69aa87e5ccd1abb5f8bf3d1f17d60bcc6c5749a2e141fd39cd28aafd173a71ff

Sharing

Copy URL Twitter E-mail

General

Target

69aa87e5ccd1abb5f8bf3d1f17d60bcc6c5749a2e141fd39cd28aafd173a71ff
Size

469KB
MD5

9d864313b9b30b698fa7fb0abfd29afc
SHA1

62d6b43832609c7764a7866d522005f8439bee0b
SHA256

69aa87e5ccd1abb5f8bf3d1f17d60bcc6c5749a2e141fd39cd28aafd173a71ff
SHA512

b2edc16772a9c8f0ccafd182168a35f8e474c0bc5a981c89dc6c416a6092508742de9d36faeea738e57b431c39a8de7127402f3a734f42cb9b53224d622bfc63
SSDEEP

12288:zQsrGf2tFUqrLYpi324+zl676jDL+tOABDbReTjVME3jn7:zVKfFmP21zl7ONxteTp9j7

Score

1^/10

Malware Config

Signatures

Files

69aa87e5ccd1abb5f8bf3d1f17d60bcc6c5749a2e141fd39cd28aafd173a71ff
.exe windows x64

770059e4ea9e4fc7388bbb4491e6165b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:d5:28:03:ae:99:c1:bb:72:71:65:45:3e:a9:8c:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

02/07/2010, 00:00

Not After

01/07/2012, 23:59

Subject

CN=BitDefender SRL,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BitDefender SRL,L=Bucharest,ST=Bucharest,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:4d:e9:a0:25:55:f0:d5:64:39:ad:d9:0a:d8:10:49:85:c9:a5:0a
Signer

Actual PE Digest

1a:4d:e9:a0:25:55:f0:d5:64:39:ad:d9:0a:d8:10:49:85:c9:a5:0a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentThreadId
SuspendThread
HeapWalk
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
SetEvent
GetCurrentThread
WaitForSingleObject
CreateThread
ResetEvent
AddVectoredExceptionHandler
GetCurrentProcessId
GetProcessHeap
CreateEventA
OpenThread
WriteConsoleW
HeapReAlloc
Thread32First
Thread32Next
VirtualAlloc
VirtualFree
VirtualProtect
lstrcatA
CloseHandle
lstrlenA
HeapSize
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
CreateFileW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualQuery
VirtualProtectEx
VirtualQueryEx
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
SetFilePointerEx
GetConsoleMode
GetFileType
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

MessageBoxA

advapi32

CryptAcquireContextA
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey

wininet

InternetOpenA
InternetReadFile
HttpOpenRequestA
HttpQueryInfoA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetCrackUrlA

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 262KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

770059e4ea9e4fc7388bbb4491e6165b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0a:d5:28:03:ae:99:c1:bb:72:71:65:45:3e:a9:8c:b3Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

1a:4d:e9:a0:25:55:f0:d5:64:39:ad:d9:0a:d8:10:49:85:c9:a5:0aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

wininet

Sections

.text Size: 128KB - Virtual size: 128KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 262KB - Virtual size: 267KB

.pdata Size: 7KB - Virtual size: 7KB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 3KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0a:d5:28:03:ae:99:c1:bb:72:71:65:45:3e:a9:8c:b3
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

1a:4d:e9:a0:25:55:f0:d5:64:39:ad:d9:0a:d8:10:49:85:c9:a5:0a
Signer

.text
Size: 128KB - Virtual size: 128KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 262KB - Virtual size: 267KB

.pdata
Size: 7KB - Virtual size: 7KB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 3KB - Virtual size: 2KB