9bcc155f596da726511ad5c566ca3c6e8edce894786a34dd6302d21766721da3

Sharing

Copy URL

Twitter E-mail

General

Target

9bcc155f596da726511ad5c566ca3c6e8edce894786a34dd6302d21766721da3
Size

826KB
MD5

e172fb2f453e7e6e13e51fcc74958891
SHA1

82c6083e125f68d483cbad6fdddf2109942c268d
SHA256

9bcc155f596da726511ad5c566ca3c6e8edce894786a34dd6302d21766721da3
SHA512

26c207aa4ee3cbb95388691baf21086dc02566c39f58e14e937e21e736ae72282f16b1027744937e029c02dfd21f364b2c756da2eb49359215273b9011436329
SSDEEP

12288:wF9AQMSI7jlkLoLVZnlQ5M91PXZoHk4hDLrMGE5mwLM9EjnuF1th/AT0Mz7Gm7:o9Mh9jC9HMGGmzLhK0Mz7Gm7

Score

N/A

Malware Config

Signatures

Files

9bcc155f596da726511ad5c566ca3c6e8edce894786a34dd6302d21766721da3
.exe windows x86

ec8e68f6d248dfa9ca5f94f5852371f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

12-08-2013 23:59

Subject

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ee:11:6a:aa:be:02:86:de:2e:d6:8e:6c:47:11:32:da:9c:59:5f:9d
Signer

Actual PE Digest

ee:11:6a:aa:be:02:86:de:2e:d6:8e:6c:47:11:32:da:9c:59:5f:9d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

05-04-2012 06:26
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
LockResource
LoadResource
FindResourceA
GetProcessVersion
GetCurrentThread
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetCurrentDirectoryA
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapAlloc
HeapFree
RaiseException
GetACP
ExitThread
HeapSize
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
GetStringTypeA
GlobalDeleteAtom
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
GlobalFlags
SuspendThread
SetThreadPriority
ResumeThread
SetEvent
MulDiv
TlsGetValue
QueryPerformanceCounter
LocalReAlloc
TlsSetValue
GlobalAlloc
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
TlsAlloc
LocalAlloc
GetVersion
DefineDosDeviceA
SetVolumeLabelA
QueryDosDeviceA
RemoveDirectoryW
CopyFileW
DeleteFileW
SetFileAttributesW
GetEnvironmentVariableW
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
MoveFileW
VirtualQueryEx
ReadProcessMemory
GetThreadPriority
CreateProcessW
LoadLibraryW
GetExitCodeThread
TerminateThread
ResetEvent
FormatMessageW
lstrlenW
FindResourceExA
lstrcatA
SetErrorMode
SetLastError
WaitForMultipleObjects
CreateEventA
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
GetFileSize
GetShortPathNameA
lstrcmpiA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
lstrcpynA
lstrcpyA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileExA
DuplicateHandle
FormatMessageA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetModuleFileNameA
GetVersionExA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
AllocConsole
GetStdHandle
WriteConsoleA
FreeConsole
OutputDebugStringW
SetFilePointer
WriteFile
CreateFileW
DeleteCriticalSection
InitializeCriticalSection
GetTempPathA
SetCurrentDirectoryA
CreateProcessA
CreateDirectoryA
TerminateProcess
SetPriorityClass
GetPriorityClass
GetDriveTypeA
ExpandEnvironmentStringsW
GetLogicalDrives
QueryDosDeviceW
ExpandEnvironmentStringsA
FreeLibrary
ReadFile
Sleep
MoveFileA
CopyFileA
SetFileAttributesA
lstrcmpA
RemoveDirectoryA
DeleteFileA
GetSystemInfo
FindFirstFileA
FindNextFileA
GetLastError
LoadLibraryA
LocalFree
OpenProcess
GetCurrentProcess
CreateThread
CreateFileA
GetFileInformationByHandle
CloseHandle
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleA
GetProcAddress
GetModuleFileNameW
GetTickCount
GetFileAttributesW
CreateDirectoryW
GetLocalTime
GetCurrentProcessId
FindFirstFileW
lstrcmpW
FindNextFileW
FindClose
GetSystemDirectoryA
GetWindowsDirectoryA
GetFileAttributesA
GetStringTypeW

