cf5522818f5eae27d7f4f148fa8e3cae0101b8dd5476484682d214f3b5e82856

Sharing

Copy URL

Twitter E-mail

General

Target

cf5522818f5eae27d7f4f148fa8e3cae0101b8dd5476484682d214f3b5e82856
Size

237KB
MD5

8ea52b91cbfdbf9f2c00cac2c42a49fb
SHA1

336c257a68ca6652329b3586e939c98e9cfb2d72
SHA256

cf5522818f5eae27d7f4f148fa8e3cae0101b8dd5476484682d214f3b5e82856
SHA512

ea93a0df0a9e0bc8cb1b7154fb5e1cff75a8f6b2e093be56c5d1e31d6521e0c967eae2dbcf438fe843071cba9953efc130e5739aafa683861d844bd8b7747eb5
SSDEEP

3072:g4c9Y03cYxb54+eWfV4QE7u+eT/bLGHthiR39My+0HKwV+UpBbvNe0dTGHlXLTnf:gjnNfG/CNLU6+0H+O7okTi7jgdaYS

Score

N/A

Malware Config

Signatures

Files

cf5522818f5eae27d7f4f148fa8e3cae0101b8dd5476484682d214f3b5e82856
.exe windows x86

342dc2d40ff84ae8d684153e444b8731

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20-07-2010 00:00

Not After

18-08-2011 23:59

Subject

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:eb:c5:f4:34:a1:62:e2:80:1a:0f:7c:4e:d9:af:25:11:b6:01:9b
Signer

Actual PE Digest

2c:eb:c5:f4:34:a1:62:e2:80:1a:0f:7c:4e:d9:af:25:11:b6:01:9b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Immunet Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Immunet Corporation,L=Woodside,ST=California,C=US

18-07-2011 23:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
SetLocaleInfoA
GetSystemDefaultLangID
GetTempPathW
GetProcAddress
LoadLibraryA
GetLogicalDriveStringsA
CopyFileExA
ExpandEnvironmentStringsW
GetNumberFormatA
FindResourceA
EnumCalendarInfoA
GetWindowsDirectoryA
InitializeCriticalSection
GetUserDefaultLangID
GetCurrentProcess
CopyFileA
LoadLibraryExA
GetMailslotInfo
FileTimeToSystemTime
HeapCreate
MulDiv
GetLongPathNameA
CreateNamedPipeW
GetFileAttributesA
ReplaceFileW
CreateNamedPipeA
GetLocalTime
GlobalFindAtomA
lstrcpynA
SetCurrentDirectoryW
CreateMailslotA
FileTimeToLocalFileTime
GetThreadLocale
SetEvent
GetStringTypeA

user32

CopyRect
CharPrevW
GetMenuState
GetSubMenu
PostMessageW
CreateWindowExA
GetMessageW
GetClassInfoW
TrackPopupMenu
CopyIcon
GetMenuItemID
GetDesktopWindow
WinHelpW
CreateDialogIndirectParamA
CharLowerW
DefWindowProcW
LoadBitmapA
GetMenuItemInfoW
ActivateKeyboardLayout
RegisterClassExW
IsMenu
GetAsyncKeyState

gdi32

GetMetaFileA
CreateDIBSection
CreateBitmap
ExtCreateRegion
CreateFontIndirectExA
CreateDIBPatternBrush
CreateEllipticRgn
RemoveFontResourceW
RemoveFontResourceA
CreateColorSpaceA

ole32

CoCreateInstance
CoGetClassObject
CoUninitialize
CLSIDFromString

setupapi

CM_Connect_MachineA
CM_Request_Device_EjectW
CMP_WaitServicesAvailable
SetupQueryFileLogW
SetupUninstallOEMInfA
CM_Run_Detection
SetupDiGetClassDescriptionExA
SetupInitializeFileLogW
SetupDiGetClassDescriptionA
SetupGetLineTextW
SetupDiDeleteDeviceInterfaceData

version

VerFindFileW
VerQueryValueW
VerInstallFileW

wininet

InternetSetDialStateW
InternetOpenW

winmm

waveOutSetPlaybackRate
midiOutGetVolume
waveOutGetPosition
midiOutOpen
mmioAdvance
PlaySoundA

wsock32

accept
TransmitFile
inet_network
ntohl
WSAIsBlocking
WSAAsyncGetHostByAddr
ioctlsocket
GetServiceW

Sections

.EGTwdZ
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hjRSN
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.XYB
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.NJ
Size: 3KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QPWlF
Size: 5KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.y
Size: 3KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.TKQuMP
Size: 3KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.iGPj
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.AuDiH
Size: 8KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

342dc2d40ff84ae8d684153e444b8731

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

2c:eb:c5:f4:34:a1:62:e2:80:1a:0f:7c:4e:d9:af:25:11:b6:01:9bSigner

Signature Validations

Verification

18-07-2011 23:04 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

setupapi

version

wininet

winmm

wsock32

Sections

.EGTwdZ Size: 9KB - Virtual size: 8KB

.hjRSN Size: 84KB - Virtual size: 83KB

.XYB Size: 12KB - Virtual size: 12KB

.NJ Size: 3KB - Virtual size: 117KB

.QPWlF Size: 5KB - Virtual size: 74KB

.y Size: 3KB - Virtual size: 31KB

.TKQuMP Size: 3KB - Virtual size: 445KB

.iGPj Size: 83KB - Virtual size: 82KB

.AuDiH Size: 8KB - Virtual size: 88KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:47:b0:da:73:5e:fb:4b:02:0f:c8:38:ad:98:21:16
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

2c:eb:c5:f4:34:a1:62:e2:80:1a:0f:7c:4e:d9:af:25:11:b6:01:9b
Signer

18-07-2011 23:04
Valid: false

.EGTwdZ
Size: 9KB - Virtual size: 8KB

.hjRSN
Size: 84KB - Virtual size: 83KB

.XYB
Size: 12KB - Virtual size: 12KB

.NJ
Size: 3KB - Virtual size: 117KB

.QPWlF
Size: 5KB - Virtual size: 74KB

.y
Size: 3KB - Virtual size: 31KB

.TKQuMP
Size: 3KB - Virtual size: 445KB

.iGPj
Size: 83KB - Virtual size: 82KB

.AuDiH
Size: 8KB - Virtual size: 88KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 1024B