af9f43331ea6e6a49f6f56a1e7066660be0f2b0fa81166194a7ca2ca697d9487

Sharing

Copy URL Twitter E-mail

General

Target

af9f43331ea6e6a49f6f56a1e7066660be0f2b0fa81166194a7ca2ca697d9487
Size

2.4MB
MD5

4900c00e013a54711a8bf77002d6ad3a
SHA1

d29c71be334a8be84687c88cb71d4745224c5c38
SHA256

af9f43331ea6e6a49f6f56a1e7066660be0f2b0fa81166194a7ca2ca697d9487
SHA512

52748ae2462b875b724c08dc1837196d512e131f676a65aad4f866fbc1d10c6d0ea4fb06a7f2fa82e8cd5d1e50708ee3f7f1486275308b522f11575fa8d1cdc6
SSDEEP

49152:hl7QVMmS5hMQVUsJ14Y1ZHzHt+NyqQwRnXqQijmOquja0:hl7cS56QVUsDn1tR2vRnXMjmMr

Score

N/A

Malware Config

Signatures

Files

af9f43331ea6e6a49f6f56a1e7066660be0f2b0fa81166194a7ca2ca697d9487
.exe windows x86

7d1a8aba458df0f945a28b4163c44247

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:13:36:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:9a:9e:17:b5:0a:6f:b8:08:ed:e3:7b:51:f4:c7:74:7d:05:c3:d1
Signer

Actual PE Digest

ac:9a:9e:17:b5:0a:6f:b8:08:ed:e3:7b:51:f4:c7:74:7d:05:c3:d1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

13/04/2012, 17:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
getsockname
bind
closesocket
send
listen
accept
htonl
getservbyport
gethostbyaddr
inet_addr
getservbyname
htons
inet_ntoa
WSASetLastError
WSAStartup
ntohs
connect
WSAGetLastError
socket
gethostbyname

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

ImageList_SetBkColor
ImageList_Create
ord17
ImageList_Add
ImageList_GetIconSize
ImageList_GetIcon
ImageList_SetOverlayImage
CreateToolbarEx
CreateStatusWindowW
InitCommonControlsEx
ImageList_DrawEx
ImageList_Destroy
ImageList_ReplaceIcon

fltlib

FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort
FilterSendMessage

kernel32

GetFileSize
CreateFileW
CreateFileMappingW
SetEndOfFile
SetFilePointer
UnmapViewOfFile
TryEnterCriticalSection
MapViewOfFile
FormatMessageW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetNumberFormatW
GetVersion
WriteFile
ReadFile
SetThreadPriority
GetCurrentThread
ReleaseSemaphore
HeapSize
HeapAlloc
ExitProcess
WaitForMultipleObjects
CreateEventW
HeapFree
GetComputerNameA
ResetEvent
SetEvent
GlobalAlloc
QueryPerformanceCounter
HeapCreate
CreateSemaphoreW
HeapDestroy
GetFileAttributesExW
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetComputerNameW
OpenThread
GetThreadContext
GetCurrentProcessId
LoadLibraryA
GetSystemDirectoryA
FindClose
FindNextFileW
FindFirstFileW
SetEnvironmentVariableW
GetEnvironmentVariableW
ExpandEnvironmentStringsA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
GetStartupInfoA
GetCommandLineA
GetCurrentThreadId
ExitThread
HeapReAlloc
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetProcessHeap
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GlobalLock
GlobalUnlock
GetLocaleInfoW
CompareStringW
CreateProcessW
OpenProcess
LoadLibraryExW
EnumResourceNamesW
GlobalAddAtomW
FreeLibrary
MulDiv
VirtualFree
GetSystemInfo
GlobalMemoryStatusEx
GetVersionExW
GetFileAttributesW
GetFullPathNameW
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
LCMapStringA
LCMapStringW
GetCommandLineW
LocalAlloc
LocalFree
InterlockedIncrement
DeleteFileW
SetLastError
GetSystemDirectoryW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
FindResourceW
LoadResource
SizeofResource
LockResource
SetFileAttributesW
GetCurrentProcess
GetLastError
VirtualAlloc
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
Sleep
WaitForSingleObject
CloseHandle
GetTickCount
CreateThread
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
GetCPInfo
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
QueryPerformanceFrequency
GetACP

