dc73283ba199c6fe3753b2b1d1a505a7860035b54a2fa3bf63de4623b488c4c4

Sharing

Copy URL

Twitter E-mail

General

Target

dc73283ba199c6fe3753b2b1d1a505a7860035b54a2fa3bf63de4623b488c4c4
Size

15.6MB
MD5

bf1a37442952dfe46543fad356d14676
SHA1

1410c92ad23f4428a1d8a31b07737421f5f5284f
SHA256

dc73283ba199c6fe3753b2b1d1a505a7860035b54a2fa3bf63de4623b488c4c4
SHA512

3333810ecb4f8dc9ffaa177011dad8d26921739608b530ad7ac9dcb888f2288166a11b3340ea57ccbe14129f24975670da2e5008ae749d98a14fe3c6db465760
SSDEEP

393216:thUDihZFhrGegmWgohKMLcINjFZMy0zOkyEo7eO5G0LLJuRy:PUD4ZiZDN/izoEjsG0L

Score

N/A

Malware Config

Signatures

Files

dc73283ba199c6fe3753b2b1d1a505a7860035b54a2fa3bf63de4623b488c4c4
.zip
Configuration/XManConfig.xml
.xml
Data/MetroFramework.Design.dll
Data/MetroFramework.Fonts.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rdata
Size: 524B - Virtual size: 523B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

data
Size: 82B - Virtual size: 125B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

pdata
Size: 100B - Virtual size: 98B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

CONST
Size: 2B - Virtual size:

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ext
Size: 52B - Virtual size: 50B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ata
Size: 130B - Virtual size: 129B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rsrc
Size: 4B - Virtual size: 3B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

reloc
Size: 22B - Virtual size: 20B
Data/MetroFramework.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 354KB - Virtual size: 527KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Installer.exe
.exe windows x86

e569e6f445d32ba23766ad67d1e3787f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale

comctl32

InitCommonControls

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

user32

CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW

oleaut32

SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate

netapi32

NetWkstaGetInfo
NetApiBufferFree

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 718KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 27KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Microsoft.VC80.CRT.manifest
Microsoft.VC90.CRT.manifest
cgGL.dll
.dll windows x86

71818d7b499d544b2967a8d17e5ba33e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

01/09/2011, 23:59

Subject

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cf:6c:9d:71:24:bc:4a:6f:d2:ca:a7:05:53:ad:97:fe:39:db:c9:4d
Signer

Actual PE Digest

cf:6c:9d:71:24:bc:4a:6f:d2:ca:a7:05:53:ad:97:fe:39:db:c9:4d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

22/07/2010, 21:10
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cg

cgGetFirstDependentParameter
cgSetMatrixParameterdc
cgSetMatrixParameterdr
cgGetMatrixParameterfc
cgGetMatrixParameterdc
cgGetMatrixParameterfr
cgGetMatrixParameterdr
cgSetMatrixParameterfc
cgSetMatrixParameterfr
cgGetParameterValuedr
cgGetParameterValuefr
cgSetParameter4dv
cgSetParameter3dv
cgSetParameter2dv
cgSetParameter1dv
cgSetParameter4d
cgSetParameter3d
cgSetParameter2d
cgSetParameter1d
cgSetParameter4fv
cgSetParameter3fv
cgSetParameter2fv
cgSetParameter1fv
cgSetParameter4f
cgSetParameter3f
cgSetParameter2f
cgSetParameter1f
cgInternal

opengl32

glShadeModel
glVertex2f
glVertex2fv
glVertex3fv
glVertex4fv
glNormal3f
glNormal3fv
glColor3f
glColor3fv
glColor4fv
glDisableClientState
glEnableClientState
glTexEnvf
glPolygonMode
glLineWidth
glEnable
glLineStipple
glBlendFunc
glFrontFace
glPolygonOffset
glTexEnvfv
glLoadIdentity
glColorMask
glTexGenfv
glLoadMatrixf
glTexGeni
glMatrixMode
glAlphaFunc
glScissor
glTexEnvi
glColorMaterial
glTexParameterf
glLightModeli
glClipPlane
glTexParameterfv
glClearDepth
glTexParameteri
glClearStencil
glClearColor
glLogicOp
glPointSize
glLightModeliv
glFogi
glDepthRange
glFogf
glFogfv
glLightModelfv
glLightf
glLightfv
glMaterialf
glMaterialfv
glDepthMask
glDepthFunc
glStencilMask
glStencilFunc
glStencilOp
glGetError
glDisable
glTexCoordPointer
glColorPointer
glNormalPointer
glVertexPointer
wglGetCurrentContext
wglGetCurrentDC
glGetString
wglGetProcAddress
glGetFloatv
glGetDoublev
glBindTexture
glGetIntegerv
glCullFace

kernel32

SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
CreateFileA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
ReadFile
InitializeCriticalSection
LoadLibraryA
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
CloseHandle
SetFilePointer
RtlUnwind
HeapSize
Sleep
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
DeleteCriticalSection
GetProcessHeap
GetVersionExA
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
ExitProcess
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
GetConsoleCP
UnhandledExceptionFilter
HeapFree
GetLastError
HeapAlloc
LeaveCriticalSection
EnterCriticalSection

