c37f55517770da7b334a3405d1e4348086901d6bad51ed3bd0f7d4e5df029919

Sharing

Copy URL Twitter E-mail

General

Target

c37f55517770da7b334a3405d1e4348086901d6bad51ed3bd0f7d4e5df029919
Size

216KB
MD5

718dc1ad668e34f203cb1d2a485ae0f1
SHA1

7ce2083a75ae606dcb0a945821cced33c371e89f
SHA256

c37f55517770da7b334a3405d1e4348086901d6bad51ed3bd0f7d4e5df029919
SHA512

d2bf73a93e846549561916898c7a4332aa6c801742320456853404e56e88dca48d5e1b2a80f20e757199dc0ef077afcb473cfd47105ac1135c7816207ae600bd
SSDEEP

6144:WOKNJAg1jsaISih0MTFLXPDxU9z/W4J6L5:ZKNJdjsa1+rPWz+4Q5

Score

N/A

Malware Config

Signatures

Files

c37f55517770da7b334a3405d1e4348086901d6bad51ed3bd0f7d4e5df029919
.exe windows x86

f3b91a7db5b9d6b53ecc212467248290

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:af:d6:99:03:92:6a:49:e3:5d:82:1a:0e:47:05:dd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

20/03/2007, 00:00

Not After

19/03/2010, 23:59

Subject

CN=IKARUS Software GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=IKARUS Software GmbH,ST=Vienna,C=AT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:ed:ba:79:4c:0e:ed:c9:04:11:4d:51:d2:b5:56:98:03:ab:88:f9
Signer

Actual PE Digest

62:ed:ba:79:4c:0e:ed:c9:04:11:4d:51:d2:b5:56:98:03:ab:88:f9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=IKARUS Software GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=IKARUS Software GmbH,ST=Vienna,C=AT

04/03/2009, 09:46
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
GetVersionExA
CreateFileA
LocalAlloc
InterlockedExchange
RaiseException
GetFileSize
SetFilePointer
ReadFile
DisableThreadLibraryCalls
FindClose
lstrcpyA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
SizeofResource
SetLastError
WaitForSingleObject
CreateEventA
CreateThread
SetThreadPriority
CloseHandle
SetEvent
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
GetCurrentThreadId
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
VirtualAllocEx
lstrcmpA
LoadLibraryExA

gdi32

SelectObject
SaveDC
SetTextColor
GetObjectA
CreateFontIndirectA
RestoreDC
DeleteObject
GetDeviceCaps

user32

CallNextHookEx
GetFocus
IsChild
SetFocus
UnhookWindowsHookEx
SendMessageA
GetDC
UnregisterClassA
SetWindowsHookExA
GetKeyState
TranslateMessage
GetWindowTextA
SetWindowTextA
SetRect
GetMessagePos
MoveWindow
MessageBeep
GetParent
CreateWindowExA
GetWindow
SetWindowContextHelpId
SendDlgItemMessageA
DestroyWindow
DefWindowProcA
WinHelpA
IsIconic
ShowWindow
BringWindowToTop
PostQuitMessage
EnumChildWindows
CreateDialogParamA
EnableWindow
IsDlgButtonChecked
CheckDlgButton
LoadBitmapA
EndDialog
GetWindowLongA
PostMessageA
SetForegroundWindow
IsDialogMessageA
GetWindowRect
SetWindowPos
SetWindowLongA
GetSysColor
LoadCursorA
SetCursor
IsWindowUnicode
GetClientRect
ChildWindowFromPoint
DispatchMessageA

advapi32

RegEnumKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ole32

CLSIDFromString
CoTaskMemFree
StringFromGUID2
CreateStreamOnHGlobal
CoCreateInstance

wininet

DeleteUrlCacheEntryW
DeleteUrlCacheEntryA

olesvr32

OleRegisterServer
SendDataMsg

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.icode
Size: 6KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3b91a7db5b9d6b53ecc212467248290

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7a:af:d6:99:03:92:6a:49:e3:5d:82:1a:0e:47:05:ddCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

62:ed:ba:79:4c:0e:ed:c9:04:11:4d:51:d2:b5:56:98:03:ab:88:f9Signer

Signature Validations

Verification

04/03/2009, 09:46 Valid: false

Headers

File Characteristics

Imports

kernel32

gdi32

user32

advapi32

ole32

wininet

olesvr32

Sections

.text Size: 16KB - Virtual size: 16KB

.bss Size: 512B - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 160KB - Virtual size: 295KB

.icode Size: 6KB - Virtual size: 179KB

.rsrc Size: 18KB - Virtual size: 17KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7a:af:d6:99:03:92:6a:49:e3:5d:82:1a:0e:47:05:dd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

62:ed:ba:79:4c:0e:ed:c9:04:11:4d:51:d2:b5:56:98:03:ab:88:f9
Signer

04/03/2009, 09:46
Valid: false

.text
Size: 16KB - Virtual size: 16KB

.bss
Size: 512B - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 160KB - Virtual size: 295KB

.icode
Size: 6KB - Virtual size: 179KB

.rsrc
Size: 18KB - Virtual size: 17KB