user32

DispatchMessageW
RegisterClassW
LoadBitmapW
DeleteMenu
InsertMenuW
DestroyMenu
KillTimer
PostQuitMessage
SetMenuInfo
SetMenuDefaultItem
CreatePopupMenu
InsertMenuItemW
GetMenuItemCount
GetMenuItemInfoW
GetMenu
CheckMenuItem
GetDlgItemInt
EqualRect
FlashWindowEx
IsWindowEnabled
IsWindowVisible
LoadMenuW
GetSubMenu
EnableMenuItem
TrackPopupMenu
SetDlgItemInt
MessageBeep
SetActiveWindow
GetDlgItemTextW
RegisterWindowMessageW
CheckRadioButton
CreateDialogParamW
ScreenToClient
GetClassNameW
DeferWindowPos
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
UnionRect
IsZoomed
DrawFrameControl
SetWindowTextA
SetWindowPlacement
GetWindowPlacement
GetWindow
GetShellWindow
GetActiveWindow
ClientToScreen
OpenClipboard
TranslateMessage
SetClipboardData
CloseClipboard
LoadImageW
FindWindowW
WaitForInputIdle
GetWindowThreadProcessId
IsIconic
FindWindowExW
SetFocus
CreateIconFromResourceEx
GetCapture
LoadAcceleratorsW
GetCursorPos
SetPropW
GetPropW
DestroyWindow
SetClassLongW
DestroyIcon
LoadIconW
CheckDlgButton
IsDlgButtonChecked
SetWindowPos
CallWindowProcW
OffsetRect
GetCursor
IsDialogMessageW
TranslateAcceleratorW
WindowFromPoint
GetWindowDC
GetClassLongW
GetUpdateRgn
GetKeyState
IntersectRect
GetScrollInfo
SetScrollInfo
MonitorFromPoint
GetMonitorInfoW
GetIconInfo
GetFocus
DrawIconEx
FrameRect
FillRect
PostMessageW
LoadStringW
SetCursor
InflateRect
DialogBoxIndirectParamW
MessageBoxW
GetDC
ReleaseDC
SetWindowTextW
SetTimer
UpdateWindow
DialogBoxParamW
GetSystemMetrics
GetAncestor
GetDesktopWindow
EnableWindow
GetWindowLongW
SetWindowLongW
EmptyClipboard
ScrollWindowEx
ChildWindowFromPoint
SetCapture
ReleaseCapture
InvalidateRect
BeginPaint
GetClientRect
GetWindowTextW
GetSysColorBrush
GetSysColor
DrawTextW
EndPaint
DefWindowProcW
LoadCursorW
RegisterClassExW
SendMessageW
ShowWindow
GetParent
MapWindowPoints
CreateWindowExW
GetDlgItem
GetWindowRect
MoveWindow
SetDlgItemTextW
EndDialog
PtInRect
GetMessageW
SetForegroundWindow

gdi32

SaveDC
SetROP2
Rectangle
RestoreDC
Polyline
CreateRectRgn
RectInRegion
CreateRectRgnIndirect
SelectClipRgn
GetBkMode
GetTextMetricsW
GdiFlush
GetPixel
SetPixel
CreateFontW
GetStockObject
CreateCompatibleBitmap
CreatePen
Polygon
MoveToEx
SetBkMode
GetObjectW
CreateFontIndirectW
GetBitmapBits
GetBkColor
CreateSolidBrush
GetDeviceCaps
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
SetBkColor
BitBlt
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
SetTextColor
LineTo

comdlg32

PrintDlgW
ChooseColorW
GetOpenFileNameW
FindTextW
ChooseFontW
GetSaveFileNameW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
ConvertStringSidToSidW
DuplicateTokenEx
AllocateAndInitializeSid
EqualSid
FreeSid
GetLengthSid
LookupAccountSidW
RegCreateKeyExW
RegSetValueW
RegEnumKeyW
GetTokenInformation
RegOpenKeyExW
MapGenericMask
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyW
RegCloseKey
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges

shell32

SHGetMalloc
SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderLocation
SHBrowseForFolderW
ShellExecuteExW
SHGetFileInfoW

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitialize
RegisterDragDrop
ReleaseStgMedium
OleInitialize
CreateBindCtx

oleaut32

SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringLen
VariantClear
VariantInit
SafeArrayGetElement
VariantChangeType
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantTimeToSystemTime
SysAllocStringLen
SysStringByteLen

shlwapi

SHAutoComplete

Sections

.text
Size: 826KB - Virtual size: 825KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d1a8aba458df0f945a28b4163c44247

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:05:13:36:00:00:00:00:00:1aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

ac:9a:9e:17:b5:0a:6f:b8:08:ed:e3:7b:51:f4:c7:74:7d:05:c3:d1Signer

Signature Validations

Verification

13/04/2012, 17:38 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

comctl32

fltlib

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 826KB - Virtual size: 825KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 16KB - Virtual size: 47KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 46KB - Virtual size: 46KB

61:19:cc:93:00:01:00:00:00:66
Certificate

61:05:13:36:00:00:00:00:00:1a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

ac:9a:9e:17:b5:0a:6f:b8:08:ed:e3:7b:51:f4:c7:74:7d:05:c3:d1
Signer

13/04/2012, 17:38
Valid: false

.text
Size: 826KB - Virtual size: 825KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 16KB - Virtual size: 47KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 46KB - Virtual size: 46KB