63f64dc1b86fe562b70771ae91d57c0705338971b38c7efa524e41e24d87b96d

Sharing

Copy URL Twitter E-mail

General

Target

63f64dc1b86fe562b70771ae91d57c0705338971b38c7efa524e41e24d87b96d
Size

531KB
MD5

1058cf929b08510bc4f7fd0f010de4a4
SHA1

d825b7a757e4b2714f53b737e506d28a96c0282b
SHA256

63f64dc1b86fe562b70771ae91d57c0705338971b38c7efa524e41e24d87b96d
SHA512

7151514adcdfd7ad2f2944223c096ba35364d71fde03d94a445b45e2bdb716d55eb9e9483a24fd89bff2f28930c49b7fd741f87f37a269c5f664745f2980600b
SSDEEP

6144:c15Fw9Fw11g9VJU3PwKD7B6oz0I6fdyJefiQZHyjd9MOuyF:cxw9E6+3oE7BWI3hGOuyF

Score

N/A

Malware Config

Signatures

Files

63f64dc1b86fe562b70771ae91d57c0705338971b38c7efa524e41e24d87b96d
.exe windows x86

207685d0727b4b07c756f7d943cedcb2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

01/09/2011, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

59:de:55:df:db:5c:44:03:03:23:24:69:8a:e7:ed:9f:24:23:bd:70
Signer

Actual PE Digest

59:de:55:df:db:5c:44:03:03:23:24:69:8a:e7:ed:9f:24:23:bd:70

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

08/04/2011, 02:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shfolder

SHGetFolderPathA
SHGetFolderPathW

shlwapi

SHDeleteValueA
SHDeleteKeyA

setupapi

SetupOpenInfFileW
SetupFindFirstLineW
SetupGetLineTextW
SetupFindNextLine
SetupCloseInfFile

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

psapi

EnumProcesses
GetProcessImageFileNameA

kernel32

SetEndOfFile
WriteConsoleW
GetStringTypeW
GetStringTypeA
GetFileAttributesA
GetVersionExW
GetSystemDefaultLCID
GetUserDefaultUILanguage
FreeResource
LockResource
LoadResource
GetLastError
FindResourceExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetProcessHeap
GetStartupInfoA
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineA
CopyFileA
CreateDirectoryA
DeleteFileA
MoveFileA
ExpandEnvironmentStringsA
CreateFileA
SetFileAttributesA
GetSystemDirectoryA
OpenProcess
Sleep
RemoveDirectoryW
ExitProcess
LoadLibraryA
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
ReadFile
CreateProcessA
GetConsoleMode
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapSize
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
InitializeCriticalSectionAndSpinCount

user32

MessageBoxW

advapi32

RegQueryValueExA
OpenSCManagerW
OpenServiceA
CloseServiceHandle
RegSetValueExA
RegOpenKeyExA
RegOpenKeyW
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoCreateInstance
CoInitialize

Sections

.text
Size: 288KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdat
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

207685d0727b4b07c756f7d943cedcb2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31Certificate

Extended Key Usages

Key Usages

59:de:55:df:db:5c:44:03:03:23:24:69:8a:e7:ed:9f:24:23:bd:70Signer

Signature Validations

Verification

08/04/2011, 02:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shfolder

shlwapi

setupapi

version

psapi

kernel32

user32

advapi32

ole32

Sections

.text Size: 288KB - Virtual size: 292KB

.rdata Size: 17KB - Virtual size: 20KB

.data Size: 16KB - Virtual size: 68KB

.rsrc Size: 134KB - Virtual size: 136KB

.rdat Size: 5KB - Virtual size: 5KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

59:de:55:df:db:5c:44:03:03:23:24:69:8a:e7:ed:9f:24:23:bd:70
Signer

08/04/2011, 02:54
Valid: false

.text
Size: 288KB - Virtual size: 292KB

.rdata
Size: 17KB - Virtual size: 20KB

.data
Size: 16KB - Virtual size: 68KB

.rsrc
Size: 134KB - Virtual size: 136KB

.rdat
Size: 5KB - Virtual size: 5KB