AddFlow5[.]ocx

Sharing

Copy URL

Twitter E-mail

General

Target

AddFlow5.ocx
Size

373KB
MD5

68feac1f1c315a28f3a67c755ebc841c
SHA1

fe9aece41b488b0cdf0de66e7d988be4ddffbfdb
SHA256

b3afdd1d9e57d729523c0d80333d2359fc682963d0133cb8a8d9eeae8f28751a
SHA512

f0a1b9a167b94c1a214beaa0939166b602a850eba67e16c72b5c027e37c2d722f3cfa3c2031c78188c156675f732ab76ee14c4b9783f39bef96938a0e5eba55e
SSDEEP

6144:teftUJD0NnlB1UAPVbXkb00XeJx4psckOwlm+gCQllp94b:tQtUOYH69Gt4

Score

1^/10

Malware Config

Signatures

Files

AddFlow5.ocx
.dll regsvr32 windows x86

aa9f858bd8e34b62aa5e119e6092ff63

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1c:21:e5:27:1a:dc:71:cb:f6:15:90:bc:b4:b3:d0:80
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

14/02/2007, 00:00

Not After

22/03/2008, 23:59

Subject

CN=Lassalle Patrick,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Lassalle Patrick,L=Boulogne,ST=Hauts-de-Seine,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord2137
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4661
ord4660
ord4768
ord4650
ord4903
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord5060
ord4584
ord4371
ord4361
ord4356
ord4739
ord4741
ord4738
ord4409
ord4603
ord5008
ord4415
ord4992
ord4979
ord2488
ord3404
ord2954
ord6055
ord4078
ord1776
ord4407
ord5241
ord2384
ord5163
ord4353
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord2446
ord2124
ord5277
ord2983
ord3148
ord3260
ord4466
ord3269
ord2986
ord3080
ord4081
ord4624
ord5825
ord772
ord758
ord809
ord699
ord723
ord2636
ord3946
ord500
ord475
ord556
ord397
ord423
ord715
ord6142
ord5261
ord1088
ord2122
ord4459
ord4502
ord4025
ord6030
ord1685
ord1601
ord4018
ord2150
ord5033
ord6194
ord3752
ord2795
ord3237
ord3571
ord3626
ord3663
ord640
ord2405
ord2414
ord4023
ord6189
ord5678
ord5647
ord5736
ord3502
ord3820
ord6186
ord6192
ord6021
ord5785
ord1641
ord1640
ord323
ord4133
ord4297
ord6119
ord5574
ord3057
ord283
ord6281
ord5875
ord5329
ord5315
ord5327
ord5313
ord5323
ord5331
ord5332
ord2541
ord2794
ord4949
ord5233
ord5269
ord2514
ord5265
ord4998
ord6052
ord1775
ord2385
ord6374
ord5280
ord3262
ord4627
ord4425
ord3597
ord641
ord324
ord6370
ord2859
ord6261
ord4636
ord6084
ord4982
ord4083
ord2868
ord1979
ord6385
ord5186
ord354
ord603
ord1969
ord273
ord5495
ord2558
ord703
ord404
ord2454
ord3318
ord1643
ord403
ord5860
ord3945
ord362
ord3204
ord2730
ord268
ord2450
ord406
ord5290
ord6128
ord5767
ord5979
ord2379
ord6002
ord4743
ord4996
ord4915
ord4756
ord4760
ord4788
ord4765
ord5981
ord6199
ord2860
ord3206
ord2089
ord3874
ord6358
ord3003
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord1227
ord6041
ord1799
ord614
ord2623
ord290
ord4226
ord4003
ord5450
ord6394
ord5440
ord6383
ord1206
ord2727
ord1223
ord4530
ord4544
ord5685
ord3274
ord3579
ord439
ord736
ord4042
ord3027
ord2614
ord4204
ord3456
ord672
ord5325
ord5333
ord860
ord861
ord6170
ord2915
ord5855
ord771
ord768
ord2528
ord1008
ord497
ord616
ord609
ord5575
ord2464
ord3525
ord1656
ord434
ord3610
ord567
ord656
ord4275
ord912
ord4188
ord5782
ord6086
ord5225
ord5227
ord1892
ord4252
ord6364
ord3326
ord6365
ord1212
ord4570
ord4672
ord4843
ord5011
ord4713
ord6371
ord5286
ord4438
ord3279
ord4625
ord449
ord746
ord2278
ord6101
ord3535
ord2298
ord2282
ord2301
ord2266
ord2362
ord2364
ord2284
ord4258
ord2411
ord2023
ord4218
ord2578
ord4398
ord3402
ord3582
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4358
ord4377
ord4854
ord5287
ord4835
ord3699
ord489
ord3089
ord2302
ord3317
ord4710
ord6241
ord3092
ord6334
ord5788
ord472
ord4396
ord3574
ord5791
ord2370
ord2818
ord3721
ord795
ord755
ord6880
ord470
ord3790
ord4224
ord1147
ord3499
ord2515
ord355
ord3701
ord5606
ord5823
ord3664
ord415
ord1081
ord5620
ord5641
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord353
ord5442
ord940
ord537
ord665
ord1567
ord1168
ord1210
ord1226
ord6467
ord1177
ord446
ord743
ord3681
ord4424
ord4622
ord4920
ord4856
ord2156
ord5674
ord4639
ord4687
ord4342
ord994
ord5618
ord1693
ord2439
ord1614
ord539
ord4129
ord5710
ord4811
ord535
ord4080
ord3079
ord3825
ord3831
ord3830
ord3353
ord2976
ord3081
ord2985
ord3278
ord3136
ord4465
ord3259
ord3147
ord2982
ord5498
ord4472
ord2687
ord2486
ord4249
ord1877
ord825
ord823
ord6042
ord3457
ord5492
ord2496
ord2901
ord5868
ord3230
ord3119
ord5959
ord2911
ord5880
ord3203
ord5984
ord2889
ord5854
ord4376
ord4853
ord540
ord4160
ord924
ord858
ord800
ord922
ord5953
ord5631
ord4234
ord1131