Exports

Exports

cgGLBindProgram
cgGLCreateBuffer
cgGLDisableClientState
cgGLDisableProfile
cgGLDisableProgramProfiles
cgGLDisableTextureParameter
cgGLEnableClientState
cgGLEnableProfile
cgGLEnableProgramProfiles
cgGLEnableTextureParameter
cgGLGetBufferObject
cgGLGetLatestProfile
cgGLGetManageTextureParameters
cgGLGetMatrixParameterArraydc
cgGLGetMatrixParameterArraydr
cgGLGetMatrixParameterArrayfc
cgGLGetMatrixParameterArrayfr
cgGLGetMatrixParameterdc
cgGLGetMatrixParameterdr
cgGLGetMatrixParameterfc
cgGLGetMatrixParameterfr
cgGLGetOptimalOptions
cgGLGetParameter1d
cgGLGetParameter1f
cgGLGetParameter2d
cgGLGetParameter2f
cgGLGetParameter3d
cgGLGetParameter3f
cgGLGetParameter4d
cgGLGetParameter4f
cgGLGetParameterArray1d
cgGLGetParameterArray1f
cgGLGetParameterArray2d
cgGLGetParameterArray2f
cgGLGetParameterArray3d
cgGLGetParameterArray3f
cgGLGetParameterArray4d
cgGLGetParameterArray4f
cgGLGetProgramID
cgGLGetTextureEnum
cgGLGetTextureParameter
cgGLIsProfileSupported
cgGLIsProgramLoaded
cgGLLoadProgram
cgGLRegisterStates
cgGLSetDebugMode
cgGLSetManageTextureParameters
cgGLSetMatrixParameterArraydc
cgGLSetMatrixParameterArraydr
cgGLSetMatrixParameterArrayfc
cgGLSetMatrixParameterArrayfr
cgGLSetMatrixParameterdc
cgGLSetMatrixParameterdr
cgGLSetMatrixParameterfc
cgGLSetMatrixParameterfr
cgGLSetOptimalOptions
cgGLSetParameter1d
cgGLSetParameter1dv
cgGLSetParameter1f
cgGLSetParameter1fv
cgGLSetParameter2d
cgGLSetParameter2dv
cgGLSetParameter2f
cgGLSetParameter2fv
cgGLSetParameter3d
cgGLSetParameter3dv
cgGLSetParameter3f
cgGLSetParameter3fv
cgGLSetParameter4d
cgGLSetParameter4dv
cgGLSetParameter4f
cgGLSetParameter4fv
cgGLSetParameterArray1d
cgGLSetParameterArray1f
cgGLSetParameterArray2d
cgGLSetParameterArray2f
cgGLSetParameterArray3d
cgGLSetParameterArray3f
cgGLSetParameterArray4d
cgGLSetParameterArray4f
cgGLSetParameterPointer
cgGLSetStateMatrixParameter
cgGLSetTextureParameter
cgGLSetupSampler
cgGLUnbindProgram
cgGLUnloadProgram

Sections

.text
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcrypto-1_1-x64.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 829KB - Virtual size: 829KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libssl-1_1-x64.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rdata
Size: 550B - Virtual size: 548B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

data
Size: 68B - Virtual size: 77B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

pdata
Size: 86B - Virtual size: 84B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

idata
Size: 88B - Virtual size: 86B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

00cfg
Size: 2B - Virtual size: 1B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

rsrc
Size: 8B - Virtual size: 6B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

reloc
Size: 28B - Virtual size: 27B
msvcr100.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 574KB - Virtual size: 573KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_CONST
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
resources/Config.xml
.xml
resources/UpdateRedirector.dat
.exe windows x86

029a7c5047528a0095c91003753a71e0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:c9:54:ae:24:12:01:1c:f5:4a:7c:3c:b1:8d:75:1e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19/02/2013, 00:00

Not After

20/02/2014, 23:59

Subject

CN=Adobe Systems Incorporated,OU=AAM+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:1c:72:8a:f6:2f:a3:3b:39:71:05:65:31:5b:4f:3f:68:bf:c8:05
Signer

Actual PE Digest

f6:1c:72:8a:f6:2f:a3:3b:39:71:05:65:31:5b:4f:3f:68:bf:c8:05

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=AAM+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

