e16de5c113ebcca7ed4635ce1b562580d2d1b8231feeda5ef00b6b0393a31e48

Sharing

Copy URL Twitter E-mail

General

Target

e16de5c113ebcca7ed4635ce1b562580d2d1b8231feeda5ef00b6b0393a31e48
Size

81KB
MD5

8ced296c0ba5547ab9afdad3e3e79349
SHA1

2bba3f7bdfaf139cde32030cac8d2d3ac295be7c
SHA256

e16de5c113ebcca7ed4635ce1b562580d2d1b8231feeda5ef00b6b0393a31e48
SHA512

76c3725d093d55c3cbc91ae342232f291279ae7b561bdea398a690ef634b4ba1e572f3c5fe8a4d370f1ec87cf7f6de66d7f7fbca6ee1855bed4fb9b12783981d
SSDEEP

1536:6Hm30TQL5kEP98amWp0IQ6X6L2X+knLaaFz868WM:6G3DL5kEP9d1XrgIz86hM

Score

N/A

Malware Config

Signatures

Files

e16de5c113ebcca7ed4635ce1b562580d2d1b8231feeda5ef00b6b0393a31e48
.exe windows x86

96d92c10b91b96c191e891371a53f64f

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

a3:a7:b0:92:59:e8:5f:04:8a:29:ed:7d:eb:68:c7:aa:e5:75:b7:1c
Signer

Actual PE Digest

a3:a7:b0:92:59:e8:5f:04:8a:29:ed:7d:eb:68:c7:aa:e5:75:b7:1c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/10/2010, 00:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetStdHandle
GetComputerNameW
GetLastError
OpenProcess
Sleep
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
GetProcAddress
GetModuleHandleW
CreateFileA
FlushFileBuffers
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
HeapReAlloc
VirtualAlloc
RaiseException
RtlUnwind
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

setupapi

SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Parent
SetupDiGetClassDevsW
CM_Connect_MachineW
CM_Get_Sibling_Ex
CM_Disconnect_Machine
CM_Get_Child_Ex
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

psapi

EnumProcessModules
GetModuleBaseNameW

ws2_32

closesocket
socket
WSACleanup
htons
WSAGetLastError
inet_addr
WSAStartup
connect

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96d92c10b91b96c191e891371a53f64f

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

a3:a7:b0:92:59:e8:5f:04:8a:29:ed:7d:eb:68:c7:aa:e5:75:b7:1cSigner

Signature Validations

Verification

17/10/2010, 00:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

setupapi

psapi

ws2_32

Sections

.text Size: 62KB - Virtual size: 61KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

a3:a7:b0:92:59:e8:5f:04:8a:29:ed:7d:eb:68:c7:aa:e5:75:b7:1c
Signer

17/10/2010, 00:14
Valid: false

.text
Size: 62KB - Virtual size: 61KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB