POWERPNT[.]EXE

Sharing

Copy URL Twitter E-mail

General

Target

POWERPNT.EXE
Size

2.1MB
MD5

be90432789208a649ae4ed19660cadd8
SHA1

75a80742ee29efdb8b67d949cb24ef2b3f62b587
SHA256

a2c9b7fd5e831eaf9c8b2fe9b16fbe8b06b77666f1f74bb447f2a9b0e4226dad
SHA512

0ceefcf8f03c3cd65701023826ffc65dbb7a78f4ddb641618e36941a5bdfa65f4d89f7ba9a4dceffa397c1d3f91f2442291e4775f9e0f5bbbf4184df20585139
SSDEEP

49152:FhgAgyZURQJcW/tH+40IVdNRQKKL9d+Lq89TqhWzUg:FhgAgyZURQJcW/tH+40IVdQKKL9d+LqE

Score

1^/10

Malware Config

Signatures

Files

POWERPNT.EXE
.exe windows x86

f1e18036b97809b852959dde12d7cd41

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/03/2015, 17:32

Not After

20/06/2016, 17:32

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:ea
Signer

Actual PE Digest

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

14/10/2015, 15:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_decode_pointer
_amsg_exit

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
IsDebuggerPresent

ppcore

_ShowSplashScreen@0
_PPMain@0

Exports

Exports

DllGetLCID

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1e18036b97809b852959dde12d7cd41

Code Sign

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6fCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:eaSigner

Signature Validations

Verification

14/10/2015, 15:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

ppcore

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 892B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 512B - Virtual size: 328B

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

25:33:f0:6d:8f:fa:00:f9:31:fa:e6:98:32:e3:50:22:15:12:e5:ea
Signer

14/10/2015, 15:29
Valid: false

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 892B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 512B - Virtual size: 328B