b561e8b0d082fc22c5114c8367fd611dfb84dc2d142c13cad3cb9eaf31ec8e64

Sharing

Copy URL Twitter E-mail

General

Target

b561e8b0d082fc22c5114c8367fd611dfb84dc2d142c13cad3cb9eaf31ec8e64
Size

133KB
MD5

81020338986a8944ad18e9ed9bebd693
SHA1

c882d26a7c74fc7d57439299bad0f762140c9cba
SHA256

b561e8b0d082fc22c5114c8367fd611dfb84dc2d142c13cad3cb9eaf31ec8e64
SHA512

407b9960d5f19abe9d38deaefaeaf4d33069b5dd8f5ecb79b0921aa7889de7712e69b7d45b2d1da0c3afed986252884ebd65b9c6dba1ea9bc50cde188057b8e9
SSDEEP

3072:8IBlNgkoswU4cNrk2pIj7jAouC7pe3x3fHLq2tHeOv3YGrrrEKRvIfnUjX:RBlHk2pI3JuCV8q2tHmGrzJIfk

Score

N/A

Malware Config

Signatures

Files

b561e8b0d082fc22c5114c8367fd611dfb84dc2d142c13cad3cb9eaf31ec8e64
.exe windows x86

29bd7aba55ad0d39a8ea581edc231833

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:7d:65:5d:0e:87:b2:82:02:b7:ab:c5:c5:09:3b:47:55:62:fd:f9
Signer

Actual PE Digest

44:7d:65:5d:0e:87:b2:82:02:b7:ab:c5:c5:09:3b:47:55:62:fd:f9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

13/04/2012, 10:35
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord535
ord941
ord537
ord924
ord800

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
__p__commode
_onexit
__dllonexit
_except_handler3
strncmp
strstr
exit
__CxxFrameHandler
__p__fmode
__set_app_type
_exit
_controlfp

kernel32

CreateFileA
LockResource
GlobalAlloc
LoadResource
lstrcatA
WriteFile
GetStartupInfoA
FindResourceA
GetSystemDirectoryA
GetSystemWindowsDirectoryA
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
CreateProcessA
OutputDebugStringA
Sleep
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
CloseHandle
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetTickCount
LoadLibraryA
GetTempPathA
CopyFileA
GetCommandLineA
SetFileAttributesA
SizeofResource

advapi32

CloseServiceHandle
RegSetValueExA
RegDeleteValueA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
RegCloseKey
RegQueryValueExA
StartServiceCtrlDispatcherA
RegCreateKeyA
RegOpenKeyExA

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

Sections

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29bd7aba55ad0d39a8ea581edc231833

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

44:7d:65:5d:0e:87:b2:82:02:b7:ab:c5:c5:09:3b:47:55:62:fd:f9Signer

Signature Validations

Verification

13/04/2012, 10:35 Valid: false

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

advapi32

msvcp60

Sections

.data Size: 9KB - Virtual size: 8KB

.rsrc Size: 118KB - Virtual size: 120KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

44:7d:65:5d:0e:87:b2:82:02:b7:ab:c5:c5:09:3b:47:55:62:fd:f9
Signer

13/04/2012, 10:35
Valid: false

.data
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 118KB - Virtual size: 120KB