0a3f59040b0b856d7888f4aa2ec229f506b82c4db62470e1d1b76b34eb49af3f

Sharing

Copy URL Twitter E-mail

General

Target

0a3f59040b0b856d7888f4aa2ec229f506b82c4db62470e1d1b76b34eb49af3f
Size

14KB
MD5

1c925be223a5c0f9f469252292a48df6
SHA1

34558e1a4fe2f58f72c84c0a3711f1d75f56de21
SHA256

0a3f59040b0b856d7888f4aa2ec229f506b82c4db62470e1d1b76b34eb49af3f
SHA512

cad3f7c19ad682c61daf2b91b16c16be260c64c88d13577524bf740fa0f1512ee1fc7c30ee2906655f281a649150d5c7034521d138d5b637498b76eebc6d8d25
SSDEEP

192:C7pYY5FhP5EqZ6QeI7YbbbmzdU+nsMyowJL/T7hb+ebCf9JQpkqs1I5Zgjl5Ln+C:KN5FhPeDQtYbbbmzdmMYJLJNbCL1M6j5

Score

N/A

Malware Config

Signatures

Files

0a3f59040b0b856d7888f4aa2ec229f506b82c4db62470e1d1b76b34eb49af3f
.exe windows x86

8087248d407428b531434f2a866cdb6a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:59:50:77:d5:ac:92:75:f3:9d:aa:a0:ed:6a:f2:bd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/01/2010, 00:00

Not After

03/02/2012, 23:59

Subject

CN=MCCI Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MCCI Corporation,L=Ithaca,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:4a:03:73:d5:ea:54:da:4a:4b:e5:3c:dd:ec:ec:f0:c0:93:48:54
Signer

Actual PE Digest

ed:4a:03:73:d5:ea:54:da:4a:4b:e5:3c:dd:ec:ec:f0:c0:93:48:54

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=MCCI Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MCCI Corporation,L=Ithaca,ST=New York,C=US

11/11/2010, 15:11
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeInitializeEvent
IoCreateDevice
IoGetAttachedDeviceReference
IofCallDriver
IoAcquireCancelSpinLock
IofCompleteRequest
KeSetEvent
IoInitializeRemoveLockEx
InterlockedIncrement
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
InterlockedDecrement
IoReleaseRemoveLockAndWaitEx
KeResetEvent
ExFreePool
KeInitializeSpinLock
ExAllocatePoolWithTag
RtlInitUnicodeString
ZwClose
IoOpenDeviceRegistryKey
KeDelayExecutionThread
KeQueryTimeIncrement
KeWaitForSingleObject
InterlockedExchange
KefAcquireSpinLockAtDpcLevel
IoReleaseCancelSpinLock
PoStartNextPowerIrp
PoCallDriver
IoFreeIrp
IoAllocateIrp
IoDetachDevice
IoAttachDeviceToDeviceStack
IoDeleteDevice
ZwQueryValueKey
ObfDereferenceObject

hal

KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8087248d407428b531434f2a866cdb6a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0e:59:50:77:d5:ac:92:75:f3:9d:aa:a0:ed:6a:f2:bdCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

ed:4a:03:73:d5:ea:54:da:4a:4b:e5:3c:dd:ec:ec:f0:c0:93:48:54Signer

Signature Validations

Verification

11/11/2010, 15:11 Valid: false

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 404B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 384B - Virtual size: 294B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:59:50:77:d5:ac:92:75:f3:9d:aa:a0:ed:6a:f2:bd
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

ed:4a:03:73:d5:ea:54:da:4a:4b:e5:3c:dd:ec:ec:f0:c0:93:48:54
Signer

11/11/2010, 15:11
Valid: false

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 404B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 384B - Virtual size: 294B