msvcrt

__CxxFrameHandler
_EH_prolog
memcmp
wcstombs
wcslen
strcpy
_mbsrchr
_mbscmp
rand
srand
time
memset
_ftol
abs
memcpy
_purecall
atoi
acos
sqrt
qsort
cos
sin
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv

kernel32

LocalFree
FindResourceA
SizeofResource
LoadResource
LockResource
GetVersionExA
MultiByteToWideChar
lstrlenA
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
MulDiv
GetModuleFileNameA
LocalAlloc

user32

DrawFocusRect
FillRect
UpdateWindow
GetCursorPos
SetCursor
LoadCursorA
ScreenToClient
SetTimer
CloseClipboard
GetSystemMetrics
EmptyClipboard
OpenClipboard
IsWindow
GetClipboardData
IsClipboardFormatAvailable
UnionRect
EnableWindow
KillTimer
GetWindowRect
FrameRect
RegisterClipboardFormatA
SetRectEmpty
SendMessageA
GetSysColor
ReleaseDC
GetDC
IntersectRect
CopyRect
OffsetRect
SetRect
SetClipboardData
InflateRect
GetParent
SetWindowLongA
ShowScrollBar
GetWindowLongA
IsRectEmpty
EqualRect
PostMessageA
PtInRect
GetDoubleClickTime
DrawTextA
GetKeyState
DrawIconEx
DrawEdge
InvalidateRect

gdi32

DeleteObject
RestoreDC
IntersectClipRect
SaveDC
BitBlt
DPtoLP
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
GetStockObject
LPtoDP
SetBrushOrgEx
UnrealizeObject
SetPixel
CreatePen
DeleteEnhMetaFile
PlayEnhMetaFile
GetCurrentPositionEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
GetMetaFileBitsEx
CloseEnhMetaFile
CreateEnhMetaFileA
CreateBitmap
CreateDCA
CreateFontIndirectA
GetObjectA
Polyline
PolyBezier
Arc
AngleArc
GetArcDirection
CreateSolidBrush
GetPath
FlattenPath
GetTextExtentPoint32A
Ellipse
Polygon
LineTo
MoveToEx
GetTextMetricsA
TextOutA
CreateDIBitmap
StretchDIBits
GetDIBits
GetSystemPaletteEntries
SetTextColor
SetBkMode
PathToRegion
StretchBlt
SetPixelV
StrokeAndFillPath
RoundRect
Rectangle
PtInRegion
EndPath
BeginPath
CloseFigure
GetPaletteEntries
CreatePalette
GetNearestColor
RealizePalette
GetDeviceCaps

shell32

DragQueryFileA

ole32

CreateStreamOnHGlobal
ReleaseStgMedium

olepro32

ord252
ord251

oleaut32

VariantClear
VariantInit
VariantCopy
SysAllocString
SysStringLen
SysFreeString
LoadRegTypeLi
VariantChangeType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa9f858bd8e34b62aa5e119e6092ff63

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

1c:21:e5:27:1a:dc:71:cb:f6:15:90:bc:b4:b3:d0:80Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

shell32

ole32

olepro32

oleaut32

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 178KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 120KB - Virtual size: 118KB

.reloc Size: 16KB - Virtual size: 15KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

1c:21:e5:27:1a:dc:71:cb:f6:15:90:bc:b4:b3:d0:80
Certificate

.text
Size: 180KB - Virtual size: 178KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 120KB - Virtual size: 118KB

.reloc
Size: 16KB - Virtual size: 15KB