af39bbdb11735e54a440799dd6b8490bc7526936c6883c1917609636520c16aa

Sharing

Copy URL Twitter E-mail

General

Target

af39bbdb11735e54a440799dd6b8490bc7526936c6883c1917609636520c16aa
Size

371KB
MD5

64a5bbf68a8e9fd079dd109bbda73a4e
SHA1

172bc1e3c1727df362aab3f9488a446f8c02cde5
SHA256

af39bbdb11735e54a440799dd6b8490bc7526936c6883c1917609636520c16aa
SHA512

dd11f605979d18094456ab44e3d0eba315f2bfeae1b3516b8312256c601338b7b9bda0a6e51ea45fe9f4b305925e056e671670f2bc9f8dbc12d3776eca248c9a
SSDEEP

6144:k17J7IlbdnKE/+TOcScWHsgk368ak4jzMU+Qzg31QVBXiT7azQrxD:klEbdKE+ONegk367PBEQVBXs

Score

N/A

Malware Config

Signatures

Files

af39bbdb11735e54a440799dd6b8490bc7526936c6883c1917609636520c16aa
.dll regsvr32 windows x86

3eebe58d99fd89aac201fc9b9efdf0c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:47:d3:a8:09:46:19:69:96:c2:89:c8:52:ee:6d:d6:05:5b:33:5e
Signer

Actual PE Digest

51:47:d3:a8:09:46:19:69:96:c2:89:c8:52:ee:6d:d6:05:5b:33:5e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

01/12/2022, 14:35
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryW
GetSystemInfo
IsProcessorFeaturePresent
GetProcessHeap
GetCurrentProcessId
GetLocalTime
GlobalMemoryStatus
GetDiskFreeSpaceA
GetEnvironmentStringsW
GetEnvironmentStrings
lstrlenW
lstrlenA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
HeapFree
DeviceIoControl
GetVersionExA
GetModuleHandleW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
HeapAlloc
EnterCriticalSection
GetProcAddress
LoadLibraryA
CloseHandle
InterlockedCompareExchange
InterlockedExchange
Sleep
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA

msvcrt

calloc
malloc
_onexit
__dllonexit
_adjust_fdiv
_initterm
free
_vsnprintf
_winver
swscanf
??2@YAPAXI@Z
iswspace
wcscmp
??3@YAXPAX@Z
_except_handler3
ceil
_CIpow
_CIsqrt
_CIsin
_CIcos
wcstombs
memmove
_purecall
_swab

oleaut32

VariantInit
SysStringLen

advapi32

RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegSetValueA
RegCreateKeyExA

shlwapi

SHDeleteKeyA

msdmo

DMORegister
MoFreeMediaType
DMOUnregister
MoInitMediaType
MoCopyMediaType

ole32

CoTaskMemFree
CoTaskMemAlloc

Exports

Exports

CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT_DATA
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3eebe58d99fd89aac201fc9b9efdf0c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:0e:7d:a7:00:00:00:00:00:48Certificate

Extended Key Usages

Key Usages

51:47:d3:a8:09:46:19:69:96:c2:89:c8:52:ee:6d:d6:05:5b:33:5eSigner

Signature Validations

Verification

01/12/2022, 14:35 Valid: false

Headers

File Characteristics

Imports

kernel32

msvcrt

oleaut32

advapi32

shlwapi

msdmo

ole32

Exports

Exports

Sections

.text Size: 294KB - Virtual size: 293KB

RT_CODE Size: 36KB - Virtual size: 36KB

.data Size: 26KB - Virtual size: 27KB

RT_DATA Size: 512B - Virtual size: 64B

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 5KB - Virtual size: 4KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

51:47:d3:a8:09:46:19:69:96:c2:89:c8:52:ee:6d:d6:05:5b:33:5e
Signer

01/12/2022, 14:35
Valid: false

.text
Size: 294KB - Virtual size: 293KB

RT_CODE
Size: 36KB - Virtual size: 36KB

.data
Size: 26KB - Virtual size: 27KB

RT_DATA
Size: 512B - Virtual size: 64B

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 5KB - Virtual size: 4KB