e3f954730f8816a33e5e519f4b18d27ce7bb1cf42a50651970ae8b2bda9ad352

Sharing

Copy URL Twitter E-mail

General

Target

e3f954730f8816a33e5e519f4b18d27ce7bb1cf42a50651970ae8b2bda9ad352
Size

268KB
MD5

40775b6b572a1248f657fb8007ad8649
SHA1

9424feea267e3ee549961058c9e6a8a2aa19a3fe
SHA256

e3f954730f8816a33e5e519f4b18d27ce7bb1cf42a50651970ae8b2bda9ad352
SHA512

b1a291f732b817bc0b747faa79acb8a5c93e1d28ca00ff524b670a2a91ba669e052daedfb27f71ee289ac2a66d32ae6a3e876821edd1c103051b7e00d2fcbf5d
SSDEEP

6144:8gtzeZWVLneJnlff412EZndwNginvbTqU5r:+ZeTAnlffa2znvbTqU5r

Score

N/A

Malware Config

Signatures

Files

e3f954730f8816a33e5e519f4b18d27ce7bb1cf42a50651970ae8b2bda9ad352
.exe windows x86

a79e544d415c6b41d071925efb8283af

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/03/2010, 00:00

Not After

08/03/2011, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:e9:ce:c3:6e:d1:f5:b2:90:5c:b2:3f:74:a4:ac:6e:01:87:8b:fe
Signer

Actual PE Digest

7b:e9:ce:c3:6e:d1:f5:b2:90:5c:b2:3f:74:a4:ac:6e:01:87:8b:fe

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

24/09/2010, 16:17
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
EnumTimeFormatsA
GetCurrentDirectoryA
GlobalGetAtomNameA
LoadLibraryA
ConnectNamedPipe
WaitForMultipleObjects
GetSystemDefaultLangID
MoveFileW
EnumCalendarInfoA
InitializeCriticalSection
FileTimeToDosDateTime
GetSystemDefaultLCID
SetEvent
GetSystemDirectoryA
GetCurrentThreadId
OpenEventA
ReplaceFileA
GetLogicalDriveStringsW
ExpandEnvironmentStringsA
GetNumberFormatW
GetWindowsDirectoryW
GetExitCodeThread
lstrlen
RaiseException
lstrcpyW
CreateEventW
GetEnvironmentStringsW
GetMailslotInfo
OpenFile
GetExitCodeProcess
GetLongPathNameA
GetProcessHeap
GetLastError
AddAtomA
GetTempPathW
GetDiskFreeSpaceW
GetVolumeInformationA
MulDiv
IsDebuggerPresent
GetEnvironmentVariableA
CopyFileExA
SetLocaleInfoW
GetModuleHandleA
IsBadReadPtr
lstrcpy
GetShortPathNameA
lstrcpynA
FatalAppExitW
OpenMutexA
ExitProcess
LoadLibraryA
GetTempFileNameW
SystemTimeToFileTime
GetThreadPriority
DisconnectNamedPipe
DuplicateHandle
GetModuleFileNameA
WaitForSingleObject
ReplaceFileW
lstrcmpiA
TlsAlloc
GlobalDeleteAtom
GetTickCount
GlobalGetAtomNameW
EnumDateFormatsW
GetCurrentProcess
GetDateFormatW
AddAtomW
lstrlenW
GetModuleHandleW
GetProcAddress
GetSystemTime

user32

InsertMenuItemA
CreateAcceleratorTableW
GetMenuStringA
ShowCaret
OffsetRect
CharLowerW
GetDCEx
mouse_event
SetWindowRgn
wsprintfA
GetTopWindow
GetDesktopWindow
DestroyMenu
InsertMenuItemW
SetDlgItemInt
EnumClipboardFormats
MonitorFromWindow
GetActiveWindow
RegisterWindowMessageA
DialogBoxParamW
CreateDialogParamA
SendMessageW
LoadImageW
GetCapture
IsIconic
EnableMenuItem
LoadMenuA
GetActiveWindow
SetWindowLongW
OpenClipboard
PeekMessageA
IsDlgButtonChecked
SetTimer
GetMessageA
GetClassInfoW
DefWindowProcW
PostQuitMessage
GetMenu
GetCapture
GetForegroundWindow
CreateDesktopA
TrackPopupMenuEx
CharNextA
SetCursor
DefWindowProcA
FindWindowW
LoadCursorA
GetMenuStringW
RegisterClassExA
SetMenu
RegisterWindowMessageW
RemoveMenu
WaitForInputIdle
MoveWindow
wvsprintfA
SetWindowPos
InvalidateRect
CharPrevA
GetSysColor
GetKeyState
PeekMessageW
SetCursorPos
GetCaretPos
LoadBitmapW
GetFocus
GetKeyboardLayout
RegisterClassW

shell32

StrCmpNIA
FreeIconList
SHGetDataFromIDListW
ExtractIconA
Shell_NotifyIconW
ExtractAssociatedIconA
SHGetDiskFreeSpaceExW
StrRStrIA
StrStrA
SHCreateDirectory
SHHelpShortcuts_RunDLL
ShellExecuteA
ExtractIconExA
StrCmpNA
StrChrW
StrChrIA
StrStrW
ShellExecuteW
StrStrIA
ShellExecuteExA
StrChrIW
SHGetDataFromIDListA
SHCreateDirectoryExA

crypt32

CertNameToStrA
CertAddCertificateContextToStore
CertAlgIdToOID
I_CryptFindSmartCardCertInStore
CertUnregisterSystemStore
CryptSetKeyIdentifierProperty
CryptSIPVerifyIndirectData
CryptMemAlloc
CertCreateCRLContext
CreateFileU
I_CertSyncStore
CertDeleteCRLFromStore
CryptCreateAsyncHandle
CryptInstallDefaultContext
CertAddEnhancedKeyUsageIdentifier

Sections

.sedQaq
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FHADCx
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.OKva
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cAdkyr
Size: 15KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.XiM
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iryTw
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a79e544d415c6b41d071925efb8283af

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4aCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

7b:e9:ce:c3:6e:d1:f5:b2:90:5c:b2:3f:74:a4:ac:6e:01:87:8b:feSigner

Signature Validations

Verification

24/09/2010, 16:17 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

shell32

crypt32

Sections

.sedQaq Size: 9KB - Virtual size: 9KB

.FHADCx Size: 12KB - Virtual size: 12KB

.OKva Size: 105KB - Virtual size: 105KB

.cAdkyr Size: 15KB - Virtual size: 123KB

.XiM Size: 107KB - Virtual size: 106KB

.iryTw Size: 5KB - Virtual size: 9KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

7b:e9:ce:c3:6e:d1:f5:b2:90:5c:b2:3f:74:a4:ac:6e:01:87:8b:fe
Signer

24/09/2010, 16:17
Valid: false

.sedQaq
Size: 9KB - Virtual size: 9KB

.FHADCx
Size: 12KB - Virtual size: 12KB

.OKva
Size: 105KB - Virtual size: 105KB

.cAdkyr
Size: 15KB - Virtual size: 123KB

.XiM
Size: 107KB - Virtual size: 106KB

.iryTw
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1024B