b5de4d56352d382875ca06ac268744fa2670ef29b932975605b8f6b91601dc0f

Sharing

Copy URL Twitter E-mail

General

Target

b5de4d56352d382875ca06ac268744fa2670ef29b932975605b8f6b91601dc0f
Size

1.8MB
MD5

01fa8b970506fe528c213811621cf56e
SHA1

10ca71784cdc0581f155398bc1cebe9b3e95d999
SHA256

b5de4d56352d382875ca06ac268744fa2670ef29b932975605b8f6b91601dc0f
SHA512

275b6804f8391579b6a74009205cdd86f0c98dcd7022fb6e25098a4b67e65aa4647542ff01e5761593490f4f2b1393aa9f63efcfc3d607b81c95592140a1fe7a
SSDEEP

24576:0UKEGww0T5HsKlgjfTwabYmIZPfBc6YTO12/JojO5Ns4udTf+c:BKEGwd5Hej9bY5QTONOjUdTf+c

Score

1^/10

Malware Config

Signatures

Files

b5de4d56352d382875ca06ac268744fa2670ef29b932975605b8f6b91601dc0f
.exe windows x86

c8d13a4da83847bdd0a6943ab489b52d

Code Sign

4e:47:59:de:d1:08:b6:64:b2:1f:9a:ac:d5:20:98:8b
Certificate

Issuer

CN=KZTechs.COM Root Certificate Authority,OU=Smallfrogs,O=KZTechs.COM,C=CN,1.2.840.113549.1.9.1=#0c13737570706f7274406b7a74656368732e636f6d

Not Before

06/09/2009, 05:43

Not After

06/09/2029, 05:43

Subject

CN=Smallfrogs

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:31:f0:1a:c5:25:da:cb:a7:d9:b0:86:59:6c:fd:18:b1:45:35:b1
Signer

Actual PE Digest

99:31:f0:1a:c5:25:da:cb:a7:d9:b0:86:59:6c:fd:18:b1:45:35:b1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
CloseHandle
WriteFile
FlushFileBuffers
CreateFileA
GetVersionExA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetTempPathA
CreateDirectoryA
GetTempFileNameA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
GetLocalTime
CreateProcessA
FreeLibrary
CreateEventA
ResetEvent
CreateThread
GetFileSize
CreateFileMappingA
TerminateThread
MapViewOfFile
SetFileAttributesA
MoveFileExA
UnmapViewOfFile
DeleteFileA
WaitForSingleObject
GetCurrentThreadId
Sleep
GetModuleHandleA
InterlockedExchange
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetACP
GetLocaleInfoA
GetThreadLocale
GetSystemTimeAsFileTime
VirtualAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetOEMCP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RaiseException
GetConsoleCP
GetConsoleMode
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle

advapi32

RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c8d13a4da83847bdd0a6943ab489b52d

Code Sign

4e:47:59:de:d1:08:b6:64:b2:1f:9a:ac:d5:20:98:8bCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

99:31:f0:1a:c5:25:da:cb:a7:d9:b0:86:59:6c:fd:18:b1:45:35:b1Signer

Headers

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 1.7MB - Virtual size: 1.7MB

.rsrc Size: 32KB - Virtual size: 32KB

4e:47:59:de:d1:08:b6:64:b2:1f:9a:ac:d5:20:98:8b
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

99:31:f0:1a:c5:25:da:cb:a7:d9:b0:86:59:6c:fd:18:b1:45:35:b1
Signer

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 1.7MB - Virtual size: 1.7MB

.rsrc
Size: 32KB - Virtual size: 32KB