windows6[.]1-kb976932-x86_c3516bc5c9e69fee6d9ac4f981f5b95977a8a2fa[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

windows6.1-kb976932-x86_c3516bc5c9e69fee6d9ac4f981f5b95977a8a2fa.exe
Size

537.8MB
MD5

4bf28fc00d86c936c89e2d91ef46758b
SHA1

c3516bc5c9e69fee6d9ac4f981f5b95977a8a2fa
SHA256

e5449839955a22fc4dd596291aff1433b998f9797e1c784232226aba1f8abd97
SHA512

3f0b4980b67a4fd658585a08cbe095b2bc53caf3957bbf5e17485fd28123d420d4b52949e98b20b3753b627a364e9f7aeac0d8deca416fe0521fbde32fc80bd0
SSDEEP

12582912:9TF3BNm9AEzcboId79CmNOaRkXoPw1CMFgId8T:L8+oIR9CWdwwMF7a

Score

1^/10

Malware Config

Signatures

Files

windows6.1-kb976932-x86_c3516bc5c9e69fee6d9ac4f981f5b95977a8a2fa.exe
.exe windows x86

a1b75c3d0558b3e13a1c4e7c0b7e10b7

Code Sign

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:15:23:0f:00:00:00:00:00:0a
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 21:57

Not After

07/03/2011, 21:57

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

ec:31:65:49:95:48:a0:44:19:79:71:be:bf:11:d6:53:9e:88:e0:9d
Signer

Actual PE Digest

ec:31:65:49:95:48:a0:44:19:79:71:be:bf:11:d6:53:9e:88:e0:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegOpenKeyExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW

kernel32

GetModuleHandleW
CreateThread
CreateEventW
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetSystemWindowsDirectoryW
FormatMessageW
WideCharToMultiByte
OutputDebugStringA
SetEvent
GetExitCodeProcess
WaitForSingleObject
LocalFree
GetLastError
SetLastError
ReadFile
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
GetFullPathNameW
WriteFile
Sleep
SetEndOfFile
CreateFileW
SetFilePointer
GetFileSize
HeapDestroy
OutputDebugStringW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
HeapAlloc
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree

user32

RegisterClassExW
CreateWindowExW
DestroyWindow
MessageBoxW
GetDesktopWindow
DefWindowProcW
GetWindowLongW
MsgWaitForMultipleObjects
UnregisterClassA
TranslateMessage
DispatchMessageW
PeekMessageW
SetWindowLongW

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
ferror
wctomb
_itoa
_snprintf
_iob
isleadbyte
__mb_cur_max
mbtowc
_controlfp
?terminate@@YAXXZ
memmove
memcpy
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
_errno
__CxxFrameHandler
_vscprintf
wcschr
memset
_vsnwprintf
??2@YAPAXI@Z
calloc
free
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_wcsicmp
_wcsnicmp
isdigit
_wtol
_vscwprintf
_CxxThrowException
??3@YAXPAX@Z
_vsnprintf

shell32

ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree

ntdll

RtlUnwind

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1b75c3d0558b3e13a1c4e7c0b7e10b7

Code Sign

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:15:23:0f:00:00:00:00:00:0aCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

ec:31:65:49:95:48:a0:44:19:79:71:be:bf:11:d6:53:9e:88:e0:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

ntdll

Sections

.text Size: 200KB - Virtual size: 199KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 19KB - Virtual size: 19KB

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:15:23:0f:00:00:00:00:00:0a
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

ec:31:65:49:95:48:a0:44:19:79:71:be:bf:11:d6:53:9e:88:e0:9d
Signer

.text
Size: 200KB - Virtual size: 199KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 19KB - Virtual size: 19KB