d8cb9975cc3e52c0dfd0b2ffab27a8fc71992539f9ada97b8c734bccc5b5fc89

Sharing

Copy URL

Twitter E-mail

General

Target

d8cb9975cc3e52c0dfd0b2ffab27a8fc71992539f9ada97b8c734bccc5b5fc89
Size

1.2MB
MD5

40168985452435cb82f8dbb415114b10
SHA1

682c50fa11003ac1d5ffc4f69d4cd3747d163391
SHA256

d8cb9975cc3e52c0dfd0b2ffab27a8fc71992539f9ada97b8c734bccc5b5fc89
SHA512

b6c229e11fc408c0387ed30c12cbb799c2841fa902f809fe71e031c5ec6887502978a3d3c07baf1a082a09eda33b48a0ab01e79393252bb13b1fe0e85c99954d
SSDEEP

24576:SmBEzaeLa1o3kYQXTDbnOeUyE7aZQrd4zpq/BMcJDW2Pz/xt5tyOjLgQGbq0t63D:SmNeLa1o3kYQHjOCAJ/Lsb63lqZG9mlo

Score

N/A

Malware Config

Signatures

Files

d8cb9975cc3e52c0dfd0b2ffab27a8fc71992539f9ada97b8c734bccc5b5fc89
.dll windows x86

d71161d27db15d49a7084b5c1def3d20

Code Sign

61:05:f7:1e:00:00:00:00:00:32
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2009, 23:00

Not After

13/10/2010, 23:10

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:b5:29:00:00:00:00:00:10
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/01/2010, 21:12

Not After

04/01/2013, 21:22

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher+OU=nCipher DSE ESN:ACD3-AE66-E0B5,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12
Signer

Actual PE Digest

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

05/03/2010, 19:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_purecall
_wcsicmp
_onexit
_lock
__dllonexit
memmove
memcpy
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
wcschr
_vsnwprintf
_unlock
rand
srand
time
wcsncmp
_wtoi
_wcsnicmp
_ui64tow
_itow
wcsstr
memset

kernel32

CreateFileMappingW
MapViewOfFile
CreateThread
WaitForMultipleObjects
SetThreadPriority
FreeLibraryAndExitThread
InterlockedExchangeAdd
CreateEventW
CreateSemaphoreW
SystemTimeToFileTime
SetEvent
WaitForSingleObject
GetModuleFileNameW
GetCurrentThread
GetThreadPriority
GetProcessAffinityMask
RaiseException
UnmapViewOfFile
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VirtualFree
FileTimeToSystemTime
GetSystemDefaultLangID
GetVersionExW
LoadLibraryW
FreeLibrary
GetLocalTime
InitializeCriticalSection
IsProcessorFeaturePresent
ReleaseSemaphore
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
CloseHandle
GetLastError
GetVersionExA
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
ReadFile
GetFileSize
CreateFileW
InterlockedDecrement
SetLastError
VirtualProtect
VirtualAlloc
GetProcAddress
GetSystemInfo
VirtualQuery
GetVersion
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount

advapi32

CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGenRandom
CryptAcquireContextW
TraceEvent
CryptReleaseContext

rpcrt4

UuidToStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidFromStringW

Exports

Exports

PidGenX
PidGenX2

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d71161d27db15d49a7084b5c1def3d20

Code Sign

61:05:f7:1e:00:00:00:00:00:32Certificate

Extended Key Usages

Key Usages

61:16:b5:29:00:00:00:00:00:10Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12Signer

Signature Validations

Verification

05/03/2010, 19:36 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 158KB - Virtual size: 157KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 25KB - Virtual size: 25KB

61:05:f7:1e:00:00:00:00:00:32
Certificate

61:16:b5:29:00:00:00:00:00:10
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

18:a5:44:58:7d:ff:6a:24:f3:eb:66:04:9b:c4:e9:b3:be:5d:37:12
Signer

05/03/2010, 19:36
Valid: false

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 158KB - Virtual size: 157KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 25KB - Virtual size: 25KB