4:fa:05:30:8a:3b:cb:06:bd:bc
Signer

Actual PE Digest

52:c3:27:bb:ea:1b:0a:6b:7b:8e:b4:fa:05:30:8a:3b:cb:06:bd:bc

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Suzhou Shijie Software Co.\, LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Suzhou Shijie Software Co.\, LTD,L=SuZhou,ST=JiangSu,C=CN

11/11/2011, 02:15
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
WaitForMultipleObjects
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleW
GetLastError
CloseHandle
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
LocalFileTimeToFileTime
lstrlenW
FileTimeToLocalFileTime
CompareFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetTempPathW
GetTempFileNameW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
GetSystemInfo
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
GetFileAttributesW
lstrcatW
lstrcpyW
GetEnvironmentVariableW
Sleep
lstrcpyA
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiW
lstrcpynW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
RtlUnwind
RaiseException
ExitThread
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoA
GetConsoleCP
GetConsoleMode

user32

wsprintfW
CharPrevExA
CharNextA
CharUpperW
CharLowerW

oleaut32

SysAllocString
VariantClear
VariantCopy
SysFreeString
SysAllocStringByteLen

shlwapi

StrRStrIW
PathAddBackslashW

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

474310626c8a3520f4647899982144dc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

50:a7:23:c5:b3:ea:71:a9:09:23:ea:0e:5f:22:09:fbCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

52:c3:27:bb:ea:1b:0a:6b:7b:8e:b4:fa:05:30:8a:3b:cb:06:bd:bcSigner

Signature Validations

Verification

11/11/2011, 02:15 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 153KB - Virtual size: 153KB

.data Size: 35KB - Virtual size: 65KB

.rsrc Size: 1024B - Virtual size: 1012B

.reloc Size: 61KB - Virtual size: 60KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

50:a7:23:c5:b3:ea:71:a9:09:23:ea:0e:5f:22:09:fb
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

52:c3:27:bb:ea:1b:0a:6b:7b:8e:b4:fa:05:30:8a:3b:cb:06:bd:bc
Signer

11/11/2011, 02:15
Valid: false

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 153KB - Virtual size: 153KB

.data
Size: 35KB - Virtual size: 65KB

.rsrc
Size: 1024B - Virtual size: 1012B

.reloc
Size: 61KB - Virtual size: 60KB