afc20ca559f57b48a02759ded958d4dbf1747321586d1dbf265f4ad82ca266dd

Sharing

Copy URL Twitter E-mail

General

Target

afc20ca559f57b48a02759ded958d4dbf1747321586d1dbf265f4ad82ca266dd
Size

330KB
MD5

3b2454b1b74dc594be1050898d370441
SHA1

b564d92aae661e970fd3f7e3b45da46e030798ec
SHA256

afc20ca559f57b48a02759ded958d4dbf1747321586d1dbf265f4ad82ca266dd
SHA512

b93af2109ab541c238c8943ad025955a1698521146f980cbadefbd011c591e187410a6bf138ba0bf7ca2a0c77b98491c2281e99bb088246800f1eb875b21d61a
SSDEEP

6144:qruJJccpdiCB6AGetJv0BaugoWeeUyB14gb0glMEnwNlsf43pW:qruJccOCB6ytJvsaurI14FgaUwNlppW

Score

N/A

Malware Config

Signatures

Files

afc20ca559f57b48a02759ded958d4dbf1747321586d1dbf265f4ad82ca266dd
.exe windows x86

cb333c622c75c4af0f58fe11e6733cbc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:5e:7b:2f:1d:4e:01:52:18:9f:63:81:e2:ba:8c:97
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

19/03/2013, 00:00

Not After

18/06/2015, 23:59

Subject

CN=Amonetize ltd.,O=Amonetize ltd.,L=Raanana,ST=Alberta,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

17:ae:4b:52:f5:e2:8c:9f:33:f4:70:e6:fa:8c:75:1d:35:b6:77:d5
Signer

Actual PE Digest

17:ae:4b:52:f5:e2:8c:9f:33:f4:70:e6:fa:8c:75:1d:35:b6:77:d5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Amonetize ltd.,O=Amonetize ltd.,L=Raanana,ST=Alberta,C=IL

06/02/2014, 15:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiW
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
lstrcmpW
MulDiv
GetModuleFileNameW
GlobalUnlock
GlobalLock
SetLastError
FreeLibrary
LoadLibraryExW
CreateThread
GlobalHandle
lstrlenA
CreateMutexW
ReleaseMutex
WaitForSingleObject
Sleep
CreateEventW
SetEvent
ExitProcess
LocalFree
GetCommandLineW
lstrcpyW
FreeResource
WaitForMultipleObjects
GetExitCodeProcess
TerminateProcess
GetProcessId
CreateDirectoryW
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
OutputDebugStringA
ReadFile
MoveFileW
DeleteFileW
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileStringW
LoadLibraryW
FindClose
FindFirstFileW
ExpandEnvironmentStringsW
SetEndOfFile
WriteConsoleW
GetModuleHandleW
FlushFileBuffers
SetStdHandle
LCMapStringW
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
HeapSize
GetStdHandle
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcAddress
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
GetTempFileNameW
CreateFileW
WriteFile
GetTickCount
GetCurrentThread
GlobalFree
GetCurrentProcessId
GetCurrentThreadId
GetLastError
CloseHandle
CreateFileA

user32

GetCursor
GetWindowThreadProcessId
GetSystemMetrics
CharNextW
GetWindowLongW
GetDesktopWindow
PostMessageW
SetWindowTextW
GetClientRect
ScreenToClient
KillTimer
SetActiveWindow
GetWindow
GetDlgItem
GetForegroundWindow
IsWindow
SetWindowLongW
EndDialog
PtInRect
CreateAcceleratorTableW
RegisterWindowMessageW
DialogBoxIndirectParamW
LoadIconW
MapDialogRect
SendDlgItemMessageW
SetWindowContextHelpId
PostThreadMessageW
TranslateMessage
DispatchMessageW
GetMessageW
GetShellWindow
CheckDlgButton
IsDlgButtonChecked
MessageBoxW
IsWindowVisible
InvalidateRect
DestroyWindow
SendMessageW
UnregisterClassA
MoveWindow
wsprintfW
GetActiveWindow
IsWindowUnicode
DefWindowProcW
GetWindowTextW
GetWindowTextLengthW
GetSysColor
SetWindowPos
ClientToScreen
GetDC
ReleaseDC
InvalidateRgn
RedrawWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetFocus
GetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
GetParent
IsChild
SetCapture

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
GetStockObject
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
BitBlt

advapi32

RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW

shell32

SHBrowseForFolderW
ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ExtractIconW
SHGetPathFromIDListW

ole32

CoAddRefServerProcess
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitialize
ProgIDFromCLSID
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CLSIDFromString
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoReleaseServerProcess

oleaut32

VariantCopy
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarUI4FromStr
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCopy
SysAllocString
SafeArrayGetVartype
VariantClear
SysStringLen
SysAllocStringLen
SysFreeString
VariantInit

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shlwapi

StrStrIW

winhttp

WinHttpQueryDataAvailable
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpConnect
WinHttpReadData
WinHttpSendRequest
WinHttpOpen
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCloseHandle

Sections

.text
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb333c622c75c4af0f58fe11e6733cbc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

23:5e:7b:2f:1d:4e:01:52:18:9f:63:81:e2:ba:8c:97Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

17:ae:4b:52:f5:e2:8c:9f:33:f4:70:e6:fa:8c:75:1d:35:b6:77:d5Signer

Signature Validations

Verification

06/02/2014, 15:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

shlwapi

winhttp

Sections

.text Size: 230KB - Virtual size: 229KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 10KB - Virtual size: 19KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 19KB - Virtual size: 18KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

23:5e:7b:2f:1d:4e:01:52:18:9f:63:81:e2:ba:8c:97
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

17:ae:4b:52:f5:e2:8c:9f:33:f4:70:e6:fa:8c:75:1d:35:b6:77:d5
Signer

06/02/2014, 15:39
Valid: false

.text
Size: 230KB - Virtual size: 229KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 10KB - Virtual size: 19KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 19KB - Virtual size: 18KB