1a85d2d6e64b8a02d12e5e27c7a0ffea11f5d1435516ca2c6f9565e9ff75b97c

Sharing

Copy URL Twitter E-mail

General

Target

1a85d2d6e64b8a02d12e5e27c7a0ffea11f5d1435516ca2c6f9565e9ff75b97c
Size

1.4MB
MD5

1d734bf5887577f375585a6795c3bca4
SHA1

1b5a72e9e61b8d3942acf0c474685cd8cfea495f
SHA256

1a85d2d6e64b8a02d12e5e27c7a0ffea11f5d1435516ca2c6f9565e9ff75b97c
SHA512

d0eabfbe74735d4e6305ff1393976a27087724361b0598762cca25bc62700be6b03a685eed2b857e2e89337ed6b2a5b56e3de1e6946e6eb83ddebee0f6775235
SSDEEP

24576:FntRinTSMAR1+zGSJvrrgcoIieqy8f/B9F+68DmImzMdq6PCKTB2:87B/yITZ8nPMhLmzMdq6PbTB

Score

N/A

Malware Config

Signatures

Files

1a85d2d6e64b8a02d12e5e27c7a0ffea11f5d1435516ca2c6f9565e9ff75b97c
.exe windows x86

341ce03f7d388e7055fe5f1972459e45

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:24:da:79:a3:f3
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

09/11/2009, 18:54

Not After

09/11/2012, 18:54

Subject

CN=TrueCrypt Foundation,O=TrueCrypt Foundation,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c15636f6e74616374407472756563727970742e6f7267

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0b:7f:6b:00:00:00:00:00:19
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:00

Not After

23/05/2016, 17:10

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:f7:93:83:cc:68:0f:de:bc:92:d8:94:74:86:5d:a0:e3:fe:8e:29
Signer

Actual PE Digest

9c:f7:93:83:cc:68:0f:de:bc:92:d8:94:74:86:5d:a0:e3:fe:8e:29

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=TrueCrypt Foundation,O=TrueCrypt Foundation,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c15636f6e74616374407472756563727970742e6f7267

01/09/2011, 15:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Create
ImageList_Add

setupapi

SetupDiOpenClassRegKey
SetupOpenInfFileA
SetupInstallFromInfSectionA
SetupCloseInfFile

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GetVolumeNameForVolumeMountPointA
SystemTimeToFileTime
GetSystemTime
VirtualLock
CopyFileA
GetTempPathA
GetDriveTypeA
GetShortPathNameA
GetVolumeInformationA
GetVolumePathNameA
FindNextVolumeW
QueryDosDeviceW
FindFirstVolumeW
WriteFile
LocalFree
VirtualUnlock
DefineDosDeviceA
GetCurrentProcessId
FormatMessageW
VirtualQuery
ReleaseMutex
OpenMutexA
GetVolumeInformationW
QueryPerformanceCounter
QueryPerformanceFrequency
FlushFileBuffers
GetFileSize
GetCurrentProcess
GetModuleHandleA
GetVersionExA
GetCurrentDirectoryA
LockResource
SizeofResource
LoadResource
FindResourceA
GetFileAttributesA
SetFilePointer
GetModuleFileNameW
SetCurrentDirectoryA
GetDiskFreeSpaceA
UnhandledExceptionFilter
GetFileInformationByHandle
GetCurrentThread
SetUnhandledExceptionFilter
SetErrorMode
InterlockedExchangeAdd
InterlockedExchange
SetEvent
ResetEvent
CreateEventA
GetFileAttributesExA
FindNextFileW
CreateFileW
FindFirstFileW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteVolumeMountPointA
GetProcessWorkingSetSize
GetProcessTimes
GetThreadTimes
GlobalMemoryStatus
GetProcessHeap
InitializeCriticalSection
GetStringTypeA
GetLocaleInfoA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
PeekNamedPipe
GetFullPathNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
InitializeCriticalSectionAndSpinCount
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateThread
ResumeThread
ExitThread
GetFileType
SetStdHandle
GetSystemTimeAsFileTime
GetFileAttributesW
GetConsoleMode
GetConsoleCP
HeapAlloc
ExitProcess
GetModuleHandleW
HeapFree
RtlUnwind
RaiseException
IsDebuggerPresent
TerminateProcess
InterlockedCompareExchange
SetVolumeMountPointA
GetWindowsDirectoryA
WaitForSingleObject
GetExitCodeProcess
CreatePipe
SetHandleInformation
GetSystemInfo
FindFirstFileA
LoadLibraryA
GetProcAddress
FreeLibrary
FindNextFileA
FindClose
SetFilePointerEx
CreateFileA
GetFileSizeEx
GetFileTime
SetEnvironmentVariableA
ReadFile
SetFileTime
SetLastError
GetLogicalDrives
MoveFileA
GetCommandLineA
GetCommandLineW
GetTickCount
CreateMutexA
Sleep
GetSystemDirectoryA
CreateDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
SetProcessShutdownParameters
GetCurrentThreadId
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
GetLastError
InterlockedDecrement
DeviceIoControl
FindFirstVolumeA
QueryDosDeviceA
FindNextVolumeA
FindVolumeClose
DeleteFileA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetEndOfFile
GetTimeZoneInformation
CompareStringA
CompareStringW
GetStartupInfoA

