tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

69.2MB
MD5

589df282da9996f7a6946a8f5634ee9c
SHA1

98c4a2473ad7969e6da56c432e37208886fb0a3b
SHA256

8a7ec51f7f3b3b1f11eb2ce8b4c8b0dd82caa3f838eb60e824910264db37cb1b
SHA512

f9e5e8646268a2663021858afe4063ca029ed9bfa8c3cf47b0921f610d1ddac45b0925108ea8365a9165c0d58f4ca18be9e42c44403c5a5250f59c5dd64a8724
SSDEEP

1572864:Npdra+J/wLcBHnDYpY/IsNfgqF/IZ6DXKButA/LTiisaFYJJL8cVf/S:1rawwLcRDYG/bIqF/IqFAHiAFYJ13S

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x86

2dc75fb58ce42f405839e58308874c52

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:3a:64:81:8c:1e:08:6b:1b:15:ae:e6:3f:a0:54:a2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/06/2008, 00:00

Not After

11/06/2011, 23:59

Subject

CN=Sun Microsystems\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sun Microsystems\, Inc.,L=Menlo Park,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:ad:87:5f:ce:a4:e8:2d:be:28:64:a7:88:d9:55:9f:98:12:ef:03
Signer

Actual PE Digest

9c:ad:87:5f:ce:a4:e8:2d:be:28:64:a7:88:d9:55:9f:98:12:ef:03

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Sun Microsystems\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sun Microsystems\, Inc.,L=Menlo Park,ST=California,C=US

18/03/2010, 13:31
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord87
ord168
ord141

ntdll

NtSetInformationFile
RtlUnwind
RtlNtStatusToDosError

kernel32

SystemTimeToTzSpecificLocalTime
GetOEMCP
GetLocaleInfoW
CompareStringW
CompareStringA
SetStdHandle
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceExA
GetLastError
CloseHandle
CreateMutexA
SetLastError
SetFilePointer
GetFileAttributesW
SetFileAttributesW
SetEndOfFile
CreateFileW
ReadFile
WriteFile
FlushFileBuffers
GetFileSize
GetFileType
LockFileEx
UnlockFile
GetFileInformationByHandle
SetFileTime
DeleteFileW
TlsAlloc
TlsSetValue
TlsGetValue
GetCurrentThreadId
Sleep
SetThreadAffinityMask
GetCurrentThread
GetProcessAffinityMask
WideCharToMultiByte
MultiByteToWideChar
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
FindClose
FindNextFileW
GetFullPathNameW
GetEnvironmentVariableW
GetFileAttributesExW
MoveFileExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
CreateEventA
WaitForSingleObjectEx
SetEvent
ResetEvent
ReleaseMutex
SetThreadPriority
GetTickCount
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetTimeZoneInformation
SystemTimeToFileTime
GetACP
FileTimeToSystemTime
GetCommandLineW
OutputDebugStringA
VirtualProtect
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitThread
CreateThread
GetCurrentProcessId
HeapAlloc
HeapReAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FatalAppExitA
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsFree
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
VirtualAlloc
IsBadWritePtr
HeapSize
SetEnvironmentVariableA
SetEnvironmentVariableW
InitializeCriticalSection
InterlockedExchange
VirtualQuery
LoadLibraryA
GetSystemInfo

