b0407777f0925d4f37da720f86c87937756244990017d004e05ef7f7dcb22a56

Sharing

Copy URL Twitter E-mail

General

Target

b0407777f0925d4f37da720f86c87937756244990017d004e05ef7f7dcb22a56
Size

781KB
MD5

425d19f53046d5aa2866e3afb315bd1b
SHA1

8820677b541cbf5ce4cd29942c2cffa9f751c080
SHA256

b0407777f0925d4f37da720f86c87937756244990017d004e05ef7f7dcb22a56
SHA512

f5f7ee802100f61724d5ae4aa261b336146176c15c81a4e338f593f961fe4fde16441421a6713503ecd1be6655ebc7c115fdbe4f8ce9b9aa399d61ab54340a60
SSDEEP

12288:2U/HIeydIGfRZdQ9uz7cAPY0MSrpL8LpVIK/DXqjnvcL7mdpOGHKWaguSywl1F0E:pgkPnXqTXd/juSyG0uHWm91TElIBR

Score

N/A

Malware Config

Signatures

Files

b0407777f0925d4f37da720f86c87937756244990017d004e05ef7f7dcb22a56
.exe windows x86

f606d4de61806b5bb24a45078ee7b42b

Code Sign

4c:17:93:4d
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

09/12/2014, 20:07

Not After

10/12/2017, 07:56

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:63:e2:e2
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

10/09/2009, 21:59

Not After

10/09/2019, 22:29

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:0e:8c:3a
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

11/11/2011, 15:41

Not After

12/11/2021, 08:51

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:17:40:9a
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

21/03/2013, 11:41

Not After

21/03/2016, 18:35

Subject

CN=Microgaming Software Systems Limited,O=Microgaming Software Systems Limited,L=Douglas,ST=Isle of Man,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:d4:47:d9:3f:0f:af:fc:74:f6:84:b3:68:88:75:e2:7f:ea:90:c8
Signer

Actual PE Digest

ef:d4:47:d9:3f:0f:af:fc:74:f6:84:b3:68:88:75:e2:7f:ea:90:c8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microgaming Software Systems Limited,O=Microgaming Software Systems Limited,L=Douglas,ST=Isle of Man,C=GB

18/05/2015, 11:24
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
lstrlenW
CreateDirectoryA
FindFirstFileA
FindClose
GetModuleFileNameA
FindNextFileA
lstrcpyA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
CreateProcessW
OpenProcess
Sleep
CreateProcessA
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetTempFileNameA
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetComputerNameA
FormatMessageA
GetVolumePathNameW
CopyFileW
FormatMessageW
RemoveDirectoryW
GetModuleHandleA
ReleaseMutex
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileW
SetFileAttributesW
GetPrivateProfileStringW
LoadLibraryA
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
DeviceIoControl
ResetEvent
InterlockedDecrement
MoveFileExA
Process32First
TerminateProcess
GetSystemDirectoryA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
InterlockedIncrement
GetPrivateProfileIntA
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
GetCurrentThreadId
CreateSemaphoreA
ReleaseSemaphore
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetSystemInfo
GetEnvironmentVariableA
GetFileAttributesW
GetCurrentThread
GetThreadTimes
ResumeThread
InterlockedCompareExchange
QueueUserWorkItem
OpenFileMappingA
lstrcatA
InitializeCriticalSection
CompareStringW
GetProcessHeap
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
GetTimeZoneInformation
LCMapStringW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapSize
HeapCreate
IsProcessorFeaturePresent
GetStdHandle
GetFileType
WriteConsoleW
MoveFileA
RaiseException
RtlUnwind
GetFullPathNameA
GetDriveTypeW
SetCurrentDirectoryA
GetCurrentDirectoryA
SetEnvironmentVariableA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpynW
GetFileAttributesA
lstrcpynA
lstrlenA
GetFileSize
LocalFree
GetProcAddress
CreateFileW
MultiByteToWideChar
LoadLibraryW
CreateDirectoryW
FreeLibrary
InterlockedPushEntrySList
WaitForSingleObject
InterlockedFlushSList
InterlockedPopEntrySList
InitializeSListHead
CloseHandle
ReadFile
WriteFile
SetFilePointer
CreateFileA
CreateThread
OutputDebugStringA
GetLastError
CreateEventA
SetEvent
SetThreadPriority
GetStartupInfoW
HeapSetInformation
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleW
HeapAlloc
DecodePointer
EncodePointer
HeapFree
SetFileAttributesA

