cda1bfe77339b923dffff8a5fe616836982eed60afe7dc786451952f265b234d

Sharing

Copy URL Twitter E-mail

General

Target

cda1bfe77339b923dffff8a5fe616836982eed60afe7dc786451952f265b234d
Size

279KB
MD5

c1092023c739ad4b2ec42e50fdc8a6e9
SHA1

e78cb7410391d2c95d8597b9460fb10e6cdf172a
SHA256

cda1bfe77339b923dffff8a5fe616836982eed60afe7dc786451952f265b234d
SHA512

a05fed1b4b04c897efbe0c6d8108e4d7068d2b2f50bfc2927df221d60763743a2b9bde5701067c807faeb3c266a42bbb4836d0afce7aa3bf46524641b365fba2
SSDEEP

6144:IEIzTPn/I5EswVWAirYTvXhE8dvXSqQKdZYmmQSy3I9AX4ke:KPn/fWAaYTpEOSqvDYi3IiX4ke

Score

N/A

Malware Config

Signatures

Files

cda1bfe77339b923dffff8a5fe616836982eed60afe7dc786451952f265b234d
.exe windows x86

ba6a2681204c8eab97723ded13686108

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/01/2010, 00:00

Not After

24/01/2012, 23:59

Subject

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:45:7b:ba:37:7f:28:66:cf:7c:be:c6:9d:dd:86:1c:58:af:98:ec
Signer

Actual PE Digest

bb:45:7b:ba:37:7f:28:66:cf:7c:be:c6:9d:dd:86:1c:58:af:98:ec

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

07/05/2010, 16:02
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryW
GetProcAddress
GlobalFindAtomA
OpenWaitableTimerW
GetLastError
SetCalendarInfoW
GetTempFileNameW
CompareStringW
GetVersionExW
CreateFileMappingW
ExitProcess
EnumCalendarInfoW
GetSystemDefaultLCID
AddAtomA
GetCommandLineW
GetUserDefaultLangID
CreateSemaphoreA
GetEnvironmentStringsA
GetLocaleInfoA
OpenSemaphoreW
TlsAlloc
EnumDateFormatsA
lstrcpy

user32

RegisterClassExW
LoadCursorW
LoadMenuIndirectW
SendDlgItemMessageW
DestroyCursor
DestroyIcon
GetDesktopWindow
GetCaretPos
GetWindowRgn
GetDlgItemTextW
SetActiveWindow
RegisterWindowMessageA
DefWindowProcW
GetSubMenu
GetWindowLongA
GetClassInfoExA
RegisterClassExA
GetClassInfoW
CreateDesktopA
InsertMenuItemW
CharUpperA
CharPrevA
PostQuitMessage
CascadeWindows
DialogBoxIndirectParamA
CreateWindowExA
SetWindowTextA
GetWindowRect
SetTimer
CharNextW
MonitorFromWindow
GetDC
MoveWindow
AdjustWindowRect
CharLowerA
InvalidateRgn
PostMessageW
EnumWindows
GetActiveWindow
GetForegroundWindow
MonitorFromPoint
EnumDesktopWindows
CreateDialogParamA
IsWindowEnabled

gdi32

GetGlyphOutlineW
GetGlyphOutlineA
GetTextCharacterExtra
GetTextColor
GetRasterizerCaps
CreateEnhMetaFileW
ScaleViewportExtEx
PlayMetaFile
SetPaletteEntries
GetLogColorSpaceA
CombineRgn
EnumFontFamiliesA
BeginPath
PolyDraw

advapi32

RegCreateKeyExW
RegFlushKey
RegDeleteKeyA
RegEnumValueA
RegRestoreKeyA
RegSaveKeyA
RegOpenKeyA

shell32

SHGetFileInfoW

shlwapi

SHGetValueW

comdlg32

GetSaveFileNameW
ChooseFontW

ole32

CoGetCurrentProcess
CoGetMalloc
CreateErrorInfo
CoInitializeEx
CoUninitialize
CoFreeLibrary
CoGetInstanceFromIStorage
CoDeactivateObject

opengl32

glColor4ub
glVertex3f
glNormal3fv

ws2_32

sendto
getpeername
WSADuplicateSocketW
WSAGetLastError
gethostbyaddr
WSAStartup
WSARecvDisconnect
WSAIoctl
WSASendTo

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.KxzcP
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.oBV
Size: 1KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.HHAFm
Size: 2KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.WAK
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ZdJ
Size: 3KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uRPZK
Size: 1024B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HfWiUH
Size: 1KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FsOO
Size: 512B - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LdOe
Size: 1024B - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rG
Size: 1KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba6a2681204c8eab97723ded13686108

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

bb:45:7b:ba:37:7f:28:66:cf:7c:be:c6:9d:dd:86:1c:58:af:98:ecSigner

Signature Validations

Verification

07/05/2010, 16:02 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comdlg32

ole32

opengl32

ws2_32

Sections

.text Size: 11KB - Virtual size: 11KB

.KxzcP Size: 512B - Virtual size: 4KB

.oBV Size: 1KB - Virtual size: 44KB

.HHAFm Size: 2KB - Virtual size: 27KB

.WAK Size: 1024B - Virtual size: 8KB

.ZdJ Size: 3KB - Virtual size: 49KB

.uRPZK Size: 1024B - Virtual size: 13KB

.HfWiUH Size: 1KB - Virtual size: 18KB

.data Size: 14KB - Virtual size: 14KB

.FsOO Size: 512B - Virtual size: 13KB

.LdOe Size: 1024B - Virtual size: 38KB

.rG Size: 1KB - Virtual size: 235KB

.rsrc Size: 230KB - Virtual size: 229KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

bb:45:7b:ba:37:7f:28:66:cf:7c:be:c6:9d:dd:86:1c:58:af:98:ec
Signer

07/05/2010, 16:02
Valid: false

.text
Size: 11KB - Virtual size: 11KB

.KxzcP
Size: 512B - Virtual size: 4KB

.oBV
Size: 1KB - Virtual size: 44KB

.HHAFm
Size: 2KB - Virtual size: 27KB

.WAK
Size: 1024B - Virtual size: 8KB

.ZdJ
Size: 3KB - Virtual size: 49KB

.uRPZK
Size: 1024B - Virtual size: 13KB

.HfWiUH
Size: 1KB - Virtual size: 18KB

.data
Size: 14KB - Virtual size: 14KB

.FsOO
Size: 512B - Virtual size: 13KB

.LdOe
Size: 1024B - Virtual size: 38KB

.rG
Size: 1KB - Virtual size: 235KB

.rsrc
Size: 230KB - Virtual size: 229KB