3ba0e68a9715579444dbefecb931f94fa5fb864a3968043787c504d96218a0c4

Sharing

Copy URL

Twitter E-mail

General

Target

3ba0e68a9715579444dbefecb931f94fa5fb864a3968043787c504d96218a0c4
Size

237KB
MD5

263de12c4e68d4606a55b94d849f4ea0
SHA1

04466f80a303e0d1b5aeab53f7fd37f87f204d0c
SHA256

3ba0e68a9715579444dbefecb931f94fa5fb864a3968043787c504d96218a0c4
SHA512

93cbfd3e3f4cb0f62ca31afe5bb073171400d780ef427bc16e4da4da37102e1af1e2922f64e1a0e6c39107b02055d6a7146964ae2133c5c7e681edbd35d69be4
SSDEEP

6144:PGVn7PAye/11ovzIddiGfIb1r/RpUnnZNf1CYJ28ch:PGVw11C8n1fY/XsnZNf1jDE

Score

N/A

Malware Config

Signatures

Files

3ba0e68a9715579444dbefecb931f94fa5fb864a3968043787c504d96218a0c4
.exe windows x86

394079c5dc11e67365da781b181a13c1

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/01/2010, 00:00

Not After

24/01/2012, 23:59

Subject

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c3:eb:7f:fe:7e:d9:e8:7a:a7:3d:1f:1f:94:ca:6c:4a:09:63:05:01
Signer

Actual PE Digest

c3:eb:7f:fe:7e:d9:e8:7a:a7:3d:1f:1f:94:ca:6c:4a:09:63:05:01

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BITDEFENDER LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BITDEFENDER LLC,L=Fort Lauderdale,ST=Florida,C=US

07/05/2010, 16:02
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
CreateNamedPipeA
GetModuleFileNameW
SetComputerNameW
LoadLibraryA
lstrcpyA
GetCurrentProcess
GetTempPathW
DisconnectNamedPipe
GetUserDefaultLCID
MoveFileA
GetExitCodeProcess
GetCPInfo
GetCurrentDirectoryA
IsBadWritePtr
GetProcAddress
OpenFile
WaitForMultipleObjects
QueryPerformanceFrequency
SetUnhandledExceptionFilter
ReadDirectoryChangesW
IsBadReadPtr
GetNumberFormatA
CreateMutexW
ReplaceFileA
SetLocaleInfoW
GetWindowsDirectoryW

user32

LoadIconA
InsertMenuItemW
LoadMenuW
LoadMenuIndirectW
DefWindowProcW
SetCursor
CopyIcon
IsMenu
SetActiveWindow
GetMenuStringW
GetKeyboardType
GetMenuItemRect
SetCapture
GetDlgItemInt
TrackPopupMenuEx
SetWindowRgn
SetTimer
LoadCursorA
MonitorFromRect
LoadMenuIndirectA
DestroyIcon
EndDialog
CharLowerW
GetActiveWindow
LoadCursorW
GetActiveWindow
EnableMenuItem
IsDlgButtonChecked
GetClassInfoA
SetDlgItemInt
SetForegroundWindow
LoadIconW
GetCapture
GetMenuItemCount
MessageBoxIndirectW
MonitorFromWindow
keybd_event
ActivateKeyboardLayout
SetWindowTextW
GetCursorPos
CreateDialogParamW
RemoveMenu
CopyRect
CreateDesktopW
SetMenu

gdi32

CreateFontIndirectExA
CreateBrushIndirect
CreateDIBPatternBrushPt
CreateSolidBrush
SetWinMetaFileBits
GetRasterizerCaps
CreateBitmapIndirect
CreateDIBPatternBrush

urlmon

GetMarkOfTheWeb
CoInternetGetSession
CoInternetCreateSecurityManager
FindMediaType
CoInternetGetProtocolFlags
DllRegisterServerEx
Extract

winmm

waveOutMessage
mciSendCommandW
waveOutUnprepareHeader

winspool.drv

AddPrinterDriverExA
AddFormW
EnumPrinterKeyA
GetPrinterA
EnumPrinterDataA
EnumPrinterDataExA
AddPrintProvidorW

Sections

.S
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Aw
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uTfR
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.n
Size: 3KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zmETW
Size: 3KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kNMes
Size: 4KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vPhZMc
Size: 4KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ECVPv
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Br
Size: 13KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

394079c5dc11e67365da781b181a13c1

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

c3:eb:7f:fe:7e:d9:e8:7a:a7:3d:1f:1f:94:ca:6c:4a:09:63:05:01Signer

Signature Validations

Verification

07/05/2010, 16:02 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

urlmon

winmm

winspool.drv

Sections

.S Size: 7KB - Virtual size: 6KB

.Aw Size: 86KB - Virtual size: 86KB

.uTfR Size: 13KB - Virtual size: 13KB

.n Size: 3KB - Virtual size: 279KB

.zmETW Size: 3KB - Virtual size: 49KB

.kNMes Size: 4KB - Virtual size: 315KB

.vPhZMc Size: 4KB - Virtual size: 34KB

.ECVPv Size: 84KB - Virtual size: 84KB

.Br Size: 13KB - Virtual size: 44KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 1024B - Virtual size: 1024B

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1c:2d:d6:1a:35:e6:5d:f6:29:97:01:ff:9b:e5:ca:44
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

c3:eb:7f:fe:7e:d9:e8:7a:a7:3d:1f:1f:94:ca:6c:4a:09:63:05:01
Signer

07/05/2010, 16:02
Valid: false

.S
Size: 7KB - Virtual size: 6KB

.Aw
Size: 86KB - Virtual size: 86KB

.uTfR
Size: 13KB - Virtual size: 13KB

.n
Size: 3KB - Virtual size: 279KB

.zmETW
Size: 3KB - Virtual size: 49KB

.kNMes
Size: 4KB - Virtual size: 315KB

.vPhZMc
Size: 4KB - Virtual size: 34KB

.ECVPv
Size: 84KB - Virtual size: 84KB

.Br
Size: 13KB - Virtual size: 44KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 1024B - Virtual size: 1024B