e0a1123a9c26a8deb3de248ca353dcc6fc8242e60879c0644358657e20196fb6

Sharing

Copy URL

Twitter E-mail

General

Target

e0a1123a9c26a8deb3de248ca353dcc6fc8242e60879c0644358657e20196fb6
Size

124KB
MD5

3d4fa4ae78fcf04a9cc6318ea6146fe3
SHA1

33dbe8d56b3077fa18ec9ac780f19ba38d062d61
SHA256

e0a1123a9c26a8deb3de248ca353dcc6fc8242e60879c0644358657e20196fb6
SHA512

a790c808c3c68bd6c37492cea0bd3c072b478eef23dec1a6ddc8e04573ff792bf396242fa10084da9eaab1995bac8102e451d465bf5229922402c4f6617e40cb
SSDEEP

3072:cBgPxgTwX94zLsb2kj2dGQhJ1lE+PKNJP6LPW:agJgTwX92ytSdGQAhWPW

Score

N/A

Malware Config

Signatures

Files

e0a1123a9c26a8deb3de248ca353dcc6fc8242e60879c0644358657e20196fb6
.exe windows x86

220e05aceb39b24adf5a7e06a03a6699

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:4d:09:d5:0f:29:97:42:52:72:b7:97:aa:28:a5:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23-06-2009 00:00

Not After

22-07-2012 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dc:3b:88:df:29:e3:33:34:11:b2:1d:8f:f8:9c:16:e9:e7:67:40:6d
Signer

Actual PE Digest

dc:3b:88:df:29:e3:33:34:11:b2:1d:8f:f8:9c:16:e9:e7:67:40:6d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Rising Information Technology Corporation Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

12-03-2010 02:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
FreeLibrary
lstrlenW
lstrlenA
GetModuleFileNameA
GetCurrentThreadId
GetProcAddress
LoadLibraryA
lstrcatA
lstrcpyA
InterlockedIncrement
InterlockedDecrement
lstrcpynA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetModuleHandleA
GetLastError
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
GetSystemInfo
SetUnhandledExceptionFilter
FormatMessageA
CloseHandle
GetCurrentProcess
DeleteCriticalSection
SuspendThread
WriteFile
VirtualQuery
GetCurrentThread
GetProcessWorkingSetSize
GlobalMemoryStatus
GetLocalTime
CreateFileA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
FlushFileBuffers
SetStdHandle
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
SetFilePointer
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetCurrentProcessId
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
IsBadWritePtr

user32

DestroyWindow
CharNextA
DefWindowProcA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey

ole32

CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathRemoveExtensionA

comctl32

InitCommonControlsEx

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

220e05aceb39b24adf5a7e06a03a6699

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

48:4d:09:d5:0f:29:97:42:52:72:b7:97:aa:28:a5:57Certificate

Extended Key Usages

Key Usages

dc:3b:88:df:29:e3:33:34:11:b2:1d:8f:f8:9c:16:e9:e7:67:40:6dSigner

Signature Validations

Verification

12-03-2010 02:00 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

version

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 28KB - Virtual size: 24KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

48:4d:09:d5:0f:29:97:42:52:72:b7:97:aa:28:a5:57
Certificate

dc:3b:88:df:29:e3:33:34:11:b2:1d:8f:f8:9c:16:e9:e7:67:40:6d
Signer

12-03-2010 02:00
Valid: false

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 28KB - Virtual size: 24KB