d904c55b0ea0d842cf9190fde55c09f37228087cddc57839e2cb0877e0bbcd3b

Sharing

Copy URL Twitter E-mail

General

Target

d904c55b0ea0d842cf9190fde55c09f37228087cddc57839e2cb0877e0bbcd3b
Size

42KB
MD5

1047290271199c4b9845051ce03054e3
SHA1

208543d74a9cc337718a34e788933721faf3d6bd
SHA256

d904c55b0ea0d842cf9190fde55c09f37228087cddc57839e2cb0877e0bbcd3b
SHA512

5ebfe07fa32ee03cf0d5b143d040abbef14e53e80200560dbc2574a2a145d0e5db58b720ba8506cdcef394b7f110b257218a6b8cf517baa4fef1daa1bf0ae87f
SSDEEP

768:Q8/od5Yaa8S/Cw/17vQJcW6HRcAz6Q4NraXYVNf8k/JPlrmu1jKvY:i5Ya7a/1DQJcdHqBdyYok/Jtrmu1kY

Score

N/A

Malware Config

Signatures

Files

d904c55b0ea0d842cf9190fde55c09f37228087cddc57839e2cb0877e0bbcd3b
.exe windows x86

a0be7a0e9d5f0e3871034bd702cf2d92

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:02:30:7e:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2008, 21:57

Not After

10/06/2009, 22:07

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

97:1d:b0:65:b8:30:e8:1a:1a:e1:00:ae:6d:91:c4:40:97:6f:25:07
Signer

Actual PE Digest

97:1d:b0:65:b8:30:e8:1a:1a:e1:00:ae:6d:91:c4:40:97:6f:25:07

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

19/07/2008, 05:10
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
GetModuleHandleA
LockResource
LoadResource
FindResourceA
ReadFile
DeleteFileA
Sleep
WinExec
lstrcatA
GetTempPathA
GetLastError
CreateFileA
lstrlenA
VirtualFree
VirtualFreeEx
GetProcAddress
LoadLibraryA
lstrcpyA
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
GetProcessTimes
VirtualAlloc
GetModuleFileNameA
WriteFile
OpenProcess
CloseHandle

advapi32

RegCloseKey
RegOpenKeyExA

msvcrt

_except_handler3
_splitpath
strstr
_stricmp
_strcmpi

psapi

EnumProcessModules
GetModuleFileNameExA

Sections

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0be7a0e9d5f0e3871034bd702cf2d92

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:02:30:7e:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

97:1d:b0:65:b8:30:e8:1a:1a:e1:00:ae:6d:91:c4:40:97:6f:25:07Signer

Signature Validations

Verification

19/07/2008, 05:10 Valid: false

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

psapi

Sections

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 28KB - Virtual size: 27KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:02:30:7e:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

97:1d:b0:65:b8:30:e8:1a:1a:e1:00:ae:6d:91:c4:40:97:6f:25:07
Signer

19/07/2008, 05:10
Valid: false

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 28KB - Virtual size: 27KB