e9402135241e6d152c6c5aa43939b357e43a2add61c9c5a26667898e3b9d9529

Sharing

Copy URL Twitter E-mail

General

Target

e9402135241e6d152c6c5aa43939b357e43a2add61c9c5a26667898e3b9d9529
Size

675KB
MD5

dbf1d3e449c8d563b9f6a6eb1baa6211
SHA1

ec669f6788c3decd5b7fc3a0322ac43189be6d1a
SHA256

e9402135241e6d152c6c5aa43939b357e43a2add61c9c5a26667898e3b9d9529
SHA512

8b99db1f17b887dfbe78a48068aa55833f345d5bd52d65418da6d16c1d6ac6e24f52c0aa96cf9862a3ecd5102daa87047dc8c8dbdb204e999417258933279fb3
SSDEEP

12288:PtvwYUi9WLBU458hVjs9n9ZsgpUplgTvCajnKZGIvKJ3mlzEDODD8e5e9Ci2EsIU:PtoYD9WL+W8Dop92gpciTpjnKUIv2QzB

Score

N/A

Malware Config

Signatures

Files

e9402135241e6d152c6c5aa43939b357e43a2add61c9c5a26667898e3b9d9529
.exe windows x86

1815204ee0bf94b8030cff0a06590581

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:a6:f4:55:13:b8:2b:2b:b3:1a:75:a7:93:4b:0c:15:15:0b:a2:17
Signer

Actual PE Digest

3b:a6:f4:55:13:b8:2b:2b:b3:1a:75:a7:93:4b:0c:15:15:0b:a2:17

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

13/06/2010, 03:04
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntA
GetModuleFileNameA
GetFileAttributesA
WritePrivateProfileStringA
CloseHandle
CreateDirectoryA
CreateFileA
ReadFile
OutputDebugStringA
SetFilePointer
WriteFile
FileTimeToSystemTime
SetEndOfFile
GetModuleHandleA
GetProcessTimes
GetCurrentProcess
FileTimeToLocalFileTime
LoadResource
LockResource
FreeResource
SizeofResource
GetTempPathA
FindResourceA
GetTickCount
LocalFileTimeToFileTime
SetFileAttributesA
GetLastError
SetFileTime
SystemTimeToFileTime
GetCurrentDirectoryA
InterlockedCompareExchange
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

user32

PostMessageA
wsprintfA
IsWindow

shell32

SHGetSpecialFolderPathA

msvcp80

?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

msvcr80

atoi
??_V@YAXPAX@Z
_unlink
_access
_chmod
rename
fopen
fwrite
_localtime64
fclose
_vsnprintf_s
_time64
_mbsstr
calloc
free
??2@YAPAXI@Z
malloc
__argv
sprintf_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
__argc
strftime
_mbsrchr
??3@YAXPAX@Z
strcpy_s
memcpy
__CxxFrameHandler3
_invalid_parameter_noinfo
memset

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 616KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1815204ee0bf94b8030cff0a06590581

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

3b:a6:f4:55:13:b8:2b:2b:b3:1a:75:a7:93:4b:0c:15:15:0b:a2:17Signer

Signature Validations

Verification

13/06/2010, 03:04 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

shell32

msvcp80

version

msvcr80

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 616KB - Virtual size: 612KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

3b:a6:f4:55:13:b8:2b:2b:b3:1a:75:a7:93:4b:0c:15:15:0b:a2:17
Signer

13/06/2010, 03:04
Valid: false

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 616KB - Virtual size: 612KB