user32

UpdateWindow
MapWindowPoints
GetSysColor
IsWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetClientRect
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
PostMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
DestroyMenu
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
SetFocus
CloseDesktop
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
OpenInputDesktop
GetUserObjectInformationA
SetWindowPos
MoveWindow
SetWindowLongA
GetWindowTextLengthA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
GetFocus
SetWindowTextA
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
IsWindowEnabled
EnableWindow
GrayStringA
DrawTextA
TabbedTextOutA
LoadIconA
LoadCursorA
GetSysColorBrush
GetWindowPlacement
PostQuitMessage
EndPaint
BeginPaint
GetProcessWindowStation
GetUserObjectInformationW
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
ShowOwnedPopups
SetCursor
InsertMenuA
GetMenuStringA
GetMenuState
DeleteMenu
MessageBoxA
MessageBoxW
EnumDesktopWindows
GetWindowThreadProcessId
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
UnhookWindowsHookEx
LoadStringA
MsgWaitForMultipleObjects
GetSystemMetrics
CharUpperA
wsprintfA
OemToCharA
CharToOemA
ShowWindow
SetActiveWindow
SendMessageA
GetClassNameA
FindWindowExA
GetMessageA
DispatchMessageA
TranslateMessage
GetWindowTextW
GetWindowTextA
GetDesktopWindow
EnumChildWindows
EnumWindows
IsWindowVisible
GetParent
GetWindowLongA
SetDlgItemInt

gdi32

GetViewportExtEx
GetWindowExtEx
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
EnumMetaFile
ExtTextOutA
Escape
CreateBitmap
GetDCOrgEx
GetObjectA
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
SelectClipPath
CreateRectRgn
GetClipRgn
DeleteObject
GetDeviceCaps
SetColorAdjustment
PolylineTo
PolyDraw
SetArcDirection
ArcTo
GetCurrentPositionEx
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
LineTo
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
PolyBezierTo
PlayMetaFile
SetMapMode
SetTextColor
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
SelectPalette
GetStockObject
SelectObject
RestoreDC
SaveDC
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
StartDocA
TextOutA
DeleteDC

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegisterEventSourceA
DeregisterEventSource
LookupAccountSidW
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
RegSetKeySecurity
SetFileSecurityA
RegEnumKeyA
RegConnectRegistryA
RegCreateKeyExA
ControlService
DeleteService
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
ChangeServiceConfigA
CloseServiceHandle
RegQueryInfoKeyA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegOpenKeyA
GetUserNameA
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCreateKeyW
RegOpenKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ReportEventA

shell32

SHGetFileInfoA
ShellExecuteA
SHFileOperationA
DragAcceptFiles

comctl32

ord17

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

oleaut32

SysReAllocStringLen
SysAllocStringLen

mpr

WNetGetConnectionA

setupapi

SetupInstallFileA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 632KB - Virtual size: 631KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec8e68f6d248dfa9ca5f94f5852371f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4aCertificate

Extended Key Usages

Key Usages

ee:11:6a:aa:be:02:86:de:2e:d6:8e:6c:47:11:32:da:9c:59:5f:9dSigner

Signature Validations

Verification

05-04-2012 06:26 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

mpr

setupapi

version

Sections

.text Size: 632KB - Virtual size: 631KB

.rdata Size: 92KB - Virtual size: 89KB

.data Size: 84KB - Virtual size: 103KB

.rsrc Size: 4KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

ee:11:6a:aa:be:02:86:de:2e:d6:8e:6c:47:11:32:da:9c:59:5f:9d
Signer

05-04-2012 06:26
Valid: false

.text
Size: 632KB - Virtual size: 631KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 84KB - Virtual size: 103KB

.rsrc
Size: 4KB - Virtual size: 1KB