5b9f37dd59b9e092863f5c23f5c52895f78a8b5f5c0aaf863f62c7e5d327d4f7

Sharing

Copy URL Twitter E-mail

General

Target

5b9f37dd59b9e092863f5c23f5c52895f78a8b5f5c0aaf863f62c7e5d327d4f7
Size

2.0MB
MD5

2a5c46201bc83d8375eab458a6ee1316
SHA1

d8563e6c963ef4cc34649658a4c978c04337dffe
SHA256

5b9f37dd59b9e092863f5c23f5c52895f78a8b5f5c0aaf863f62c7e5d327d4f7
SHA512

527dea03e9ac365d43e4855730b792cead2821701b42859db2528d6fc399ae456d50a3ee6dd0a904b7b702ecaab6823e6b0ef572342e1382728936f67393a5ed
SSDEEP

24576:E3vqUuyhlFyVzWLxCz50yEDS1GgCStMPZEtzx5vPPbaCmZd6Asbaj2B1:NUlSzJzZE9gCRPoPPbdmZgAtSD

Score

N/A

Malware Config

Signatures

Files

5b9f37dd59b9e092863f5c23f5c52895f78a8b5f5c0aaf863f62c7e5d327d4f7
.exe windows x86

618d4b20644abdc515a390c09016b0e2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:66:cc:1b:6d:1f:5c:82:76:61:a2:53:31:36:fd:9e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/03/2008, 00:00

Not After

06/03/2010, 23:59

Subject

CN=AVG Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ec:39:f6:c7:dc:b6:c5:30:79:98:c9:0e:6b:25:d1:96:3c:1c:cf:18
Signer

Actual PE Digest

ec:39:f6:c7:dc:b6:c5:30:79:98:c9:0e:6b:25:d1:96:3c:1c:cf:18

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AVG Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies,L=Brno,ST=Jihomoravsky kraj,C=CZ

21/12/2009, 19:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvfw32

DrawDibClose
DrawDibDraw
DrawDibRealize
DrawDibSetPalette
DrawDibOpen

winmm

PlaySoundW

mfc80u

ord3995
ord3678
ord3590
ord6013
ord3280
ord5723
ord6033
ord1183
ord1908
ord567
ord758
ord5640
ord326
ord5643
ord5636
ord1959
ord3508
ord1555
ord1176
ord2074
ord1556
ord416
ord651
ord1557
ord6751
ord3198
ord5867
ord6749
ord2860
ord3983
ord3301
ord1578
ord3296
ord2713
ord731
ord4755
ord6276
ord4234
ord3570
ord2086
ord3311
ord741
ord330
ord589
ord3602
ord4964
ord4474
ord4510
ord4370
ord4788
ord4281
ord4799
ord5047
ord4958
ord4643
ord4940
ord4501
ord4955
ord4125
ord1293
ord1999
ord2797
ord3212
ord4267
ord5162
ord1351
ord2413
ord3338
ord2414
ord1610
ord5910
ord2412
ord6763
ord2411
ord3968
ord4854
ord4857
ord5202
ord4373
ord4378
ord4375
ord4371
ord4395
ord4380
ord4770
ord4581
ord4172
ord4165
ord4974
ord4383
ord4775
ord4198
ord4784
ord4437
ord410
ord4438
ord648
ord3734
ord4908
ord2362
ord3644
ord4914
ord4553
ord5043
ord4433
ord4362
ord4495
ord4840
ord6279
ord6277
ord1720
ord1957
ord3589
ord2936
ord5829
ord2364
ord1946
ord4094
ord2085
ord3238
ord1274
ord6140
ord2365
ord5654
ord5096
ord1007
ord2009
ord4320
ord5231
ord1118
ord2311
ord577
ord1590
ord1646
ord1647
ord2397
ord2409
ord2386
ord2390
ord2392
ord2394
ord293
ord2384
ord5229
ord776
ord1883
ord2261
ord3842
ord1542
ord860
ord1252
ord566
ord6063
ord1058
ord5803
ord283
ord774
ord5558
ord1476
ord3756
ord1536
ord1156
ord5864
ord3877
ord2876
ord280
ord1582
ord4523
ord4965
ord4942
ord4957
ord4790
ord1553
ord4124
ord4121
ord2415
ord3990
ord4101
ord4667
ord2260
ord4358
ord1906
ord2121
ord894
ord4117
ord5637
ord3281
ord587
ord3176
ord502
ord3158
ord4226
ord2077
ord356
ord2648
ord709
ord501
ord3829
ord1622
ord265
ord6061
ord572
ord760
ord3165
ord2985
ord4228
ord1538
ord2080
ord4092
ord1474
ord1922
ord6115
ord591
ord3629
ord1731
ord2240
ord3825
ord759
ord570
ord5223
ord4563
ord5563
ord3330
ord1155
ord2984
ord3327
ord6278
ord2151
ord2981
ord3322
ord754
ord3342
ord2788
ord2254
ord3645
ord3224
ord4232
ord2083
ord370
ord618
ord5708
ord6116
ord658
ord1572
ord2239
ord3824
ord1086
ord757
ord1920
ord5633
ord602
ord347
ord3885
ord1271
ord2361
ord4574
ord605
ord354
ord1270
ord5982
ord5618
ord3435
ord1925
ord5981
ord3344
ord5727
ord3155
ord4314
ord2011
ord3204
ord5609
ord4729
ord4206
ord4119
ord5799
ord4112
ord4109
ord3635
ord2366
ord4347
ord3395
ord2255
ord2651
ord3157
ord2159
ord5178
ord4884
ord1662
ord1661
ord6232
ord6720
ord5908
ord1392
ord6271
ord5199
ord4256
ord1864
ord1784
ord1785
ord762
ord6086
ord2155
ord920
ord925
ord2167
ord929
ord927
ord931
ord2404
ord2388
ord1894
ord2407
ord2402
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5196
ord2856
ord4480
ord6721
ord5911
ord1611
ord1608
ord3940
ord1393
ord4238
ord5148
ord1899
ord5067
ord4179
ord5210
ord1299
ord3397
ord1955
ord4716
ord4276
ord1591
ord5171
ord5956
ord4255
ord4032
ord4008
ord6272
ord3795
ord6274
ord2054
ord5579
ord3800
ord6215
ord5378
ord3826
ord1911
ord266
ord2925
ord5220
ord1386
ord5222
ord3942
ord4562
ord5226
ord1079
ord3677
ord5209
ord5562
ord2531
ord2725
ord3586
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord764
ord1198
ord4513
ord1634
ord715
ord3133
ord5638
ord3286
ord642
ord5584
ord5635
ord3208
ord4230
ord1172
ord1479
ord282
ord3869
ord6700
ord5398
ord5869
ord2460
ord5862
ord1006
ord1921
ord2250
ord2297
ord5519
ord1628
ord1549