user32

SetFocus
MessageBoxA
SetWindowTextA
PostMessageA
RegisterClassA
ShowWindow
DefWindowProcA
CreateWindowExA
FlashWindowEx
MoveWindow
CopyRect
GetDlgCtrlID
LoadCursorA
AdjustWindowRect
EnableWindow
UpdateWindow
MapWindowPoints
LoadImageA
IsWindowVisible
GetSystemMetrics
RegisterClassW
MessageBoxW
DispatchMessageA
wsprintfW
InvalidateRect
GetMessageA
PostThreadMessageA
wsprintfA
DefWindowProcW
CreateWindowExW
CreatePopupMenu
SetLayeredWindowAttributes
GetCursorPos
SetWindowPos
SetWindowLongW
ReleaseDC
AppendMenuW
GetWindowLongW
SetWindowLongA
OffsetRect
ChildWindowFromPoint
TranslateMessage
IsDialogMessageA
SendMessageA
GetClientRect
IsWindowEnabled
LoadIconA
SetForegroundWindow
GetWindowDC
TrackPopupMenu
PeekMessageA
GetActiveWindow
wvsprintfA
SendMessageTimeoutA
DestroyWindow
GetWindowRect

gdi32

DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
GetStockObject
BitBlt

advapi32

RegCreateKeyExA
RegEnumKeyW
OpenSCManagerA
CloseServiceHandle
OpenServiceA
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueW
RegSetValueA
RegQueryValueW
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
FreeSid
SetEntriesInAclW

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA
SHGetPathFromIDListW
SHGetFolderPathW
SHGetMalloc
SHChangeNotify
SHGetSpecialFolderLocation

ole32

CoCreateInstance
OleUninitialize
OleInitialize
CLSIDFromProgID
CoTaskMemFree
StringFromIID
CoCreateGuid
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleSetContainedObject
OleCreate

oleaut32

VariantTimeToSystemTime
VariantCopy
VariantChangeType
SysStringLen
SafeArrayUnaccessData
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
SafeArrayCreateVector
SafeArrayAccessData
VariantInit

wsock32

closesocket
inet_addr
htonl
socket
WSAGetLastError
ntohs
getservbyport
getservbyname
send
WSAStartup
WSACleanup
WSASetLastError
gethostbyaddr
connect
ioctlsocket
htons
gethostbyname

ws2_32

WSAAddressToStringA

wininet

InternetCrackUrlA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
InternetOpenUrlA
InternetCreateUrlA
InternetOpenW
InternetOpenUrlW
InternetConnectA
InternetQueryOptionA
InternetOpenA
InternetCrackUrlW

shlwapi

PathAppendA
SHDeleteKeyA
PathCanonicalizeW
PathAppendW
StrStrA
PathCanonicalizeA

psapi

GetModuleFileNameExA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

urlmon

CoInternetGetSession

Exports

Exports

?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
?CreateMacAddress@@YGPAVIMacAddress@@XZ
?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ
?CreateOSInfo@@YGPAVIOSInfo@@XZ
?CreateProcessorsInfo@@YGPAVIProcessorsInfo@@XZ
?CreateRamInfo@@YGPAVIRamInfo@@XZ
?CreateSoundDevicesInfo@@YGPAVISoundDevicesInfo@@XZ
?CreateUserExperience@@YGPAVIUserExperience@@XZ
?CreateVMInfo@@YGPAVIVMInfo@@XZ

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f606d4de61806b5bb24a45078ee7b42b

Code Sign

4c:17:93:4dCertificate

Extended Key Usages

Key Usages

38:63:e2:e2Certificate

Key Usages

4c:0e:8c:3aCertificate

Key Usages

4c:17:40:9aCertificate

Extended Key Usages

Key Usages

ef:d4:47:d9:3f:0f:af:fc:74:f6:84:b3:68:88:75:e2:7f:ea:90:c8Signer

Signature Validations

Verification

18/05/2015, 11:24 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

ws2_32

wininet

shlwapi

psapi

version

urlmon

Exports

Exports

Sections

.text Size: 446KB - Virtual size: 445KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 84KB - Virtual size: 103KB

.rsrc Size: 4KB - Virtual size: 3KB

4c:17:93:4d
Certificate

38:63:e2:e2
Certificate

4c:0e:8c:3a
Certificate

4c:17:40:9a
Certificate

ef:d4:47:d9:3f:0f:af:fc:74:f6:84:b3:68:88:75:e2:7f:ea:90:c8
Signer

18/05/2015, 11:24
Valid: false

.text
Size: 446KB - Virtual size: 445KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 84KB - Virtual size: 103KB

.rsrc
Size: 4KB - Virtual size: 3KB