b9571542d7c9267d12f59e354f9f2aaa33a3bdc6b1b411f267a1085896d4c150

Sharing

Copy URL Twitter E-mail

General

Target

b9571542d7c9267d12f59e354f9f2aaa33a3bdc6b1b411f267a1085896d4c150
Size

184KB
MD5

5f64a81853c39b432a187c9520dbb4d1
SHA1

5d5d2b36ec4f7114969d1c3a5a10ab073ae9a29a
SHA256

b9571542d7c9267d12f59e354f9f2aaa33a3bdc6b1b411f267a1085896d4c150
SHA512

fb1986cea3cfed944509c45abc941d010eb38f201af4f4a3801f2892b55da0e93b726df65a416e74d86a179c7629d77e76a609fa5eb8bd8c3b2ed01ac69eaf8b
SSDEEP

3072:4bTtaYnZd0FOZxyC3iviC8Bf6LSLwpL2MfCt9GTPbcJ/KJ:4boaQOOC3VC8BfXMNtQ/K

Score

N/A

Malware Config

Signatures

Files

b9571542d7c9267d12f59e354f9f2aaa33a3bdc6b1b411f267a1085896d4c150
.exe windows x86

a45fda0c22de5a6d00a731fc23072006

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4621
ord4418
ord3716
ord3614
ord795
ord1634
ord567
ord3658
ord3621
ord2406
ord6195
ord4282
ord4279
ord4270
ord5871
ord2371
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord3733
ord561
ord815
ord617
ord2506
ord5208
ord4075
ord2613
ord1131
ord4215
ord2576
ord3649
ord641
ord2430
ord2566
ord4390
ord3567
ord4229
ord5261
ord4370
ord4992
ord6048
ord1767
ord5276
ord4419
ord3592
ord1143
ord1165
ord324
ord2362
ord2294
ord6213
ord4142
ord6237
ord4704
ord755
ord2746
ord470
ord6211
ord3087
ord6330
ord4219
ord2634
ord4294
ord6266
ord1637
ord3566
ord609
ord2810
ord3074
ord3820
ord3826
ord3825
ord3397
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord6655
ord6868
ord538
ord942
ord2910
ord5568
ord2756
ord4273
ord4272
ord925
ord922
ord940
ord537
ord861
ord858
ord825
ord540
ord860
ord296
ord800
ord1569

msvcrt

_controlfp
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__CxxFrameHandler
_itow
swprintf
wcscmp
wcslen
_snwprintf
gmtime
clock
memcmp
memcpy
memset
_wtoi
wcstok
wcsrchr
wcsftime
localtime
time
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr

kernel32

FreeLibrary
DeleteFileW
GetFileAttributesW
GetPrivateProfileSectionNamesW
lstrlenW
lstrcatW
lstrcpyW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetProcAddress
GetPrivateProfileStringW
TerminateProcess
OpenProcess
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpW
ExpandEnvironmentStringsW
GetModuleHandleW
GetStartupInfoW
LoadLibraryW
GetModuleFileNameW
SetFileAttributesW
Sleep
CreateDirectoryW
CopyFileW
lstrcpynW
GetVersionExW
CloseHandle
WaitForSingleObject
GetLastError
CreateProcessW
GetPrivateProfileIntW
Process32NextW
VirtualFree
VirtualAlloc
GetFileSize
SetFilePointer
ReadFile
CreateFileW
GetTickCount

user32

IsIconic
GetSystemMetrics
GetClientRect
InsertMenuW
CreatePopupMenu
IsWindowVisible
InvalidateRect
FindWindowW
GetSysColor
RedrawWindow
SetCursor
GetWindowRect
AppendMenuW
GetMenuStringW
PostMessageW
GetMenuItemCount
DrawIcon
DrawEdge
SendMessageW
LoadCursorW
LoadIconW
MessageBoxW
EnableWindow

gdi32

CreateSolidBrush
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject

advapi32

RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

SHChangeNotify
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

shlwapi

PathRemoveFileSpecW
StrStrIW
PathFileExistsW
PathAppendW

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a45fda0c22de5a6d00a731fc23072006

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 117KB - Virtual size: 117KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 117KB - Virtual size: 117KB