user32

GetDesktopWindow
MessageBoxA

shell32

SHFileOperationA

Exports

Exports

AssertMsg1
AssertMsg2
RTAssertShouldPanic
RTAvlPVDestroy
RTAvlPVDoWithAll
RTAvlPVGet
RTAvlPVGetBestFit
RTAvlPVInsert
RTAvlPVRemove
RTAvlPVRemoveBestFit
RTCritSectDelete
RTCritSectEnter
RTCritSectEnterDebug
RTCritSectEnterMultiple
RTCritSectEnterMultipleDebug
RTCritSectInit
RTCritSectInitEx
RTCritSectLeave
RTCritSectLeaveMultiple
RTCritSectTryEnter
RTCritSectTryEnterDebug
RTDirClose
RTDirCreate
RTDirCreateFullPath
RTDirExists
RTDirOpen
RTDirOpenFiltered
RTDirRead
RTDirReadEx
RTDirRemove
RTDirRemoveRecursive
RTDirRename
RTEnvClone
RTEnvCreate
RTEnvDestroy
RTEnvExist
RTEnvExistEx
RTEnvGet
RTEnvGetEx
RTEnvGetExecEnvP
RTEnvPut
RTEnvPutEx
RTEnvSet
RTEnvSetEx
RTEnvUnset
RTEnvUnsetEx
RTErrCOMGet
RTErrConvertFromErrno
RTErrConvertFromWin32
RTErrGet
RTErrWinGet
RTFileChangeLock
RTFileClose
RTFileCopyByHandles
RTFileCopyByHandlesEx
RTFileCopyEx
RTFileDelete
RTFileExists
RTFileFlush
RTFileFromNative
RTFileGetMaxSize
RTFileGetMaxSizeEx
RTFileGetSize
RTFileIsValid
RTFileLock
RTFileMove
RTFileOpen
RTFileQueryInfo
RTFileRead
RTFileReadAt
RTFileRename
RTFileSeek
RTFileSetForceFlags
RTFileSetMode
RTFileSetSize
RTFileSetTimes
RTFileTell
RTFileToNative
RTFileUnlock
RTFileWrite
RTFileWriteAt
RTLogCloneRC
RTLogCopyGroupsAndFlags
RTLogCreate
RTLogCreateEx
RTLogCreateExV
RTLogCreateForR0
RTLogDefaultInit
RTLogDefaultInstance
RTLogDestroy
RTLogFlags
RTLogFlush
RTLogFlushRC
RTLogFlushToLogger
RTLogFormatV
RTLogGetDefaultInstance
RTLogGroupSettings
RTLogLogger
RTLogLoggerEx
RTLogLoggerExV
RTLogLoggerV
RTLogPrintf
RTLogPrintfV
RTLogRelDefaultInstance
RTLogRelLogger
RTLogRelLoggerV
RTLogRelPrintf
RTLogRelPrintfV
RTLogRelSetDefaultInstance
RTLogSetCustomPrefixCallback
RTLogSetDefaultInstance
RTLogWriteDebugger
RTLogWriteStdErr
RTLogWriteStdOut
RTLogWriteUser
RTMemAlloc
RTMemAllocZ
RTMemExecAlloc
RTMemExecFree
RTMemFree
RTMemPageAlloc
RTMemPageAllocZ
RTMemPageFree
RTMemProtect
RTMemRealloc
RTMemTmpAlloc
RTMemTmpAllocZ
RTMemTmpFree
RTPathAbs
RTPathAbsDup
RTPathAbsEx
RTPathAbsExDup
RTPathAppDocs
RTPathAppPrivateArch
RTPathAppPrivateNoArch
RTPathAppend
RTPathCompare
RTPathExecDir
RTPathExists
RTPathExt
RTPathFilename
RTPathGetCurrent
RTPathHaveExt
RTPathHavePath
RTPathParse
RTPathQueryInfo
RTPathReal
RTPathRealDup
RTPathRename
RTPathSetCurrent
RTPathSetTimes
RTPathSharedLibs
RTPathStartsWith
RTPathStripExt
RTPathStripFilename
RTPathStripTrailingSlash
RTPathTemp
RTPathUserHome
RTProcGetExecutableName
RTProcGetPriority
RTProcSelf
RTProcSetPriority
RTR3Init
RTR3InitAndSUPLib
RTR3InitAndSUPLibWithProgramPath
RTR3InitEx
RTR3InitWithProgramPath
RTSemEventCreate
RTSemEventDestroy
RTSemEventMultiCreate
RTSemEventMultiDestroy
RTSemEventMultiReset
RTSemEventMultiSignal
RTSemEventMultiWait
RTSemEventMultiWaitNoResume
RTSemEventSignal
RTSemEventWait
RTSemEventWaitNoResume
RTSemFastMutexCreate
RTSemFastMutexDestroy
RTSemFastMutexRelease
RTSemFastMutexRequest
RTSemMutexCreate
RTSemMutexDestroy
RTSemMutexRelease
RTSemMutexRequest
RTSemMutexRequestNoResume
RTSemRWCreate
RTSemRWDestroy
RTSemRWGetWriteRecursion
RTSemRWGetWriterReadRecursion
RTSemRWIsWriteOwner
RTSemRWReleaseRead
RTSemRWReleaseWrite
RTSemRWRequestRead
RTSemRWRequestReadNoResume
RTSemRWRequestWrite
RTSemRWRequestWriteNoResume
RTStrAPrintf
RTStrAPrintfV
RTStrCalcUtf16Len
RTStrCalcUtf16LenEx
