windows_7[.]2_m-1[.]exe[.]rar[.]1

Sharing

Copy URL

Twitter E-mail

General

Target

windows_7.2_m-1.exe.rar.1
Size

7.3MB
MD5

03dea5b2ad5e33b70045451229fd2b7b
SHA1

077c70bf772abbc3af525e52819015610ec9d6c7
SHA256

fb8dd3da8b7f2d8de5ee79279bb527a914d8d637e183edf30376735053b736e9
SHA512

393e9733b15aa7c7a9b0cec4b3ca568f282ba973028ca92084907b6ce658095d546b375e5713a3818606395048324bf2e985e8d2540ccfbcac90b0749137cdb1
SSDEEP

196608:mAXnKdxnFW09/J1LyRiW9LZxdjBa1lajbTSk0k0nqhoF:/wP1LyRigpBa1S6k0nqWF

Score

1^/10

Malware Config

Signatures

Files

windows_7.2_m-1.exe.rar.1
.rar
windows_7.2_m-1.exe.exe
.exe windows x86

90046e9abc187e6c7d24f1c321928821

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:71:9d:9e:a3:a2:1d:fd:c9:b9:4b:d1:63:5a:6c:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08-09-2009 00:00

Not After

13-09-2012 23:59

Subject

CN=Seagull Scientific\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=BarTender Development,O=Seagull Scientific\, Inc,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
SetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateDirectoryA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
Sleep
SetThreadPriority
CreateThread
WaitForSingleObject
CreateProcessA
RemoveDirectoryA
DeleteFileA
GetTempFileNameA
GetTempPathA
FlushFileBuffers
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetEndOfFile
InitializeCriticalSection
CompareStringW
CompareStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapAlloc
GetLastError
HeapFree
MultiByteToWideChar
ReadFile
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
ExitProcess
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
RaiseException
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
RtlUnwind
SetEnvironmentVariableA
SetEnvironmentVariableW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

DispatchMessageA
DestroyWindow
GetDesktopWindow
CreateDialogParamA
SetWindowLongA
GetWindowRect
SetWindowPos
ShowWindow
GetWindowLongA
SetWindowTextA
GetDlgItem
SendMessageA
UpdateWindow
GetMessageA
IsWindow
IsDialogMessageA
TranslateMessage

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90046e9abc187e6c7d24f1c321928821

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:71:9d:9e:a3:a2:1d:fd:c9:b9:4b:d1:63:5a:6c:1cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 16KB - Virtual size: 14KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:71:9d:9e:a3:a2:1d:fd:c9:b9:4b:d1:63:5a:6c:1c
Certificate

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 16KB - Virtual size: 14KB