msvcr80

vfprintf
strcmp
qsort
_time64
_lrotl
fprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_except_handler4_common
abort
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
fputs
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
memchr
_crt_debugger_hook
realloc
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3
wcstoul
wcschr
_wcsicmp
_CxxThrowException
wcsncpy
wcsstr
abs
_encode_pointer
__iob_func
_wtoi
wcstod
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
wcscpy
_wtol
_wcsdup
swprintf_s
_set_invalid_parameter_handler
_invoke_watson
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_errno
srand
rand
wcsftime
strlen
_wgetenv_s
wcsncmp
_beginthreadex
malloc
free
_vsnwprintf_s
_wcsupr_s
wcslen
_wcslwr_s
towlower
memcmp
memset
memmove
memcpy
_purecall

kernel32

MapViewOfFile
SetFilePointer
CreateFileMappingW
GetComputerNameExW
GetSystemInfo
GetSystemDirectoryW
GetCurrentProcessId
GetWindowsDirectoryW
GetModuleFileNameW
LocalAlloc
ProcessIdToSessionId
GetComputerNameW
OpenThread
GetCurrentThreadId
LoadLibraryA
GetVersionExW
LoadLibraryW
FreeLibrary
SetFileAttributesW
GetModuleHandleW
UnmapViewOfFile
GetProcAddress
GetCurrentDirectoryW
GetTempPathW
MoveFileExW
GetFileAttributesW
CreateFileW
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
CreateProcessW
GetExitCodeProcess
SetThreadPriority
ResumeThread
GetExitCodeThread
CloseHandle
WaitForSingleObject
WaitForMultipleObjects
GetSystemDefaultLCID
MultiByteToWideChar
GetACP
CompareStringW
WideCharToMultiByte
ResetEvent
SetLastError
SetEvent
CreateEventW
OpenProcess
LocalFree
GetTickCount
GetLastError
GetCurrentProcess
SetProcessWorkingSetSize
SetEndOfFile
WriteFile
ReadFile
GetFileSize
FlushFileBuffers
SystemTimeToFileTime
GetLocalTime
GetSystemTimeAsFileTime
Sleep
FileTimeToSystemTime
CreateMutexW
ReleaseMutex
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
GetOverlappedResult
CancelIo
SetUnhandledExceptionFilter
FindResourceW
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
MulDiv
lstrcpynW
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
HeapAlloc
lstrcpyW
IsBadStringPtrW
lstrlenW
GetShortPathNameW
QueryPerformanceFrequency
QueryPerformanceCounter
FileTimeToLocalFileTime
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetVersionExA
ExpandEnvironmentStringsW
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetDiskFreeSpaceExW
GetDriveTypeW
QueryDosDeviceW
GetCurrentThread
GetThreadLocale
DeleteFileW
GetLocaleInfoA

