tmulvhhft[.]def

Sharing

Copy URL

Twitter E-mail

General

Target

tmulvhhft.def
Size

7.9MB
MD5

ca1c1e010e7ddac258e9dee2625a9657
SHA1

8c674aa81dd1e0ef523516b248682ff1c67c938b
SHA256

a41d5274599dfe60823b477ea0dc20b9c8e9b398d8b287701f8cb02ea605ad84
SHA512

19cea2ce1f1ec136b248cedd8045efdc2b94d59c6b1c01cd52179555dbdcbb3d39e135cdff7db7ba6a0e29546a41907c1f5b9cf159e0261f5ce1fa6f8c2d5642
SSDEEP

98304:0MhrN1tEkygPgPzSWOC0cq8owkp2+ngw2twGzTnVYv9f8nVOl/3Gph8Sxa/L6Iuy:XDQOCIgJnswLEgv32I/gX

Score

1^/10

Malware Config

Signatures

Files

tmulvhhft.def
.dll regsvr32 windows x86

e670c3d12bf13367add26736416ef3bb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

31/10/2007, 00:00

Not After

24/11/2010, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:3e:f5:9d:74:b9:2d:e7:2e:ce:29:62:97:09:27:98:6d:f2:68:cd
Signer

Actual PE Digest

3b:3e:f5:9d:74:b9:2d:e7:2e:ce:29:62:97:09:27:98:6d:f2:68:cd

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

17/08/2010, 03:33
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
RegCloseKey
RevertToSelf
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RegQueryValueExW
RegOpenKeyExW
InitializeSecurityDescriptor

iphlpapi

GetAdaptersInfo
NotifyAddrChange

kernel32

FindResourceW
SetThreadLocale
CreateNamedPipeW
WaitForMultipleObjectsEx
LockResource
DeleteFileW
IsProcessorFeaturePresent
SetWaitableTimer
EnterCriticalSection
IsDebuggerPresent
GetCurrentThreadId
CreateEventW
SetConsoleCtrlHandler
LeaveCriticalSection
ResumeThread
WideCharToMultiByte
OutputDebugStringA
HeapFree
SetEndOfFile
GetModuleHandleW
GetModuleFileNameA
Sleep
TerminateProcess
WaitForMultipleObjects
OpenThread
DisconnectNamedPipe
WaitForSingleObject
IsBadWritePtr
QueueUserAPC
WTSGetActiveConsoleSessionId
CreateTimerQueueTimer
UnmapViewOfFile
FindResourceExW
GetLocaleInfoW
LoadLibraryW
SetUnhandledExceptionFilter
SetEvent
GetProcAddress
GetModuleFileNameW
CreateFileW
SetThreadPriority
OutputDebugStringW
MapViewOfFile
GetCommandLineW
GetTempPathW
LocalFree
SetFilePointer
GetUserDefaultUILanguage
OpenProcess
DeleteCriticalSection
LoadResource
GetLocalTime
SizeofResource
InterlockedIncrement
GetTimeFormatA
QueryPerformanceCounter
GetSystemTime
VirtualProtect
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
OpenMutexW
InterlockedDecrement
GetTickCount
GetModuleHandleA
GetProcessHeap
GetFileSize
GetCurrentThread
ReadFile
CreateThread
GetVersion
ProcessIdToSessionId
GetACP
GetCurrentProcessId
CancelWaitableTimer
CreateWaitableTimerW
HeapAlloc
CreateMutexW
GetComputerNameW
ConnectNamedPipe
GetTimeZoneInformation
CreateFileMappingW
ResetEvent
GetLastError
TerminateThread
MultiByteToWideChar
CloseHandle
WriteFile
DeviceIoControl
DeleteTimerQueueTimer
ReleaseMutex
FindResourceA
GetTempFileNameW
GetOverlappedResult
CancelIo
SleepEx

ole32

CLSIDFromProgID
CoUninitialize
CoInitialize
CoInitializeEx
CoCreateInstance

shell32

ShellExecuteExW

shlwapi

StrStrIA

user32

LoadStringW
wsprintfA
GetWindowThreadProcessId
FindWindowW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

WSAIoctl
WSASetEvent
WSAWaitForMultipleEvents
WSAResetEvent
WSAAccept
WSAEventSelect
WSACreateEvent
WSAEnumNetworkEvents

Exports

Exports

Pronate
Divisionism
Benzophenothiazine
Stronghearted
Hyposphene
Strategian
Pampinocele
Overfanciful
Backbiter
Undergarment
Reduced
Worsening
Unweel
Aldoketene
Pogonion
Brainlike
Monotonical
Tinglingly
Phlebosclerosis
Bechtler
Combust
Navew
Sparagus
Chasmed
DllUnregisterServer
Unifacial
Squarer
Dicranterian
Tripinnate
Iridodiagnosis
Hereticalness
Axhead
Phenocryst
Emotively
Apiaca
Unprisoned
DllRegisterServer
Bovinely
Linamarin
Evangelary
Novendial
Idiotically
Cordwainer
Alphecca
Unclerkly
Vibrissae
Queery
Proinvestment
Godforsaken
Aira
Galenic
Dateless
Herbose
Turbiniform
Endemiology

Sections

.text
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e670c3d12bf13367add26736416ef3bb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08Certificate

Extended Key Usages

Key Usages

3b:3e:f5:9d:74:b9:2d:e7:2e:ce:29:62:97:09:27:98:6d:f2:68:cdSigner

Signature Validations

Verification

17/08/2010, 03:33 Valid: false

Headers

File Characteristics

Imports

advapi32

iphlpapi

kernel32

ole32

shell32

shlwapi

user32

version

ws2_32

Exports

Exports

Sections

.text Size: 7.7MB - Virtual size: 7.7MB

.data Size: 29KB - Virtual size: 29KB

.rsrc Size: 180KB - Virtual size: 180KB

.reloc Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:8f:5e:e8:26:3b:66:94:71:9d:84:34:eb:99:86:08
Certificate

3b:3e:f5:9d:74:b9:2d:e7:2e:ce:29:62:97:09:27:98:6d:f2:68:cd
Signer

17/08/2010, 03:33
Valid: false

.text
Size: 7.7MB - Virtual size: 7.7MB

.data
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 180KB - Virtual size: 180KB

.reloc
Size: 3KB - Virtual size: 3KB