822b05058579e9d407e01afbe52f6a09fd5f2372e4c217481fb06778d1bbed4c

Sharing

Copy URL Twitter E-mail

General

Target

822b05058579e9d407e01afbe52f6a09fd5f2372e4c217481fb06778d1bbed4c
Size

198KB
MD5

61315fb88c97756a68380a603b8ce2ab
SHA1

cbd8ec0acc4b8dec26e4629a28d439a8d6efd89a
SHA256

822b05058579e9d407e01afbe52f6a09fd5f2372e4c217481fb06778d1bbed4c
SHA512

27f9f1db9b42ab9866056c1ef471ab56b91646d93a33ada340d7f6b8354689d2d76f060ff25db86fd4e63fbf956bff73e9a038c1e4df56b272df0e6e39b3d184
SSDEEP

6144:biHNdUP8haFqGDFuIbshKPYIe6zQSlSrjB19F:OHsEGPYb6k/B19F

Score

N/A

Malware Config

Signatures

Files

822b05058579e9d407e01afbe52f6a09fd5f2372e4c217481fb06778d1bbed4c
.exe windows x86

c29ae14aa636545eebcfdf7046ff17e1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

02/03/2010, 00:00

Not After

02/03/2011, 23:59

Subject

CN=Comodo Security Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Comodo Security Solutions\, Inc.,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:f5:12:4d:18:62:cb:78:f4:21:ad:12:06:9a:21:10:f1:53:ae:d1
Signer

Actual PE Digest

0d:f5:12:4d:18:62:cb:78:f4:21:ad:12:06:9a:21:10:f1:53:ae:d1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Comodo Security Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Comodo Security Solutions\, Inc.,L=Jersey City,ST=New Jersey,C=US

01/06/2010, 17:50
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsA
LocalFree
GlobalAlloc
GlobalFree
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
LocalAlloc
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
GetProcAddress
LoadLibraryA
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer
VirtualAllocEx

user32

LoadCursorW
SetCursor
CreateAcceleratorTableW
IsWindowVisible
RegisterHotKey
SetCapture
GetWindow
GetRawInputData
CheckRadioButton
SetKeyboardState
FlashWindowEx
CharLowerW
OemToCharBuffW
GetWindowModuleFileNameW
CreateWindowStationW
LoadStringW
CloseDesktop
DrawTextW
CharToOemW
EnterReaderModeHelper
WINNLSEnableIME
GetScrollRange
GetScrollPos
mouse_event
WaitForInputIdle
SetDebugErrorLevel
MessageBoxTimeoutW
LookupIconIdFromDirectoryEx
ImpersonateDdeClientWindow
SetSysColors
SetMenuItemInfoA
IMPSetIMEA
RegisterWindowMessageW
SetScrollPos
CallNextHookEx
ArrangeIconicWindows
GetKeyboardType
DrawFrame
GetKBCodePage
UserLpkPSMTextOut
IsDialogMessageA
DdeSetUserHandle
GetActiveWindow
GetUserObjectInformationA
LoadAcceleratorsA
SystemParametersInfoA
DdeKeepStringHandle
RegisterMessagePumpHook
InvertRect
GrayStringW
SetDlgItemTextA
LockWorkStation
SetShellWindow
IsCharLowerA
SoftModalMessageBox
GetWinStationInfo
PostQuitMessage
GetWindowRgn
DlgDirSelectComboBoxExW
OpenDesktopW
GetOpenClipboardWindow
DeferWindowPos
CreateIconFromResource
SetParent
LoadMenuA
AllowForegroundActivation
TrackPopupMenu
SetWindowsHookA
DialogBoxParamW
GetDlgItemTextW
PackDDElParam
SendMessageTimeoutW
RedrawWindow
DlgDirListW

cmutil

CmStrStrW
CmLoadIconW
CmLoadStringW
IsLogonAsSystem
CmLoadSmallIconA
CmStripPathAndExtW
CmStrchrA

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 8KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 10KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c29ae14aa636545eebcfdf7046ff17e1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8Certificate

Extended Key Usages

Key Usages

0d:f5:12:4d:18:62:cb:78:f4:21:ad:12:06:9a:21:10:f1:53:ae:d1Signer

Signature Validations

Verification

01/06/2010, 17:50 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

cmutil

Sections

.text Size: 18KB - Virtual size: 17KB

.bss Size: 8KB - Virtual size: 84KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 148KB - Virtual size: 348KB

.edata Size: 10KB - Virtual size: 72KB

.rsrc Size: 1024B - Virtual size: 616B

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8
Certificate

0d:f5:12:4d:18:62:cb:78:f4:21:ad:12:06:9a:21:10:f1:53:ae:d1
Signer

01/06/2010, 17:50
Valid: false

.text
Size: 18KB - Virtual size: 17KB

.bss
Size: 8KB - Virtual size: 84KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 148KB - Virtual size: 348KB

.edata
Size: 10KB - Virtual size: 72KB

.rsrc
Size: 1024B - Virtual size: 616B