a07d0a47c1f211e944b45233840c6cb38ff0006eb71d9185b97601bfe82617d2

Sharing

Copy URL Twitter E-mail

General

Target

a07d0a47c1f211e944b45233840c6cb38ff0006eb71d9185b97601bfe82617d2
Size

130KB
MD5

5c98a00a52537caeed5a71027c5b6f88
SHA1

b2f6a6cb5394f44a04e2d3d2ef9ec94be84d6460
SHA256

a07d0a47c1f211e944b45233840c6cb38ff0006eb71d9185b97601bfe82617d2
SHA512

14496839c1976be3ade2d05b7c35bb82dd54dc6d4425da85d08721d4f6d57263f7c3c6c31ecae79ed10a24d02edac0630ec731a2e6456d5840d2eab995e02623
SSDEEP

3072:FtRx0BQ5KGxaus0uTND/uPH5IpBzpqlPTFHS2N:NoQ5KC8TND/uv5cePTFy2N

Score

N/A

Malware Config

Signatures

Files

a07d0a47c1f211e944b45233840c6cb38ff0006eb71d9185b97601bfe82617d2
.exe windows x86

558e9859459d7f20106eda4a03be94cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09/04/2010, 00:00

Not After

09/04/2011, 23:59

Subject

CN=TrustPort,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TrustPort,L=Brno,ST=Morava,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:fc:29:4a:c3:b5:78:84:4c:ba:42:6f:3f:7e:14:82:b9:e9:5e:aa
Signer

Actual PE Digest

20:fc:29:4a:c3:b5:78:84:4c:ba:42:6f:3f:7e:14:82:b9:e9:5e:aa

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=TrustPort,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TrustPort,L=Brno,ST=Morava,C=CZ

06/09/2010, 05:32
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetComputerNameA
FindResourceA
VirtualAlloc
lstrcpyA
SetPriorityClass
GetAtomNameA
GlobalGetAtomNameW
OpenEventW
LocalAlloc
GetExpandedNameW

user32

SetParent
RemoveMenu
wvsprintfW
MessageBoxW
GetDesktopWindow
MoveWindow
InvalidateRgn
ClientToScreen
GetSysColor
SetCapture
CopyRect
RegisterWindowMessageW
GetMenuItemRect
ActivateKeyboardLayout
GetMessageA
CharPrevA
GetDlgItemInt
RegisterClassExA
GetDC
WaitForInputIdle
WaitMessage
SetCursorPos
CharUpperA
LoadCursorW
GetClientRect
FillRect
CreateDesktopA
SetDlgItemInt
GetClassLongA
RegisterClassA
GetClassInfoA
SetWindowTextA
GetMenuItemInfoW
FrameRect
GetKeyState
MonitorFromRect
GetWindowDC
GetDlgItemTextA

gdi32

GetCharABCWidthsW
GetWorldTransform
CreateBitmapIndirect
SetBkMode
CreateRoundRectRgn
SetTextColor
EnumFontFamiliesA
SetPolyFillMode
SetWorldTransform

advapi32

RegQueryValueExW
AddAuditAccessAceEx
AddAce
RegEnumKeyW
RegDeleteValueA

shell32

StrCmpNIA
StrStrA
ExtractIconExW
StrRChrIW
ExtractIconExA
SHGetFolderLocation
ExtractIconEx

shlwapi

PathMakeSystemFolderA
SHAutoComplete
SHDeleteOrphanKeyA
UrlIsNoHistoryW
SHRegEnumUSValueA
wvnsprintfW
PathAddBackslashW
PathCompactPathExA
StrToInt64ExA

comdlg32

PageSetupDlgA

ws2_32

WSAGetLastError
getprotobyname
getsockname
WSACleanup
gethostname
WSASend
WSAIoctl
WSACloseEvent
select

wininet

InternetSetCookieExA
InternetGetLastResponseInfoA
DeleteUrlCacheContainerW
SetUrlCacheEntryInfoA
UpdateUrlCacheContentPath
GetUrlCacheHeaderData
HttpSendRequestW
FindFirstUrlCacheEntryExA
InternetOpenW
InternetClearAllPerSiteCookieDecisions

Sections

.6-%`+
Size: 1KB - Virtual size: 36KB

IMAGE_SCN_MEM_READ

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.e+31-3
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_MEM_READ

.:6|[4
Size: 1KB - Virtual size: 42KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.6),,-
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_MEM_READ

.Mg-5
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..Z*\
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.818
Size: 1024B - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.\41[9
Size: 1024B - Virtual size: 35KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1#
Size: 1024B - Virtual size: 25KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

558e9859459d7f20106eda4a03be94cf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

20:fc:29:4a:c3:b5:78:84:4c:ba:42:6f:3f:7e:14:82:b9:e9:5e:aaSigner

Signature Validations

Verification

06/09/2010, 05:32 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comdlg32

ws2_32

wininet

Sections

.6-%`+ Size: 1KB - Virtual size: 36KB

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 3KB - Virtual size: 2KB

.e+31-3 Size: 1KB - Virtual size: 12KB

.:6|[4 Size: 1KB - Virtual size: 42KB

.6),,- Size: 1024B - Virtual size: 8KB

.Mg-5 Size: 1024B - Virtual size: 39KB

..Z*\ Size: 15KB - Virtual size: 16KB

.818 Size: 1024B - Virtual size: 39KB

.\41[9 Size: 1024B - Virtual size: 35KB

.1# Size: 1024B - Virtual size: 25KB

.rsrc Size: 77KB - Virtual size: 76KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

20:fc:29:4a:c3:b5:78:84:4c:ba:42:6f:3f:7e:14:82:b9:e9:5e:aa
Signer

06/09/2010, 05:32
Valid: false

.6-%`+
Size: 1KB - Virtual size: 36KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 3KB - Virtual size: 2KB

.e+31-3
Size: 1KB - Virtual size: 12KB

.:6|[4
Size: 1KB - Virtual size: 42KB

.6),,-
Size: 1024B - Virtual size: 8KB

.Mg-5
Size: 1024B - Virtual size: 39KB

..Z*\
Size: 15KB - Virtual size: 16KB

.818
Size: 1024B - Virtual size: 39KB

.\41[9
Size: 1024B - Virtual size: 35KB

.1#
Size: 1024B - Virtual size: 25KB

.rsrc
Size: 77KB - Virtual size: 76KB