RTStrCmp
RTStrCurrentCPToUtf8
RTStrDup
RTStrDupEx
RTStrDupN
RTStrFormat
RTStrFormatNumber
RTStrFormatTypeDeregister
RTStrFormatTypeRegister
RTStrFormatTypeSetUser
RTStrFormatV
RTStrFree
RTStrGetCpExInternal
RTStrGetCpInternal
RTStrGetCpNExInternal
RTStrICmp
RTStrIStr
RTStrIsValidEncoding
RTStrNCmp
RTStrNICmp
RTStrPrevCp
RTStrPrintf
RTStrPrintfEx
RTStrPrintfExV
RTStrPrintfV
RTStrPutCpInternal
RTStrStr
RTStrToInt16
RTStrToInt16Ex
RTStrToInt16Full
RTStrToInt32
RTStrToInt32Ex
RTStrToInt32Full
RTStrToInt64
RTStrToInt64Ex
RTStrToInt64Full
RTStrToInt8
RTStrToInt8Ex
RTStrToInt8Full
RTStrToLower
RTStrToUInt16
RTStrToUInt16Ex
RTStrToUInt16Full
RTStrToUInt32
RTStrToUInt32Ex
RTStrToUInt32Full
RTStrToUInt64
RTStrToUInt64Ex
RTStrToUInt64Full
RTStrToUInt8
RTStrToUInt8Ex
RTStrToUInt8Full
RTStrToUni
RTStrToUniEx
RTStrToUpper
RTStrToUtf16
RTStrToUtf16Ex
RTStrUniLen
RTStrUniLenEx
RTStrUtf8ToCurrentCP
RTStrValidateEncoding
RTStrValidateEncodingEx
RTThreadAdopt
RTThreadBlocking
RTThreadCreate
RTThreadCreateF
RTThreadCreateV
RTThreadFromNative
RTThreadGetAffinity
RTThreadGetName
RTThreadGetNative
RTThreadGetReadLockCount
RTThreadGetType
RTThreadGetWriteLockCount
RTThreadNativeSelf
RTThreadReadLockDec
RTThreadReadLockInc
RTThreadSelf
RTThreadSelfName
RTThreadSetAffinity
RTThreadSetName
RTThreadSetType
RTThreadSleep
RTThreadUnblocked
RTThreadUserReset
RTThreadUserSignal
RTThreadUserWait
RTThreadUserWaitNoResume
RTThreadWait
RTThreadWaitNoResume
RTThreadWriteLockDec
RTThreadWriteLockInc
RTThreadYield
RTTimeExplode
RTTimeImplode
RTTimeIsLeapYear
RTTimeLocalDeltaNano
RTTimeLocalExplode
RTTimeLocalNow
RTTimeMilliTS
RTTimeNanoTS
RTTimeNormalize
RTTimeNow
RTTimeProgramMicroTS
RTTimeProgramMilliTS
RTTimeProgramNanoTS
RTTimeProgramSecTS
RTTimeProgramStartNanoTS
RTTimeSpecToString
RTTimeSystemMilliTS
RTTimeSystemNanoTS
RTTimeToString
RTUniFree
RTUtf16CalcUtf8Len
RTUtf16CalcUtf8LenEx
RTUtf16Cmp
RTUtf16Dup
RTUtf16DupEx
RTUtf16Free
RTUtf16GetCpExInternal
RTUtf16GetCpInternal
RTUtf16ICmp
RTUtf16Len
RTUtf16PutCpInternal
RTUtf16ToLower
RTUtf16ToUpper
RTUtf16ToUtf8
RTUtf16ToUtf8Ex
g_aRTUniLowerRanges
g_aRTUniUpperRanges
g_szRTAssertMsg1
g_szRTAssertMsg2

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 456KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68.7MB - Virtual size: 68.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2dc75fb58ce42f405839e58308874c52

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

69:3a:64:81:8c:1e:08:6b:1b:15:ae:e6:3f:a0:54:a2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

9c:ad:87:5f:ce:a4:e8:2d:be:28:64:a7:88:d9:55:9f:98:12:ef:03Signer

Signature Validations

Verification

18/03/2010, 13:31 Valid: false

Headers

File Characteristics

Imports

msi

ntdll

kernel32

user32

shell32

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 133KB

.rdata Size: 456KB - Virtual size: 452KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 68.7MB - Virtual size: 68.7MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

69:3a:64:81:8c:1e:08:6b:1b:15:ae:e6:3f:a0:54:a2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

9c:ad:87:5f:ce:a4:e8:2d:be:28:64:a7:88:d9:55:9f:98:12:ef:03
Signer

18/03/2010, 13:31
Valid: false

.text
Size: 136KB - Virtual size: 133KB

.rdata
Size: 456KB - Virtual size: 452KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 68.7MB - Virtual size: 68.7MB