20/02/2014, 15:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
GetModuleFileNameW
FlushFileBuffers
GetTempPathW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
QueryPerformanceCounter
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
FreeLibrary
LoadLibraryW
GetProcAddress
GetACP
IsValidCodePage
HeapSize
FreeEnvironmentStringsW
GetLastError
LocalFree
CloseHandle
LocalAlloc
CreateFileW
GetOEMCP
SetFilePointerEx
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetEnvironmentStringsW
GetCurrentProcessId
GetFileType
GetProcessHeap
GetStdHandle
GetModuleHandleExW
WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
ExitProcess
GetCurrentThreadId
LCMapStringW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetCommandLineW
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW

shell32

SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetSpecialFolderPathW

ole32

CoTaskMemFree

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust

shlwapi

PathRemoveFileSpecW
PathAppendW

Exports

Exports

_CreateProcessWithTokenW@36

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

text Size: 2KB - Virtual size: 2KB

rdata Size: 524B - Virtual size: 523B

data Size: 82B - Virtual size: 125B

pdata Size: 100B - Virtual size: 98B

CONST Size: 2B - Virtual size:

ext Size: 52B - Virtual size: 50B

ata Size: 130B - Virtual size: 129B

rsrc Size: 4B - Virtual size: 3B

reloc Size: 22B - Virtual size: 20B

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 3.1MB - Virtual size: 3.1MB

.data Size: 354KB - Virtual size: 527KB

.pdata Size: 244KB - Virtual size: 243KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 42KB - Virtual size: 41KB

e569e6f445d32ba23766ad67d1e3787f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

version

user32

oleaut32

netapi32

advapi32

Exports

Exports

Sections

.text Size: 718KB - Virtual size: 718KB

.itext Size: 6KB - Virtual size: 5KB

.data Size: 14KB - Virtual size: 13KB

.bss Size: - Virtual size: 27KB

.idata Size: 4KB - Virtual size: 3KB

.didata Size: 512B - Virtual size: 420B

.edata Size: 512B - Virtual size: 154B

.tls Size: - Virtual size: 24B

.rdata Size: 512B - Virtual size: 93B

.rsrc Size: 68KB - Virtual size: 68KB

71818d7b499d544b2967a8d17e5ba33e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31Certificate

Extended Key Usages

Key Usages

cf:6c:9d:71:24:bc:4a:6f:d2:ca:a7:05:53:ad:97:fe:39:db:c9:4dSigner

Signature Validations

Verification

22/07/2010, 21:10 Valid: false

Headers

File Characteristics

Imports

cg

opengl32

kernel32

Exports

text
Size: 2KB - Virtual size: 2KB

rdata
Size: 524B - Virtual size: 523B

data
Size: 82B - Virtual size: 125B

pdata
Size: 100B - Virtual size: 98B

CONST
Size: 2B - Virtual size:

ext
Size: 52B - Virtual size: 50B

ata
Size: 130B - Virtual size: 129B

rsrc
Size: 4B - Virtual size: 3B

reloc
Size: 22B - Virtual size: 20B

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 354KB - Virtual size: 527KB

.pdata
Size: 244KB - Virtual size: 243KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 42KB - Virtual size: 41KB

.text
Size: 718KB - Virtual size: 718KB

.itext
Size: 6KB - Virtual size: 5KB

.data
Size: 14KB - Virtual size: 13KB

.bss
Size: - Virtual size: 27KB

.idata
Size: 4KB - Virtual size: 3KB

.didata
Size: 512B - Virtual size: 420B

.edata
Size: 512B - Virtual size: 154B

.tls
Size: - Virtual size: 24B

.rdata
Size: 512B - Virtual size: 93B

.rsrc
Size: 68KB - Virtual size: 68KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

53:4a:be:d0:be:56:d9:84:0d:d1:2d:db:84:f8:b0:31
Certificate

cf:6c:9d:71:24:bc:4a:6f:d2:ca:a7:05:53:ad:97:fe:39:db:c9:4d
Signer

22/07/2010, 21:10
Valid: false

.text
Size: 236KB - Virtual size: 233KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 25KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 829KB - Virtual size: 829KB

.data
Size: 12KB - Virtual size: 31KB

.pdata
Size: 112KB - Virtual size: 112KB

.idata
Size: 10KB - Virtual size: 9KB

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 30KB

text
Size: 1KB - Virtual size: 1KB

rdata
Size: 550B - Virtual size: 548B

data
Size: 68B - Virtual size: 77B

pdata
Size: 86B - Virtual size: 84B

idata
Size: 88B - Virtual size: 86B

00cfg
Size: 2B - Virtual size: 1B

rsrc
Size: 8B - Virtual size: 6B

reloc
Size: 28B - Virtual size: 27B

.text
Size: 574KB - Virtual size: 573KB

.rdata
Size: 131KB - Virtual size: 130KB

.data
Size: 20KB - Virtual size: 31KB

.pdata
Size: 25KB - Virtual size: 24KB

_CONST
Size: 512B - Virtual size: 8B

text
Size: 13KB - Virtual size: 12KB

data
Size: 32KB - Virtual size: 32KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 5KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:c9:54:ae:24:12:01:1c:f5:4a:7c:3c:b1:8d:75:1e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f6:1c:72:8a:f6:2f:a3:3b:39:71:05:65:31:5b:4f:3f:68:bf:c8:05
Signer

20/02/2014, 15:37
Valid: false