72c4b593660352c636159f7b1ba4588da4712a5f53c78c51e0ca1f6a6cb3ec8d

Sharing

Copy URL Twitter E-mail

General

Target

72c4b593660352c636159f7b1ba4588da4712a5f53c78c51e0ca1f6a6cb3ec8d
Size

143KB
MD5

144bcf77f50b2bba70fef4ed89b244e2
SHA1

9c0dc771b42581f623663bced1b9a9e4bbc929eb
SHA256

72c4b593660352c636159f7b1ba4588da4712a5f53c78c51e0ca1f6a6cb3ec8d
SHA512

3088d647b7d1288ccf81ce1a8f776780f558678a1c0129fb14f2f2f8ad1a2298e40df17660bef5995396a5fea49941c88d68aed0a65d73dded1e16dea5d807a9
SSDEEP

3072:LFrdbBKnuy7XMEZrlPCtqy3MOBBQOoYeXYJZ1Nd:LFrdN8hbhUH3MOBKzUN

Score

N/A

Malware Config

Signatures

Files

72c4b593660352c636159f7b1ba4588da4712a5f53c78c51e0ca1f6a6cb3ec8d
.exe windows x86

bdb0cb030bcfd4cf1c0d39c87b189170

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:40:3b:57:d4:11:ea:c5:1e:37:9c:ae:73:e0:8a:8e:a2:5a:07:69
Signer

Actual PE Digest

c1:40:3b:57:d4:11:ea:c5:1e:37:9c:ae:73:e0:8a:8e:a2:5a:07:69

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

11/03/2009, 17:51
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_setmbcp
_ismbblead
abort
_expand
_msize
longjmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_ismbcdigit
_wcsicmp
wcschr
_mbschr
isspace
_strdup
_splitpath_s
_makepath_s
memmove
_vsnwprintf
_stricmp
_setjmp3
malloc
free
_vsnprintf
memcpy
??3@YAXPAX@Z
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ

shell32

SHGetFolderPathA

ole32

OleLoad
GetClassFile
StgCreateDocfile
OleCreateLinkToFile
OleSetContainedObject
StgOpenStorageOnILockBytes
StgIsStorageILockBytes
CoBuildVersion
CoRegisterClassObject
CoRevokeClassObject
OleSave
ReadClassStg

kernel32

InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
LoadLibraryExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
SetLastError
GetLastError
GetCurrentProcessId
CloseHandle
GetSystemTime
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
lstrcmpiA
LoadLibraryA
OutputDebugStringA
MultiByteToWideChar
GetFileAttributesA
GetFileTime
CreateFileA
DeleteFileA
WriteFile
GetTempPathA
ReadFile
SetCurrentDirectoryA
lstrlenA
CompareFileTime
WaitForSingleObject
IsBadWritePtr
IsDBCSLeadByte
GetProfileStringA
GetSystemDefaultLCID
WideCharToMultiByte
GetACP
GetCurrentThreadId
lstrlenW
FreeResource
LockResource
LoadResource
GlobalAddAtomA
GetCurrentThread
TlsSetValue
SizeofResource
FindResourceW
TlsGetValue
LocalAlloc
FindResourceA
TlsAlloc
GetVersionExA
lstrcmpA
lstrcmpW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentDirectoryA

advapi32

RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegCloseKey

user32

GetSubMenu
GetMenu
IsWindowEnabled
GetLastActivePopup
GetForegroundWindow
RegisterClassA
CreateWindowExW
GetClassInfoA
GetClassInfoW
GetDlgCtrlID
GetTopWindow
AdjustWindowRectEx
SystemParametersInfoA
GetMonitorInfoA
MonitorFromWindow
RemovePropA
GetPropA
SetPropA
SetWindowLongW
GetWindowLongW
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetNextDlgTabItem
GetCursorPos
ValidateRect
GetKeyState
DispatchMessageA
TranslateMessage
GetMessageA
IsWindowVisible
MessageBoxA
TranslateAcceleratorA
GetDesktopWindow
BringWindowToTop
LoadAcceleratorsA
DestroyMenu
LoadMenuA
WinHelpA
SetMenu
EndDialog
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DialogBoxIndirectParamA
DialogBoxIndirectParamW
TabbedTextOutA
DrawTextA
GrayStringA
DrawTextW
ModifyMenuW
TabbedTextOutW
GetMenuItemID
GetClassNameA
SetWindowTextA
UnregisterClassA
UnregisterClassW
CopyRect
IsDialogMessageW
IsDialogMessageA
GetWindow
IsWindowUnicode
DefWindowProcA
CallWindowProcA
GetMessageTime
GetMessagePos
GetWindowLongA
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadStringA
GetWindowTextLengthA
GetWindowTextW
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
GetAsyncKeyState
SendDlgItemMessageA
DrawFocusRect
DrawIcon
CharPrevA
DestroyWindow
IsCharAlphaNumericA
CharNextA
GetDC
ReleaseDC
MapDialogRect
MessageBoxW
ShowWindow
LoadMenuW
GetSystemMetrics
PeekMessageA
CreateWindowExA
MessageBeep
IsWindow
SetCursor
SetForegroundWindow
GetFocus
SetWindowPos
IsIconic
SetWindowLongA
SetWindowTextW
ScreenToClient
GetDlgItem
SetFocus
EnableWindow
RedrawWindow
SendMessageA
GetClientRect
MoveWindow
GetWindowRect
OffsetRect
PostMessageA
SetRectEmpty
LoadStringW
LoadIconA
LoadCursorA
RegisterClassW
DefWindowProcW
PostQuitMessage
GetParent
GetWindowThreadProcessId
GetMenuItemCount
GetSysColor

gdi32

SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
DeleteDC
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps
TextOutW
ExtTextOutW
PatBlt
GetTextMetricsA
CreateFontIndirectA
GetObjectA
RectVisible
GetStockObject
GetTextExtentPointW

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bdb0cb030bcfd4cf1c0d39c87b189170

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

c1:40:3b:57:d4:11:ea:c5:1e:37:9c:ae:73:e0:8a:8e:a2:5a:07:69Signer

Signature Validations

Verification

11/03/2009, 17:51 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

shell32

ole32

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 19KB - Virtual size: 19KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

c1:40:3b:57:d4:11:ea:c5:1e:37:9c:ae:73:e0:8a:8e:a2:5a:07:69
Signer

11/03/2009, 17:51
Valid: false

.text
Size: 104KB - Virtual size: 103KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 19KB - Virtual size: 19KB