f76794bac70dde0480b7de73f50dad534bc5a6d9e918ac9a0302efda40ea9799

Sharing

Copy URL

Twitter E-mail

General

Target

f76794bac70dde0480b7de73f50dad534bc5a6d9e918ac9a0302efda40ea9799
Size

34KB
MD5

be5b4d361f229ef11dfefdc8907f322b
SHA1

ba48a93af32e5cfc635d1cd0b27bc441e4ef0c3c
SHA256

f76794bac70dde0480b7de73f50dad534bc5a6d9e918ac9a0302efda40ea9799
SHA512

9e552b03c6dfd2bdb0fbe36f1907edf2cdfde3c4fd825dccdd7c8da31f21a28dfa721709ab6eb2d4582684c6f9cc8597d438c33fe351a7f796eb8cdba6e8dd54
SSDEEP

384:Zs/ISQEU33Ur1dIv+ktFxBc7KV1xAL5xGptD6RgCWOFYpG9n3YJLItbCJ1M6j8:y/ISQ6huLM783ArGptWWHkWLWbCbMm8

Score

N/A

Malware Config

Signatures

Files

f76794bac70dde0480b7de73f50dad534bc5a6d9e918ac9a0302efda40ea9799
.exe windows x86

6556440019dd2b2589cbd4427f80f94c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:af:b8:2a:bd:ed:8f:86:08:23:c1:42:d9:4a:b3:6b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05/08/2009, 00:00

Not After

02/09/2010, 23:59

Subject

CN=Farstone Technology Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Farstone Technology Inc,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:f2:c7:b7:4d:c0:3e:85:0d:71:3f:3a:09:4e:a5:d8:f3:e4:f4:74
Signer

Actual PE Digest

1f:f2:c7:b7:4d:c0:3e:85:0d:71:3f:3a:09:4e:a5:d8:f3:e4:f4:74

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Farstone Technology Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Farstone Technology Inc,L=Irvine,ST=California,C=US

19/01/2010, 01:27
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord3081
ord5861
ord800
ord1200
ord2818
ord537
ord860
ord540
ord541
ord2621
ord1134
ord1576
ord2985
ord1168
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord801
ord4274

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
__CxxFrameHandler
__p___argc
__p___argv
sprintf
_mbsicmp
_setmbcp
atol

kernel32

GetModuleHandleA
OutputDebugStringA
OpenFileMappingA
MapViewOfFile
GetStartupInfoA
GetLastError
GetCurrentProcess
GetVersionExA
GetCurrentThread

advapi32

OpenProcessToken
EqualSid
OpenThreadToken
FreeSid
GetTokenInformation
AllocateAndInitializeSid

cderase

EraseCD

cdinfo

RefreshDevice
IsRWDev
ShowCDInfo

buildcd

DirectRecordCD

autorun

CanUseDVDFun

vdproductinfoex

VDC_GetProductName
VDC_GetProductNumber

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6556440019dd2b2589cbd4427f80f94c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

02:af:b8:2a:bd:ed:8f:86:08:23:c1:42:d9:4a:b3:6bCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

1f:f2:c7:b7:4d:c0:3e:85:0d:71:3f:3a:09:4e:a5:d8:f3:e4:f4:74Signer

Signature Validations

Verification

19/01/2010, 01:27 Valid: false

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

advapi32

cderase

cdinfo

buildcd

autorun

vdproductinfoex

Sections

.text Size: 4KB - Virtual size: 2KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 832B

.rsrc Size: 12KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

02:af:b8:2a:bd:ed:8f:86:08:23:c1:42:d9:4a:b3:6b
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

1f:f2:c7:b7:4d:c0:3e:85:0d:71:3f:3a:09:4e:a5:d8:f3:e4:f4:74
Signer

19/01/2010, 01:27
Valid: false

.text
Size: 4KB - Virtual size: 2KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 832B

.rsrc
Size: 12KB - Virtual size: 8KB