user32

GetIconInfo
AnimateWindow
GetSysColorBrush
TranslateMessage
GetMessageW
DispatchMessageW
RegisterClassExW
SetWindowRgn
GetTopWindow
GetDlgCtrlID
InflateRect
EndDeferWindowPos
RemovePropW
DeferWindowPos
SetPropW
IsWindowEnabled
FrameRect
AppendMenuW
BringWindowToTop
EnumWindows
GetForegroundWindow
DrawIconEx
RemoveMenu
GetMenuItemID
GetMenuItemInfoW
GetMenuItemCount
IsMenu
GetWindowDC
SendMessageTimeoutW
AttachThreadInput
CopyRect
DrawTextW
GetSysColor
SystemParametersInfoA
BeginDeferWindowPos
FindWindowExW
PostQuitMessage
GetPropW
LoadImageW
TrackPopupMenu
RegisterWindowMessageW
GetDesktopWindow
EnableWindow
PostMessageW
GetSystemMetrics
IsWindow
GetNextDlgTabItem
SetScrollInfo
EndPaint
GetScrollPos
ClientToScreen
SetWindowTextW
BeginPaint
DestroyWindow
CallWindowProcW
ScreenToClient
GetAncestor
GetWindowTextLengthW
GetScrollRange
GetWindowTextW
SetFocus
DrawFocusRect
CreateWindowExW
InvalidateRect
MapWindowPoints
GetWindowThreadProcessId
EnumChildWindows
FindWindowW
GetClassNameW
GetDoubleClickTime
GetCursorPos
GetSystemMenu
MoveWindow
SystemParametersInfoW
FillRect
CloseClipboard
MessageBeep
SetClipboardData
IsIconic
EmptyClipboard
GetLastActivePopup
GetActiveWindow
OpenClipboard
MessageBoxW
PtInRect
WinHelpW
SetRect
SetRectEmpty
SetWindowLongW
GetWindowLongW
IsWindowVisible
IsZoomed
GetWindowPlacement
SetWindowPlacement
FlashWindowEx
RedrawWindow
OffsetRect
SetWindowPos
PostThreadMessageW
LoadIconW
DefWindowProcW
ReleaseDC
LoadCursorW
SendMessageW
GetDC
ShowWindow
GetScrollInfo
SetCursor
GetClientRect
GetWindowRect
IsRectEmpty
GetWindow
GetKeyState
SetParent
DestroyIcon
GetParent
GetDlgItem
ModifyMenuW
InsertMenuItemW
CreatePopupMenu
SetForegroundWindow
EnableMenuItem
SetMenuDefaultItem
DestroyMenu
GetSubMenu
LoadMenuW
KillTimer
SetTimer
GetMessagePos
ReleaseCapture
GetFocus
SetCapture

gdi32

CreateFontIndirectW
GetDeviceCaps
CreatePen
GetTextMetricsW
DPtoLP
ExcludeClipRect
DeleteDC
GetObjectW
GetTextExtentPoint32W
SelectObject
RemoveFontResourceExW
AddFontResourceExW
LineTo
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
DeleteObject
GetObjectType
GetDIBits
RealizePalette
RoundRect
CreatePalette
Rectangle
Ellipse
GetDIBColorTable
CreateBrushIndirect
CreatePolygonRgn
SetDCPenColor
Polygon
SetBkMode
GetStockObject
ExtTextOutW
SetTextJustification
CreateRectRgnIndirect
TextOutW
SetTextColor
MoveToEx
SetBkColor
StretchBlt
CreateBitmap
CreateDIBSection
BitBlt
GetPixel
GdiFlush

msimg32

TransparentBlt

advapi32

RegQueryValueExA
RegOpenKeyExA
OpenThreadToken
CheckTokenMembership
FreeSid
RegQueryValueExW
AllocateAndInitializeSid
GetTokenInformation
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegOpenKeyW
OpenProcessToken

shell32

ExtractIconExW
ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW

comctl32

_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Destroy
InitCommonControlsEx
ImageList_AddMasked
ImageList_Draw
ord17
ImageList_LoadImageW

oleaut32

SysFreeString

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

socket
inet_addr
ioctlsocket
WSAStartup
WSAGetLastError
closesocket
htons
sendto
select
recvfrom
WSACleanup

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 278KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

618d4b20644abdc515a390c09016b0e2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

62:66:cc:1b:6d:1f:5c:82:76:61:a2:53:31:36:fd:9eCertificate

Extended Key Usages

Key Usages

ec:39:f6:c7:dc:b6:c5:30:79:98:c9:0e:6b:25:d1:96:3c:1c:cf:18Signer

Signature Validations

Verification

21/12/2009, 19:52 Valid: false

Headers

File Characteristics

Imports

msvfw32

winmm

mfc80u

msvcr80

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

oleaut32

msvcp80

version

ws2_32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 278KB - Virtual size: 277KB

.data Size: 104KB - Virtual size: 125KB

.rsrc Size: 379KB - Virtual size: 379KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

62:66:cc:1b:6d:1f:5c:82:76:61:a2:53:31:36:fd:9e
Certificate

ec:39:f6:c7:dc:b6:c5:30:79:98:c9:0e:6b:25:d1:96:3c:1c:cf:18
Signer

21/12/2009, 19:52
Valid: false

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 278KB - Virtual size: 277KB

.data
Size: 104KB - Virtual size: 125KB

.rsrc
Size: 379KB - Virtual size: 379KB