General

Malware Config

Signatures

Files

• fd2d9b3b2366b8b23e0f5f6f562f972aceaa9c3f2b6e7a523e2b072a03422e79

  .exe windows x86

  d96f67d295c3038057d7cf489b339b47

  
  

  Code Sign

  33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  26-07-2012 20:50

  Not After

  26-10-2013 20:50

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:02:8e:42:00:00:00:00:00:1f

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  09-01-2012 22:25

  Not After

  09-04-2013 22:25

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  26:d6:ef:aa:71:0e:aa:e8:be:94:b3:dd:de:fb:1c:bb:00:33:b1:d8

  Signer

  Actual PE Digest

  26:d6:ef:aa:71:0e:aa:e8:be:94:b3:dd:de:fb:1c:bb:00:33:b1:d8

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  01-10-2012 10:19

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvbvm60

  _CIcos

  _adj_fptan

  __vbaVarMove

  __vbaFreeVar

  __vbaStrVarMove

  ord697

  __vbaFreeVarList

  _adj_fdiv_m64

  _adj_fprem1

  ord519

  __vbaStrCat

  __vbaLsetFixstr

  ord660

  __vbaSetSystemError

  __vbaHresultCheckObj

  _adj_fdiv_m32

  __vbaAryDestruct

  __vbaObjSet

  __vbaOnError

  _adj_fdiv_m16i

  __vbaObjSetAddref

  _adj_fdivr_m16i

  __vbaCyStr

  ord523

  _CIsin

  __vbaChkstk

  EVENT_SINK_AddRef

  ord527

  __vbaGenerateBoundsError

  __vbaStrCmp

  __vbaAryConstruct2

  __vbaI2I4

  DllFunctionCall

  ord671

  _adj_fpatan

  __vbaLateIdCallLd

  ord678

  EVENT_SINK_Release

  _CIsqrt

  EVENT_SINK_QueryInterface

  __vbaFpCmpCy

  ord710

  __vbaExceptHandler

  ord711

  __vbaStrToUnicode

  _adj_fprem

  _adj_fdivr_m64

  __vbaFPException

  __vbaVarCat

  __vbaDateVar

  _CIlog

  ord646

  __vbaErrorOverflow

  __vbaNew2

  ord571

  _adj_fdiv_m32i

  _adj_fdivr_m32i

  __vbaStrCopy

  __vbaFreeStrList

  __vbaDerefAry1

  _adj_fdivr_m32

  _adj_fdiv_r

  ord685

  ord100

  __vbaI4Var

  ord610

  __vbaLateMemCall

  __vbaVarDup

  __vbaStrToAnsi

  __vbaFpI4

  _CIatan

  __vbaStrMove

  __vbaR8IntI4

  __vbaI4Cy

  _allmul

  ord544

  _CItan

  ord546

  _CIexp

  __vbaFreeObj

  __vbaFreeStr

  Sections

  .text

  Size: 532KB - Virtual size: 529KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 16KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