af040199438743146a6b549b6f3588906a7d2d36d8a145584186c82c55e00d3c

Sharing

Copy URL

Twitter E-mail

General

Target

af040199438743146a6b549b6f3588906a7d2d36d8a145584186c82c55e00d3c
Size

3.7MB
MD5

5a69fea78966377a0affcdfd7beaa003
SHA1

adf89120cd04aa52b5fd5812b44368b926e78a45
SHA256

af040199438743146a6b549b6f3588906a7d2d36d8a145584186c82c55e00d3c
SHA512

f47d65f9e61dcd5f87decc4f99331d9f123b3f8e4ebd9b95e628c202cbdff397864e86ef4a8530e7ec4705b96b91a4da14914ede82865b5c6dbb26a33afaab3a
SSDEEP

49152:2nGjOjhrl7PsZ7sgJuBRkatiO+QeWBMrF0QD3I+y3OZJTSwvcTI9f/3rLrKxPKTp:A2Ojhli7fJuBRkatiO+bW2JUuGZKt

Score

N/A

Malware Config

Signatures

Files

af040199438743146a6b549b6f3588906a7d2d36d8a145584186c82c55e00d3c
.exe windows x86

cc28db7c37ee55b199577018eeb61d5c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05-11-2009 00:00

Not After

10-12-2010 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ff:cb:10:35:27:85:11:1c:8b:d3:2f:6a:bc:51:f6:fb:fa:c0:eb:79
Signer

Actual PE Digest

ff:cb:10:35:27:85:11:1c:8b:d3:2f:6a:bc:51:f6:fb:fa:c0:eb:79

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

13-07-2010 20:02
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoA

crypt32

CertFreeCertificateContext
CertVerifySubjectCertificateContext
CertFindCertificateInStore
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCloseStore

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

timeGetTime
timeEndPeriod
timeSetEvent
timeKillEvent
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveOutGetPosition
waveOutWrite
waveOutPrepareHeader
waveOutGetDevCapsA
waveInGetDevCapsA
waveOutGetNumDevs
waveInGetNumDevs
waveInStart
waveInAddBuffer
waveInStop
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeBeginPeriod
waveInOpen
timeGetDevCaps

oleaut32

SysFreeString

kernel32

SetWaitableTimer
CreateThread
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetFileAttributesA
GetSystemInfo
GetUserDefaultLangID
ExitThread
GlobalFree
GetFileAttributesW
WriteFile
SetFilePointer
CreateFileA
LockResource
LoadResource
FindResourceExA
FindResourceExW
GlobalAlloc
SetUnhandledExceptionFilter
GetTempPathA
GetCurrentProcess
GetCurrentProcessId
FindClose
FindNextFileA
FindFirstFileA
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
WideCharToMultiByte
CreateDirectoryA
ReadFile
GetFileSize
GetModuleFileNameA
CreateMutexA
WaitForSingleObject
GetCurrentDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
GetTempFileNameA
GetFullPathNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
lstrcpyA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
GlobalSize
GlobalLock
IsDBCSLeadByteEx
DeleteFileW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetModuleHandleA
ExitProcess
GetStartupInfoA
GetCommandLineA
GetProcessTimes
CreateEventA
SetEvent
ResetEvent
WaitForMultipleObjects
ReleaseSemaphore
VirtualFree
CreateSemaphoreA
VirtualAlloc
GetThreadPriority
GetSystemTimeAsFileTime
TerminateProcess
CreateWaitableTimerA
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
FreeLibrary
GetVersionExA
CreateProcessA
CloseHandle
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
SetErrorMode
HeapAlloc
LoadLibraryA
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
VirtualQuery
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
VirtualProtect
HeapDestroy
HeapCreate
HeapReAlloc
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
RtlUnwind
GetStringTypeA
GetStringTypeW
GetOEMCP
SetStdHandle
FlushFileBuffers
GetFileAttributesExA

