e53b00a47e66f6bfd28cc077cc489157564c7a5251b7e7067899ebaaf74e301a

Sharing

Copy URL Twitter E-mail

General

Target

e53b00a47e66f6bfd28cc077cc489157564c7a5251b7e7067899ebaaf74e301a
Size

1.1MB
MD5

efae6e52c6744b29b03275a0f72f2585
SHA1

c228076bfd2c4ab61d19b3e455852dd2a5512e34
SHA256

e53b00a47e66f6bfd28cc077cc489157564c7a5251b7e7067899ebaaf74e301a
SHA512

b4efed84c0d6d0edd1eb3ebfff234df60f51b25f89dd1c0a31cc84ec6a2839ea793014ab80d5f9f676aacc59ebd69a0a76e400b459b1386ad87ccb59335eb2db
SSDEEP

6144:2+yk8EET+o0QHBZgguClX/cLR6nrwzI00dM+D7viWDEeYbr4inMvWBR/IzH6/KrF:21krdTE8LA4HoIE

Score

N/A

Malware Config

Signatures

Files

e53b00a47e66f6bfd28cc077cc489157564c7a5251b7e7067899ebaaf74e301a
.exe windows x86

03dbfa741d22c1d18fc13609d769ad58

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b5:ed:47:93:c9:4e:41:e8:fe:5c:71:6c:a9:8c:3b:32
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30/08/2012, 00:00

Not After

30/08/2013, 23:59

Subject

CN=Ts Security System - Seguranc a em Sistemas Ltda,OU=winmonitor,O=Ts Security System - Seguranc a em Sistemas Ltda,POSTALCODE=14801280,STREET=Rua Major Carvalho Filho 1321 Casa a,L=Araraquara,ST=São Paulo,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d0:7d:d9:3d:9c:9e:44:ec:c5:e9:94:c0:d7:64:5d:8d:cf:29:64:1c
Signer

Actual PE Digest

d0:7d:d9:3d:9c:9e:44:ec:c5:e9:94:c0:d7:64:5d:8d:cf:29:64:1c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ts Security System - Seguranc a em Sistemas Ltda,OU=winmonitor,O=Ts Security System - Seguranc a em Sistemas Ltda,POSTALCODE=14801280,STREET=Rua Major Carvalho Filho 1321 Casa a,L=Araraquara,ST=São Paulo,C=BR

30/08/2012, 13:33
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CreateStreamOnHGlobal

gdiplus

GdipCreateHBITMAPFromBitmap

msvbvm60

ord588
MethCallEngine
ord621
ord516
ord517
ord518
ord626
ord519
ord553
ord660
ord661
ord662
ord558
ord666
ord667
ord593
ord300
ord594
ord301
ord595
ord302
ord303
ord702
ord304
ord598
ord306
ord520
ord307
ord308
ord309
ord631
ord709
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord529
ord561
DllFunctionCall
ord563
ord670
ord568
EVENT_SINK_Release
ord600
ord601
ord310
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord312
ord711
ord712
ord713
ord606
ord607
ord608
ord717
ord532
ProcCallEngine
ord535
ord644
ord537
ord645
ord570
ord648
ord572
ord573
ord681
ord577
ord578
ord685
ord100
ord579
ord610
ord612
ord616
ord617
ord619
ord542
ord650
ord543
ord544
ord545
ord546
ord547
ord580
ord581

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03dbfa741d22c1d18fc13609d769ad58

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

b5:ed:47:93:c9:4e:41:e8:fe:5c:71:6c:a9:8c:3b:32Certificate

Extended Key Usages

Key Usages

d0:7d:d9:3d:9c:9e:44:ec:c5:e9:94:c0:d7:64:5d:8d:cf:29:64:1cSigner

Signature Validations

Verification

30/08/2012, 13:33 Valid: false

Headers

File Characteristics

Imports

ole32

gdiplus

msvbvm60

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.data Size: - Virtual size: 31KB

.rsrc Size: 4KB - Virtual size: 2KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

b5:ed:47:93:c9:4e:41:e8:fe:5c:71:6c:a9:8c:3b:32
Certificate

d0:7d:d9:3d:9c:9e:44:ec:c5:e9:94:c0:d7:64:5d:8d:cf:29:64:1c
Signer

30/08/2012, 13:33
Valid: false

.text
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: - Virtual size: 31KB

.rsrc
Size: 4KB - Virtual size: 2KB