user32

GetKeyState
EnumChildWindows
GetDlgCtrlID
GetClassNameA
LoadCursorA
SetCursor
DefDlgProcA
UnregisterClassA
LoadIconA
RegisterClassA
GetUpdateRect
BeginPaint
DefWindowProcA
GetDialogBaseUnits
EndPaint
PeekMessageA
DestroyWindow
GetWindowTextW
GetSystemMetrics
GetWindowInfo
ReleaseDC
MessageBoxA
GetActiveWindow
GetMessagePos
EnumWindows
RegisterWindowMessageA
IsWindowEnabled
SystemParametersInfoA
DrawMenuBar
PostMessageA
GetCursorPos
MessageBeep
SetMenuItemInfoW
GetSubMenu
LoadBitmapA
FlashWindowEx
GetDlgItemInt
SetLayeredWindowAttributes
CreateWindowExA
RegisterClassExA
TrackMouseEvent
GetSystemMenu
SystemParametersInfoW
SendMessageTimeoutA
wsprintfA
DrawTextA
GetClassInfoA
UnhookWindowsHookEx
CallNextHookEx
GetCaretPos
GetMessageTime
GetQueueStatus
GetProcessWindowStation
GetOpenClipboardWindow
SetWindowsHookExA
GetCapture
GetClipboardOwner
EnableWindow
GetDlgItem
CheckDlgButton
GetClipboardViewer
GetDesktopWindow
GetFocus
GetInputState
MoveWindow
CreatePopupMenu
TrackPopupMenu
DestroyMenu
SetDlgItemInt
GetMenu
EnableMenuItem
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetWindowRect
SetForegroundWindow
LoadImageA
DestroyIcon
GetDlgItemTextA
SetDlgItemTextA
SendDlgItemMessageA
SetFocus
SendDlgItemMessageW
GetKeyboardLayout
LoadKeyboardLayoutA
MessageBoxW
GetWindowTextA
SetWindowTextA
GetWindowTextLengthA
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
GetParent
SetTimer
GetWindowTextLengthW
KillTimer
GetAsyncKeyState
RegisterHotKey
UnregisterHotKey
wsprintfW
DialogBoxParamW
ShowWindow
SetWindowTextW
GetClientRect
SetWindowPos
InvalidateRect
SendMessageW
EndDialog
SendMessageA
DeleteMenu
AppendMenuA
AppendMenuW
GetDlgItemTextW
IsDlgButtonChecked
SetDlgItemTextW
GetDC

gdi32

MoveToEx
LineTo
GetCurrentObject
GetObjectA
CreateCompatibleBitmap
SetStretchBltMode
CreatePen
DeleteDC
BitBlt
CreateCompatibleDC
SetMapMode
GetDeviceCaps
SelectObject
GetTextExtentPoint32W
GetTextMetricsA
GetStockObject
CreateFontIndirectW
StretchBlt
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegisterEventSourceA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumKeyExA
GetTokenInformation
IsWellKnownSid
QueryServiceStatus
ControlService
StartServiceA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ChangeServiceConfigA
OpenSCManagerA
CreateServiceA
ChangeServiceConfig2A
OpenServiceA
DeleteService
RegCloseKey
SetServiceStatus
DeregisterEventSource
ReportEventA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle

shell32

ShellExecuteW
SHGetFileInfoA
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListA
CommandLineToArgvW
SHGetSpecialFolderPathA
ShellExecuteA
SHChangeNotify
SHGetFolderPathA
DragAcceptFiles
DragQueryFileA
DragFinish
Shell_NotifyIconA
Shell_NotifyIconW
ord680

ole32

CoCreateInstance
CoGetObject
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
SysFreeString

Sections

.text
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 737KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

341ce03f7d388e7055fe5f1972459e45

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:08:d9:61:1c:d6Certificate

Key Usages

04:00:00:00:00:01:08:d9:61:24:48Certificate

Key Usages

01:00:00:00:00:01:24:da:79:a3:f3Certificate

Extended Key Usages

Key Usages

61:0b:7f:6b:00:00:00:00:00:19Certificate

Key Usages

9c:f7:93:83:cc:68:0f:de:bc:92:d8:94:74:86:5d:a0:e3:fe:8e:29Signer

Signature Validations

Verification

01/09/2011, 15:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

setupapi

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 576KB - Virtual size: 576KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 19KB - Virtual size: 210KB

.rsrc Size: 737KB - Virtual size: 737KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

01:00:00:00:00:01:24:da:79:a3:f3
Certificate

61:0b:7f:6b:00:00:00:00:00:19
Certificate

9c:f7:93:83:cc:68:0f:de:bc:92:d8:94:74:86:5d:a0:e3:fe:8e:29
Signer

01/09/2011, 15:29
Valid: false

.text
Size: 576KB - Virtual size: 576KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 19KB - Virtual size: 210KB

.rsrc
Size: 737KB - Virtual size: 737KB