user32

UnregisterClassA
GetWindowTextA
LoadStringW
MoveWindow
SetMenu
UpdateWindow
ShowWindow
EnumDisplaySettingsA
SetDlgItemTextA
SetDlgItemTextW
EnableWindow
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
GetWindowTextLengthW
PostQuitMessage
GetMenuStringA
GetMenuStringW
RegisterClassA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
LoadAcceleratorsA
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
GetWindow
RemoveMenu
InsertMenuW
InsertMenuA
EmptyClipboard
SetClipboardData
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
RegisterClipboardFormatA
GetWindowLongA
DefWindowProcA
IsWindow
CreateWindowExA
ReleaseCapture
GetCapture
SetCapture
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
WindowFromPoint
GetFocus
DestroyWindow
GetMenu
BeginPaint
EndPaint
LoadCursorA
SetCursor
GetCursorPos
ScreenToClient
GetClientRect
KillTimer
SetTimer
LoadMenuA
GetSubMenu
DestroyMenu
LoadStringA
EnableMenuItem
CheckMenuItem
InvalidateRect
MapVirtualKeyA
GetKeyState
GetForegroundWindow
WaitForInputIdle
DialogBoxParamW
DialogBoxParamA
MessageBoxA
SystemParametersInfoA
DialogBoxIndirectParamW
DialogBoxIndirectParamA
PostMessageA
EndDialog
SetWindowLongA
GetParent
GetWindowRect
GetDesktopWindow
SetWindowPos
LoadIconA
GetDlgItem
SendMessageA
SetWindowTextA
SetFocus
GetMenuItemCount
GetSystemMetrics
InsertMenuItemA
MonitorFromWindow
GetDC
ReleaseDC
FillRect
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
SendInput
GetKeyboardLayout
GetDoubleClickTime
GetMenuItemInfoA

gdi32

StretchBlt
SetStretchBltMode
GetStretchBltMode
SelectObject
RealizePalette
SelectPalette
CreateDIBSection
BitBlt
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
GetStockObject
CreateFontIndirectA
SetBkMode
SetTextAlign
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetTextMetricsA
GetTextAlign
GetBkMode
GetTextColor
CreateSolidBrush
SetTextCharacterExtra
GetClipRgn
CreateRectRgn
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
EndPage
BeginPath
EndPath
GetBkColor
CreatePen
GetTextExtentPoint32A
CreatePalette
GetSystemPaletteEntries
GetClipBox
LPtoDP
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
CreateDCA
GetObjectA
RestoreDC
SaveDC
SelectClipPath
PolyBezierTo
LineTo
MoveToEx
DeleteObject
SetBkColor
ExtTextOutA
DeleteDC
CreateCompatibleDC
GdiFlush
EnumFontFamiliesA
StartPage
SetPolyFillMode
GetPixel

comdlg32

GetSaveFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgA
GetOpenFileNameA
CommDlgExtendedError

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shell32

DragQueryFileA
SHGetSpecialFolderLocation
SHAppBarMessage
DragQueryFileW
SHBrowseForFolderA
DragAcceptFiles
SHGetPathFromIDListA

ole32

CoUninitialize
CoInitialize
CoFreeUnusedLibraries
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

ws2_32

WSAAddressToStringA
gethostname
select
ioctlsocket
ntohl
recvfrom
connect
getsockname
sendto
send
recv
WSASetLastError
ntohs
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSAStartup
WSASocketA
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
setsockopt

Exports

Exports

pcre_callout
pcre_compile
pcre_compile2
pcre_copy_named_substring
pcre_copy_substring
pcre_exec
pcre_free
pcre_free_substring
pcre_free_substring_list
pcre_fullinfo
pcre_get_named_substring
pcre_get_stringnumber
pcre_get_stringtable_entries
pcre_get_substring
pcre_get_substring_list
pcre_malloc
pcre_stack_free
pcre_stack_malloc

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 316KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc28db7c37ee55b199577018eeb61d5c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1Certificate

Extended Key Usages

Key Usages

ff:cb:10:35:27:85:11:1c:8b:d3:2f:6a:bc:51:f6:fb:fa:c0:eb:79Signer

Signature Validations

Verification

13-07-2010 20:02 Valid: false

Headers

File Characteristics

Imports

wininet

crypt32

version

winmm

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

ws2_32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 260KB - Virtual size: 259KB

.data Size: 196KB - Virtual size: 1.0MB

.rodata Size: 4KB - Virtual size: 192B

.rsrc Size: 316KB - Virtual size: 314KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

ff:cb:10:35:27:85:11:1c:8b:d3:2f:6a:bc:51:f6:fb:fa:c0:eb:79
Signer

13-07-2010 20:02
Valid: false

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 260KB - Virtual size: 259KB

.data
Size: 196KB - Virtual size: 1.0MB

.rodata
Size: 4KB - Virtual size: 192B

.rsrc
Size: 316KB - Virtual size: 314KB