e038cc354d2090efe558723f39e3514c55045be99f9c994c1e8a34d463e615cf

Sharing

Copy URL Twitter E-mail

General

Target

e038cc354d2090efe558723f39e3514c55045be99f9c994c1e8a34d463e615cf
Size

849KB
MD5

2f1ebd3e5f1ce27b19dd884e1c9efdc3
SHA1

4c84ca71a4e976d5e88208380dee7edd1dd75ff8
SHA256

e038cc354d2090efe558723f39e3514c55045be99f9c994c1e8a34d463e615cf
SHA512

63753a96d03bbd9cb479666181cfce79d9fb5e3081bf271ff813c1a2bc885e4d13c5f7710b4d89c169416f26127eeda47129845d66321c4bfcd9f83a6e9bf593
SSDEEP

12288:tB+nwj7vbsslMqeMPwTYlOrSo8/APonLQHcNI7ibyVe+LipD2PFpjffSWF5lKQVu:tB+nsYkQ8K7imRmpD8fSWZdven

Score

N/A

Malware Config

Signatures

Files

e038cc354d2090efe558723f39e3514c55045be99f9c994c1e8a34d463e615cf
.exe windows x86

048175dd0a28d314e38de4bb10426af9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/04/2014, 00:00

Not After

06/04/2017, 23:59

Subject

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:53:a4:d9:ea:36:f0:ad:c5:cf:21:11:04:b5:d7:b0:0a:e6:b7:f6
Signer

Actual PE Digest

74:53:a4:d9:ea:36:f0:ad:c5:cf:21:11:04:b5:d7:b0:0a:e6:b7:f6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

24/10/2014, 13:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

crypt32

CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

wintrust

WinVerifyTrust

wininet

HttpOpenRequestW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetErrorDlg
InternetSetStatusCallbackW
HttpSendRequestW
HttpQueryInfoW

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CreateProcessAsUserW

kernel32

GetTimeZoneInformation
WriteConsoleW
LoadLibraryExW
FreeEnvironmentStringsW
GetACP
GetOEMCP
OutputDebugStringW
GetDriveTypeW
GetEnvironmentStringsW
HeapSize
EnumSystemLocalesW
LCMapStringW
GetLocaleInfoW
IsValidCodePage
GetUserDefaultLCID
IsValidLocale
GetModuleHandleW
CreateFileW
ReadFile
SetFilePointer
SetFileTime
WriteFile
CloseHandle
GetLastError
GetExitCodeProcess
SetThreadLocale
SetThreadUILanguage
DeleteFileW
OutputDebugStringA
SetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCurrentProcessId
GetTickCount
GetModuleFileNameW
FormatMessageA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCommandLineW
LocalFree
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
GetCurrentProcess
CopyFileW
MoveFileExW
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
ResumeThread
CreateProcessW
AssignProcessToJobObject
CreateEventW
GetProcAddress
InterlockedCompareExchange
GetVersionExW
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DuplicateHandle
RaiseException
Sleep
CreateThread
GetCurrentThread
GetCurrentThreadId
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
InterlockedExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryW
GetWindowsDirectoryW
SetEvent
TerminateProcess
GetModuleHandleExW
GetModuleHandleExA
LocalAlloc
CompareStringW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
HeapReAlloc
ExitProcess
GetFileType
SetStdHandle
GetFullPathNameW
GetProcessHeap
HeapAlloc
GetConsoleMode
GetConsoleCP
HeapFree
IsProcessorFeaturePresent
GetStringTypeW
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
LoadLibraryExA
FreeLibrary
SetEnvironmentVariableA

ole32

CoTaskMemFree
CoInitialize

user32

KillTimer
SetTimer
LoadStringW
GetQueueStatus
CallMsgFilterW
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
WaitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
LoadIconW
SetWindowLongW
GetWindowLongW
SetWindowTextW
EnableWindow
GetDlgItem
CreateDialogParamW
ShowWindow
DestroyWindow
SendMessageW
MsgWaitForMultipleObjectsEx

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

048175dd0a28d314e38de4bb10426af9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

74:53:a4:d9:ea:36:f0:ad:c5:cf:21:11:04:b5:d7:b0:0a:e6:b7:f6Signer

Signature Validations

Verification

24/10/2014, 13:49 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

crypt32

wintrust

wininet

winmm

advapi32

kernel32

ole32

user32

userenv

Sections

.text Size: 362KB - Virtual size: 361KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 7KB - Virtual size: 27KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 403KB - Virtual size: 402KB

.reloc Size: 13KB - Virtual size: 12KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

74:53:a4:d9:ea:36:f0:ad:c5:cf:21:11:04:b5:d7:b0:0a:e6:b7:f6
Signer

24/10/2014, 13:49
Valid: false

.text
Size: 362KB - Virtual size: 361KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 7KB - Virtual size: 27KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 403KB - Virtual size: 402KB

.reloc
Size: 13KB - Virtual size: 12KB