5ffc0c9b0456b562e7174cf690fc19b91a06c145b5e7704991cf77d670234f92

Sharing

Copy URL Twitter E-mail

General

Target

5ffc0c9b0456b562e7174cf690fc19b91a06c145b5e7704991cf77d670234f92
Size

126KB
MD5

6e6f47684faed02a020af0f2e1c3abed
SHA1

48582d76ea9291f7d24381aeebeed91498dde33b
SHA256

5ffc0c9b0456b562e7174cf690fc19b91a06c145b5e7704991cf77d670234f92
SHA512

129bdd2693881688da3f0ebb754f50cd6342ea5e9efde0c5671a6a14ebc3f3d5a061dcf0081327bf82db91b56f96b085aa93ad01de3793ef3c2cddbcb3f1d830
SSDEEP

3072:5OO7pIdOe4tWpeLGSLNho4b8byAGdJVu/gjkWrzE5nab:k1dOTpGSLX8ehPVZjkWvEpq

Score

N/A

Malware Config

Signatures

Files

5ffc0c9b0456b562e7174cf690fc19b91a06c145b5e7704991cf77d670234f92
.exe windows x86

aa152a874b19e27b999fdd9351caab16

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/02/2009, 00:00

Not After

11/02/2012, 23:59

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidCodePage
GetLongPathNameW
ReadDirectoryChangesW
EnumTimeFormatsA
ExitProcess
CreateSemaphoreW
SetThreadPriority
FatalAppExitW
GetProcessHeaps
lstrcmpiA
GetCurrentProcess
ConnectNamedPipe
RaiseException
GetDateFormatA
GetCalendarInfoA
VirtualAlloc
lstrcpy
OpenEventA
Sleep
DuplicateHandle
FileTimeToLocalFileTime
LoadLibraryA
EndUpdateResourceW
GetTempFileNameA
GetLongPathNameA
SetComputerNameA
GetSystemDefaultLCID
lstrcpyA
GetLocalTime
GetWindowsDirectoryA
ReplaceFileA
GetTempPathW
CopyFileExW
SetCurrentDirectoryA
GetLocaleInfoA
GetStringTypeA
ExpandEnvironmentStringsW
FindResourceW
lstrcatW
GlobalGetAtomNameA
GetModuleHandleA
EnumDateFormatsA
lstrcmpi
GetCurrentDirectoryA
SetCalendarInfoA
SetEvent
FindAtomA
CreateNamedPipeW
FreeResource
ReplaceFileW
OpenProcess
GetNamedPipeInfo
AddAtomA
GetTempFileNameW
GetThreadLocale
CompareStringA

user32

ArrangeIconicWindows
RegisterWindowMessageW
SetDlgItemTextA
CreateDialogParamA
AppendMenuW
RegisterClassExA
EnumDesktopsW
GetDlgItemInt
GetScrollPos
GetWindowTextW
UpdateWindow
SetTimer
LoadImageA
GetActiveWindow
GetDC
EndDialog
IsDlgButtonChecked
FindWindowW
CharUpperW
DeleteMenu
DestroyWindow
EnableMenuItem
ShowCursor
wvsprintfA
CheckRadioButton

gdi32

StretchDIBits
EnumICMProfilesA
RemoveFontResourceExA
GetCurrentPositionEx
GetTextCharacterExtra
DeleteEnhMetaFile
GetArcDirection
CreateBitmapIndirect
SetPixelV

advapi32

GetMultipleTrusteeW
RegRestoreKeyW
RegQueryMultipleValuesA
RegCreateKeyA

oleaut32

SafeArrayCreateVector
SafeArrayGetElemsize
VarR4FromI2
VarUI8FromR8
OleLoadPictureFileEx

setupapi

SetupDiGetHwProfileList
SetupQueryInfVersionInformationA
CM_Add_ID_ExA
SetupCopyOEMInfW
SetupGetFileQueueCount
SetupDiLoadClassIcon
CM_Open_Class_KeyA
MyRealloc
SetupDiClassNameFromGuidA
CM_Free_Log_Conf_Handle

ws2_32

getpeername
getprotobynumber
accept
inet_addr
closesocket
bind
recvfrom
WSAAccept

inetcomm

EssSecurityLabelDecodeEx
MimeOleSetBodyPropW
EssMLHistoryDecodeEx
MimeOleGenerateFileName
MimeOleGetFileExtension
EssKeyExchPreferenceDecodeEx
EssReceiptDecodeEx
EssReceiptRequestEncodeEx
CreateIMAPTransport
EssKeyExchPreferenceEncodeEx
MimeOleGenerateCID
MimeOleObjectFromMoniker
MimeOleGetContentTypeExt
MimeOleGetPropA

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.~0W
Size: 1024B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.%*}8
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.9`9
Size: 1024B - Virtual size: 15KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4/!
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.#15ke&
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.~
Size: 1KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.L0;U
Size: 1KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

./X$6
Size: 1KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa152a874b19e27b999fdd9351caab16

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

oleaut32

setupapi

ws2_32

inetcomm

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 3KB

.~0W Size: 1024B - Virtual size: 40KB

.%*}8 Size: 1024B - Virtual size: 12KB

.9`9 Size: 1024B - Virtual size: 15KB

.4/! Size: 1024B - Virtual size: 28KB

.#15ke& Size: 17KB - Virtual size: 22KB

.~ Size: 1KB - Virtual size: 42KB

.L0;U Size: 1KB - Virtual size: 17KB

./X$6 Size: 1KB - Virtual size: 30KB

.rsrc Size: 74KB - Virtual size: 74KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 3KB

.~0W
Size: 1024B - Virtual size: 40KB

.%*}8
Size: 1024B - Virtual size: 12KB

.9`9
Size: 1024B - Virtual size: 15KB

.4/!
Size: 1024B - Virtual size: 28KB

.#15ke&
Size: 17KB - Virtual size: 22KB

.~
Size: 1KB - Virtual size: 42KB

.L0;U
Size: 1KB - Virtual size: 17KB

./X$6
Size: 1KB - Virtual size: 30KB

.rsrc
Size: 74KB - Virtual size: 74KB