a7eb839b9706b2ee461ccdc50b6d4f4fbca614fd5dd468ebfc9efd112f3a4298

Sharing

Copy URL

Twitter E-mail

General

Target

a7eb839b9706b2ee461ccdc50b6d4f4fbca614fd5dd468ebfc9efd112f3a4298
Size

633KB
MD5

74b06a056684a7f3d768d9827f5f72e2
SHA1

0c4a8c57569fe525cb4d217f7372d9bb8e86a74a
SHA256

a7eb839b9706b2ee461ccdc50b6d4f4fbca614fd5dd468ebfc9efd112f3a4298
SHA512

f950d72b18ebc792e1fd034d80669ce77a4b42f9bdf2db0f12cbcd96b152ddfda12537d025def6bf571a34dc7348b9f7e5826b8eac01663ab69a462071ed035c
SSDEEP

12288:xemAVC2tL4pCuXdliR40sD1w9lRUS4Tx6Ym/+teDuUlPv:xMQ1YuD4Z4Tx+/eW

Score

N/A

Malware Config

Signatures

Files

a7eb839b9706b2ee461ccdc50b6d4f4fbca614fd5dd468ebfc9efd112f3a4298
.exe windows x86

76e8ee6dc5e046e5847ecd72887135ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

45:62:43:07:0b:32:ab:65:36:43:ba:67:b6:52:95:3c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

27-08-2007 00:00

Not After

04-09-2009 23:59

Subject

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetVersion
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
CompareStringA
CompareStringW
lstrcmpiA
lstrlenA
GetEnvironmentVariableA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileAttributesA
GetFullPathNameA
GetModuleFileNameA
GetTickCount
GetCurrentThreadId
GlobalDeleteAtom
GlobalAddAtomA
FreeLibrary
MulDiv
WriteProfileStringA
GetProfileStringA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileStringA
CloseHandle
SetEvent
CreateEventA
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
SetLastError
FindResourceExA
ResumeThread
SuspendThread
QueryDosDeviceA
GetDriveTypeA
DeviceIoControl
CreateFileA
SetThreadPriority
GetThreadPriority
GetCurrentThread
GlobalGetAtomNameA
GetCurrentProcessId
CreateMutexA
LocalFree
FormatMessageA
ExitProcess
Sleep
GetCommandLineA
CopyFileA
DeleteFileA
SetFileAttributesA
LoadLibraryExA
WaitForMultipleObjectsEx
OpenEventA
GetFileSize
WaitForSingleObject
GetSystemInfo
GetSystemDirectoryA
GlobalMemoryStatus
GetDiskFreeSpaceA
GetVersionExA
GetExitCodeProcess
CreateProcessA
GetStartupInfoA
OutputDebugStringA
WriteFile
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
HeapAlloc
GetProcessHeap
HeapFree
GlobalFree
GlobalAlloc
FlushFileBuffers
GetTempPathA
CreateDirectoryA
lstrcmpA
GetSystemDefaultLangID
SetThreadAffinityMask
CreateThread
GetProcessAffinityMask
LocalAlloc
MoveFileA
WritePrivateProfileStringA
CompareFileTime
GetFileTime
GetUserDefaultLangID
GetLocaleInfoA
GetShortPathNameA
OpenMutexA
ReleaseMutex
ResetEvent
PulseEvent
GlobalUnlock
GlobalLock
FreeResource
lstrcmpW
GlobalFindAtomA
GetModuleFileNameW
InterlockedDecrement
EnumResourceLanguagesA
ConvertDefaultLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
ReadFile
SetFilePointer
LockFile
UnlockFile
SetEndOfFile
GetThreadLocale
DuplicateHandle
GetVolumeInformationA
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
RtlUnwind
HeapReAlloc
VirtualAlloc
RaiseException
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
ExitThread
SetStdHandle
GetFileType
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetACP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
CreateFileW

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

ole32

CoCreateInstance
CoInitialize

oleaut32

OleLoadPicturePath
VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 420KB - Virtual size: 417KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76e8ee6dc5e046e5847ecd72887135ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

45:62:43:07:0b:32:ab:65:36:43:ba:67:b6:52:95:3cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

ole32

oleaut32

Sections

.text Size: 420KB - Virtual size: 417KB

.rdata Size: 116KB - Virtual size: 113KB

.data Size: 12KB - Virtual size: 93KB

.rsrc Size: 76KB - Virtual size: 73KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

45:62:43:07:0b:32:ab:65:36:43:ba:67:b6:52:95:3c
Certificate

.text
Size: 420KB - Virtual size: 417KB

.rdata
Size: 116KB - Virtual size: 113KB

.data
Size: 12KB - Virtual size: 93KB

.rsrc
Size: 76KB - Virtual size: 73KB