75d7ff1954e589fea30c37210140a4ca2ab3f169441ea783f93f54fcb15cc6a7

Sharing

Copy URL Twitter E-mail

General

Target

75d7ff1954e589fea30c37210140a4ca2ab3f169441ea783f93f54fcb15cc6a7
Size

993KB
MD5

63ed05b2677fdc4fc0142561ae9f55d5
SHA1

4ecf780e2c1cc34f998d8ad53c67462256b5b646
SHA256

75d7ff1954e589fea30c37210140a4ca2ab3f169441ea783f93f54fcb15cc6a7
SHA512

724f53033b55b1e282ec64b8eae8d40d085b373073ba6655c261d0fc365be65d2e08ccbbb3c87d4cc24067dd733680914ecd28ff6688c61d289ce8d06aeff2f4
SSDEEP

24576:sRzcRf/dmxBQlxqxHAcB3zhPkUkHS2loNYQFItTj9C9/1Ubh5tq:VluS+FCTZQ+bhvq

Score

N/A

Malware Config

Signatures

Files

75d7ff1954e589fea30c37210140a4ca2ab3f169441ea783f93f54fcb15cc6a7
.dll windows x86

64fe9067f2c230beaa5bfbebf87ae038

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
LocalAlloc
GetFileAttributesW
LoadLibraryW
GetFileAttributesExW
GetLongPathNameW
GetModuleHandleW
CreateEventW
ResumeThread
SetEvent
ResetEvent
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
GetSystemDefaultUILanguage
GetEnvironmentVariableW
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
SetFilePointerEx
HeapFree
HeapAlloc
GetProcessHeap
CreateProcessW
GetSystemDirectoryW
FileTimeToSystemTime
TerminateThread
CopyFileW
CreateDirectoryW
GetShortPathNameW
GetDriveTypeW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetTempPathW
GetFullPathNameW
InterlockedExchange
GetVersionExW
DeviceIoControl
GetWindowsDirectoryW
GetSystemTimeAsFileTime
FlushFileBuffers
WriteFile
GetExitCodeThread
FindNextFileW
GetCurrentProcess
GetSystemTime
GetCurrentProcessId
GetCurrentThreadId
IsBadReadPtr
IsBadWritePtr
lstrcpyW
FindFirstFileW
FindClose
DeleteFileW
GetLogicalDrives
GetFileSizeEx
GetLocalTime
SystemTimeToFileTime
GetTickCount
ExpandEnvironmentStringsW
SearchPathW
GetSystemWindowsDirectoryW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
OutputDebugStringW
DebugBreak
GetPrivateProfileStringW
InterlockedIncrement
GetPrivateProfileIntW
CreateThread
InterlockedCompareExchange
Sleep
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
CreateFileA
TlsGetValue
OpenThread
TlsSetValue
TlsAlloc
SetEnvironmentVariableW
TlsFree
LocalFileTimeToFileTime
FormatMessageW
GetACP
lstrcmpA
GetFileType
UnlockFileEx
LockFileEx
MoveFileExW
FileTimeToLocalFileTime
GetProcAddress
GetModuleFileNameW
lstrlenW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
CreateFileW
GetLastError
GetFileSize
ReadFile
SetFilePointer
CloseHandle
SetLastError

user32

LoadStringW
wvsprintfW
FindWindowW
SendMessageTimeoutW
LoadBitmapW
CharLowerW
CharUpperW
CharNextW

gdi32

DeleteObject

advapi32

SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegEnumValueW
RegOpenKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyExW
AllocateAndInitializeSid
RegQueryValueExA
FreeSid
RegSetValueExW

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

OleRun
CoCreateInstance
CoInitialize
CLSIDFromString
CoUninitialize
CLSIDFromProgID

oleaut32

GetErrorInfo
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantChangeType
VariantClear

comctl32

ImageList_Create
ImageList_Add
ImageList_Destroy

shlwapi

PathFindFileNameW
StrCmpW
StrCmpNW
PathFindExtensionW
PathIsDirectoryW
PathRemoveFileSpecW
StrDupW
StrStrW
StrRStrIW
StrCmpIW
SHSetValueW
StrStrIW
StrCmpNIW
SHGetValueW
PathFileExistsW
PathAppendW
StrChrW
PathCombineW
StrRChrW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
??2@YAPAXI@Z
__CxxFrameHandler
_wcsicmp
free
wcslen
calloc
iswdigit
_wtoi
_wsplitpath
wcscmp
iswspace
rand
srand
swscanf
malloc
memmove
wcschr
wcsrchr
wcsstr
strncpy
isspace
wcsncmp
_i64toa
_vsnwprintf
_ftol
_CxxThrowException
_errno
_wtoi64
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_purecall
_except_handler3
_local_unwind2
wcstoul
fclose
fgetws
fopen
printf
_wcsnicmp
fwrite
fread
fseek
_wfopen
_wcslwr
_itoa
_vsnprintf
isalnum
time
wcsncpy
qsort
memchr
tolower
swprintf
wcscpy
wcscat
_snwprintf
wcstok
strerror
realloc

ws2_32

inet_addr
inet_ntoa
gethostbyname
WSAStartup
WSACleanup
gethostname

iphlpapi

DeleteIPAddress
GetIpAddrTable
GetIpForwardTable
DeleteIpForwardEntry
GetAdaptersInfo

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrAsyncClientCall
RpcBindingFree
RpcStringFreeW
RpcAsyncCompleteCall

wininet

InternetCloseHandle
InternetOpenA
InternetConnectA
InternetWriteFile
InternetSetOptionA
InternetCrackUrlW
InternetSetStatusCallbackA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA

crypt32

CryptMsgOpenToDecode
CertOpenStore
CryptMsgUpdate
CertCloseStore
CryptMsgClose
CertGetCertificateContextProperty
CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

netapi32

Netbios

winmm

timeGetTime

Exports

Exports

DSAsyncEvaluateExec
DSAsyncNotifyWriteBack
EngCreateObject
EngFrontFix
EngLib_Init

Sections

.text
Size: 720KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64fe9067f2c230beaa5bfbebf87ae038

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

psapi

version

msvcrt

ws2_32

iphlpapi

rpcrt4

wininet

crypt32

wintrust

netapi32

winmm

Exports

Exports

Sections

.text Size: 720KB - Virtual size: 718KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 100KB - Virtual size: 115KB

.rsrc Size: 28KB - Virtual size: 24KB

.reloc Size: 60KB - Virtual size: 56KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 720KB - Virtual size: 718KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 100KB - Virtual size: 115KB

.rsrc
Size: 28KB - Virtual size: 24KB

.reloc
Size: 60KB - Virtual size: 56KB