ec558d507bae68525e16d3fb97944210a3dede08fb868f10a2ace98f3225c25f

Sharing

Copy URL Twitter E-mail

General

Target

ec558d507bae68525e16d3fb97944210a3dede08fb868f10a2ace98f3225c25f
Size

20KB
MD5

898974d6f3e2fdfe9b47f1f187b052eb
SHA1

118c8c3b23582880dac58c8d0188ac7e413ebcee
SHA256

ec558d507bae68525e16d3fb97944210a3dede08fb868f10a2ace98f3225c25f
SHA512

de0e7dc20cfb2d0b43847ce97efba27c295702740ea523fa4265b8c21fcb01afb54482933e7f6f98a54828886d8a0913cc4c6692f13f098a49319f568ba9d3d6
SSDEEP

192:Syzt31koaiK3oDyowJL/7FbyvcfXNt7xDyowJL/7FbyvcfXNt7g:3BlK3oDYJLhGcf9tdDYJLhGcf9t0

Score

N/A

Malware Config

Signatures

Files

ec558d507bae68525e16d3fb97944210a3dede08fb868f10a2ace98f3225c25f
.exe windows x64

6e771352086856abbfb3b2b06ef8a7cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=Agent,OU=Engineering,O=Rapid7,L=Austin,ST=Texas,C=US

Not Before

29/12/2011, 03:37

Not After

06/11/2021, 03:37

Subject

CN=AgentSigner,OU=Engineering,O=Rapid7 LLC,L=Austin,ST=Texas,C=US

4a:aa:a7:7d:b6:53:f1:ca:d3:7f:30:85:46:cb:08:6f:a5:6a:fa:bb
Signer

Actual PE Digest

4a:aa:a7:7d:b6:53:f1:ca:d3:7f:30:85:46:cb:08:6f:a5:6a:fa:bb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=AgentSigner,OU=Engineering,O=Rapid7 LLC,L=Austin,ST=Texas,C=US

29/12/2011, 07:13
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus

kernel32

ExitProcess
CloseHandle
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetThreadContext
CreateProcessA
ReadFile
SetFilePointer
VirtualAlloc
CreateFileA
GetModuleFileNameA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e771352086856abbfb3b2b06ef8a7cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

01Certificate

4a:aa:a7:7d:b6:53:f1:ca:d3:7f:30:85:46:cb:08:6f:a5:6a:fa:bbSigner

Signature Validations

Verification

29/12/2011, 07:13 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 740B

.data Size: - Virtual size: 48B

.pdata Size: 512B - Virtual size: 60B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

01
Certificate

4a:aa:a7:7d:b6:53:f1:ca:d3:7f:30:85:46:cb:08:6f:a5:6a:fa:bb
Signer

29/12/2011, 07:13
Valid: false

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 740B

.data
Size: - Virtual size: 48B

.pdata
Size: 512B - Virtual size: 60B