a87b83239f38ff684a80ca74ef38b19597c20bce210d0cef0bb74cf333ef14a6[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

a87b83239f38ff684a80ca74ef38b19597c20bce210d0cef0bb74cf333ef14a6.7z
Size

4.2MB
MD5

35cdb74a2509cde48ed1b0ac56564f64
SHA1

d343e8066394b1bcf96a310a72c2965236a36cc0
SHA256

59892a7bceb7c3cb808681d7e398fcb749b148c733e51bd9e541cfa44fbed335
SHA512

eccac89b36f91053874148419c77c9d0018680ef5e5c51571b7388ea91b817f3b4ece5f52ecf34fd1897a33d43369da05427f08735a473affc1ae63a929b0bd7
SSDEEP

98304:5C7DYLdvPUzDVI05ZMLflo8xlYox2O+d/8tY0k:54DYLFUXVFZMLflosYi4

Score

1^/10

Malware Config

Signatures

Files

a87b83239f38ff684a80ca74ef38b19597c20bce210d0cef0bb74cf333ef14a6.7z
.7z

Password: infected
a87b83239f38ff684a80ca74ef38b19597c20bce210d0cef0bb74cf333ef14a6
.exe windows x86

04aa7d6b64894bac310f969d4688d279

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:2a:4b:bb:66:26:2a:8f:b4:e0:84:56:05:73:e9:08
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16-12-2011 00:00

Not After

15-12-2012 23:59

Subject

CN=Faglaro Enterprises Limited,O=Faglaro Enterprises Limited,POSTALCODE=2107,STREET=Konstantinoupoleos\, 22,L=Nicosia,ST=Aglantzia/Cyprus,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

20:fd:b1:92:cf:dd:e9:e6:a4:82:57:ff:ef:33:91:25:b9:16:38:0e
Signer

Actual PE Digest

20:fd:b1:92:cf:dd:e9:e6:a4:82:57:ff:ef:33:91:25:b9:16:38:0e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Faglaro Enterprises Limited,O=Faglaro Enterprises Limited,POSTALCODE=2107,STREET=Konstantinoupoleos\, 22,L=Nicosia,ST=Aglantzia/Cyprus,C=CY

22-02-2012 17:17
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidToStringW
RpcStringFreeW

shlwapi

PathFindFileNameW
StrCmpIW
SHDeleteKeyW
SHDeleteValueW
SHGetValueA
PathRemoveExtensionW
SHGetValueW
SHSetValueW

user32

GetSystemMetrics
MessageBoxIndirectW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
PostQuitMessage
DefWindowProcW
ShowWindow
MessageBoxW
GetWindowThreadProcessId
GetShellWindow
CreateWindowExW
LoadIconW
RegisterClassExW
LoadCursorW
MessageBoxW
CharUpperBuffW
wsprintfW

kernel32

GetConsoleCP
QueryPerformanceCounter
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
IsProcessorFeaturePresent
HeapSize
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation
VirtualFree
VirtualAlloc
GetFileSize
FindFirstFileW
SetFilePointer
VirtualQuery
GetCurrentProcess
GetCurrentThread
WriteFile
OpenProcess
WideCharToMultiByte
GetVersionExW
TerminateProcess
ReadFile
CreateFileW
MultiByteToWideChar
GetLastError
GetConsoleMode
FindClose
Process32FirstW
RemoveDirectoryW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTickCount
GetTempPathW
CreateProcessW
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
GetModuleHandleA
FindResourceA
FreeResource
LoadResource
LoadLibraryW
SizeofResource
LockResource
ExitProcess
CreateMutexW
CreateDirectoryW
Sleep
CopyFileW
GetModuleFileNameW
FindResourceW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleHandleW
MapViewOfFile
RaiseException
OpenEventA
OpenFileMappingA
LocalFree
InterlockedDecrement
GetVersion
MoveFileExW
GetCurrentThreadId
GetStringTypeW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
InterlockedExchange
LocalAlloc
SetLastError
SetEvent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenThreadToken
OpenProcessToken
FreeSid

shell32

SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW

ole32

CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear
VariantInit

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.A0
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.A1
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

04aa7d6b64894bac310f969d4688d279

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

dd:2a:4b:bb:66:26:2a:8f:b4:e0:84:56:05:73:e9:08Certificate

Extended Key Usages

Key Usages

20:fd:b1:92:cf:dd:e9:e6:a4:82:57:ff:ef:33:91:25:b9:16:38:0eSigner

Signature Validations

Verification

22-02-2012 17:17 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

shlwapi

user32

kernel32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 88KB - Virtual size: 88KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 5KB - Virtual size: 12KB

.A0 Size: 4.1MB - Virtual size: 4.1MB

.A1 Size: 42KB - Virtual size: 42KB

.rsrc Size: 219KB - Virtual size: 218KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

dd:2a:4b:bb:66:26:2a:8f:b4:e0:84:56:05:73:e9:08
Certificate

20:fd:b1:92:cf:dd:e9:e6:a4:82:57:ff:ef:33:91:25:b9:16:38:0e
Signer

22-02-2012 17:17
Valid: false

.text
Size: 88KB - Virtual size: 88KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 5KB - Virtual size: 12KB

.A0
Size: 4.1MB - Virtual size: 4.1MB

.A1
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 219KB - Virtual size: 218KB