cc52b074d258e89952e3587747d4e0a15d7b62616458e7c6366573d9afe489ad

Sharing

Copy URL Twitter E-mail

General

Target

cc52b074d258e89952e3587747d4e0a15d7b62616458e7c6366573d9afe489ad
Size

141KB
MD5

b688f4db5bed9b0b88c502927e6617dc
SHA1

7fcf455310c298d488d1b6127b610c79dea18329
SHA256

cc52b074d258e89952e3587747d4e0a15d7b62616458e7c6366573d9afe489ad
SHA512

27172f0bd58bb3bbe930a338ab66e53e0ab83ecc3ffb5f2371cedaf48c98651bc59059951309166b42af2c49e9582eecd8100d5117f9302635df1a0c45a8676e
SSDEEP

3072:8oii714RfeAL352G0KD6wGE51wFOn+ocJKwAOL2JZ72:8oP714RfeE4yf1eOzOLp

Score

N/A

Malware Config

Signatures

Files

cc52b074d258e89952e3587747d4e0a15d7b62616458e7c6366573d9afe489ad
.exe windows x86

b6a251a8c243fe57265d948050f8c266

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:50:77:e8:7e:b0:40:fa:30:da:c8:ca:e8:e6:17:1e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/09/2008, 00:00

Not After

24/09/2010, 23:59

Subject

CN=Quick Heal Technologies (Pvt) Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R & D,O=Quick Heal Technologies (Pvt) Ltd.,L=Pune,ST=Maharashtra,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:87:1a:35:5b:49:c6:d8:8a:92:5c:5b:c8:2c:c7:c3:d2:30:76:48
Signer

Actual PE Digest

c3:87:1a:35:5b:49:c6:d8:8a:92:5c:5b:c8:2c:c7:c3:d2:30:76:48

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Quick Heal Technologies (Pvt) Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R & D,O=Quick Heal Technologies (Pvt) Ltd.,L=Pune,ST=Maharashtra,C=IN

26/10/2008, 11:53
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

registry

AddRegistryValue
SetRegValue
IsRegistryValuePresent
GetRegValue
DeleteRegistryValue

mfc71u

ord587
ord605
ord354
ord3198
ord3204
ord764
ord1925
ord2086
ord1582
ord5911
ord1393
ord4234
ord5210
ord6275
ord2985
ord4255
ord3311
ord572
ord2077
ord1536
ord4226
ord3158
ord1545
ord3189
ord1785
ord3395
ord2651
ord1719
ord6063
ord5829
ord4574
ord2159
ord5199
ord870
ord2311
ord2460
ord577
ord774
ord293
ord1182
ord1178
ord283
ord741
ord4535
ord3677
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord3942
ord4562
ord5226
ord5209
ord5562
ord2832
ord4475
ord3327
ord566
ord757
ord593
ord5113
ord334
ord4025
ord1049
ord2239
ord3927
ord4026
ord1079
ord2365
ord1894
ord4743
ord709
ord501
ord4098
ord620
ord3176
ord4256
ord4480
ord3943
ord2638
ord3703
ord3713
ord3712
ord2527
ord2640
ord2534
ord2856
ord2708
ord4301
ord2829
ord2725
ord2531
ord5196
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1392
ord3940
ord1608
ord1611
ord5908
ord1542
ord1661
ord1662
ord2011
ord4884
ord4729
ord4206
ord5178
ord3635
ord287
ord1198

msvcr71

_controlfp
__security_error_handler
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
_cexit
_XcptFilter
_exit
_c_exit
_access
memcmp
exit
time
localtime
memcpy
_wfullpath
wcscmp
_except_handler3
_wtoi
free
_open
wcsftime
_localtime64
_mktime64
_filelength
strcpy
strcat
strlen
_write
_wunlink
_wrename
_wopen
_tell
_read
_lseek
_close
malloc
_wcsicmp
_wcsupr
wcsncmp
wcsncpy
_wcslwr
_waccess
wcsrchr
swprintf
wcslen
memset
wcsstr
wcscpy
wcschr
wcscat
__CxxFrameHandler

kernel32

TerminateProcess
GetExitCodeProcess
OpenProcess
GetCurrentProcessId
CreateDirectoryW
FindNextFileW
CopyFileW
WritePrivateProfileSectionW
GetModuleFileNameW
CreateEventW
Sleep
RemoveDirectoryW
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
MulDiv
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
GetStartupInfoW
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
CloseHandle
GetModuleHandleW
LoadLibraryExW
FindFirstFileW
FindClose
GetSystemDirectoryW
GetVersionExW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetWindowsDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
LocalFree
LocalAlloc
GetCurrentProcess
GetLastError
GetCurrentThread
GetVersionExA
LoadLibraryA
GetShortPathNameW

user32

GetClientRect
IsIconic
DrawIcon
SetTimer
GetSystemMenu
AppendMenuW
LoadImageW
FindWindowW
KillTimer
LoadIconW
PostQuitMessage
GetActiveWindow
MessageBoxW
SendMessageW
LoadBitmapW
SetWindowLongW
ExitWindowsEx
LoadStringW
EnableWindow
ReleaseDC
GetDC
GetSystemMetrics

gdi32

GetDeviceCaps

advapi32

AddAccessAllowedAce
RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
FreeSid
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
ImpersonateSelf

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b6a251a8c243fe57265d948050f8c266

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

16:50:77:e8:7e:b0:40:fa:30:da:c8:ca:e8:e6:17:1eCertificate

Extended Key Usages

Key Usages

c3:87:1a:35:5b:49:c6:d8:8a:92:5c:5b:c8:2c:c7:c3:d2:30:76:48Signer

Signature Validations

Verification

26/10/2008, 11:53 Valid: false

Headers

File Characteristics

Imports

registry

mfc71u

msvcr71

kernel32

user32

gdi32

advapi32

Sections

.text Size: 92KB - Virtual size: 90KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 80KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

16:50:77:e8:7e:b0:40:fa:30:da:c8:ca:e8:e6:17:1e
Certificate

c3:87:1a:35:5b:49:c6:d8:8a:92:5c:5b:c8:2c:c7:c3:d2:30:76:48
Signer

26/10/2008, 11:53
Valid: false

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 80KB