cd4ea0ad8da3a67c38eabc46a728d2d25a17d6a807f049ba9047533e637958e6

Sharing

Copy URL

Twitter E-mail

General

Target

cd4ea0ad8da3a67c38eabc46a728d2d25a17d6a807f049ba9047533e637958e6
Size

1.6MB
MD5

43e79659e14c5d7fed98a193c5f808ad
SHA1

8c162457d70b4dc8c4038b55d66386b47e1d49c1
SHA256

cd4ea0ad8da3a67c38eabc46a728d2d25a17d6a807f049ba9047533e637958e6
SHA512

f56f94ace43d0f3dc456c05315c737700faafdec06f45bf144946a5e62d4aedb6f8649feba4082b92cad765059d5260b7c028df7cc90cf6b4fa682d0899559c0
SSDEEP

49152:C57wtn5Esc+QwlArcF96eLs3kT4k+jX/A6Kr9LYmaKLqfin12:Egn5EiQkVFds3kT4k+jX/A3LkKLqfaI

Score

1^/10

Malware Config

Signatures

Files

cd4ea0ad8da3a67c38eabc46a728d2d25a17d6a807f049ba9047533e637958e6
.exe windows:5 windows x86

053c785164f4e6069a294a58398e4b9e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1e:f0:ac:7f:b1:03:a0:25:c1:e8:11:88:99:c5:99:97
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/07/2011, 00:00

Not After

06/09/2014, 23:59

Subject

CN=TechSmith Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TechSmith Corporation,L=Okemos,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:f8:9d:64:97:4c:58:64:7e:a8:a9:3b:7e:34:79:2d:0e:4a:bb:42
Signer

Actual PE Digest

31:f8:9d:64:97:4c:58:64:7e:a8:a9:3b:7e:34:79:2d:0e:4a:bb:42

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate
UuidFromStringA
UuidToStringA

kernel32

GetConsoleCP
GetConsoleMode
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetTimeZoneInformation
GetOEMCP
SetEnvironmentVariableA
GetACP
LoadLibraryA
IsBadReadPtr
GetProcessHeap
SizeofResource
LockResource
LoadResource
GetStringTypeW
LCMapStringW
IsValidCodePage
GetCPInfo
IsProcessorFeaturePresent
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapDestroy
HeapCreate
SetHandleCount
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapSize
HeapQueryInformation
GetFileType
SetStdHandle
CreateThread
ExitThread
HeapReAlloc
ExitProcess
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
DecodePointer
FindResourceW
FindFirstFileW
GetModuleFileNameW
EncodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
VirtualProtect
SearchPathW
GetProfileIntW
GetTempFileNameW
SetErrorMode
GlobalFlags
GetSystemDirectoryW
GetCurrentDirectoryW
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetFileSizeEx
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrlenA
GlobalFindAtomW
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GlobalAddAtomW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
WaitForSingleObject
ResumeThread
SetThreadPriority
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
FreeResource
lstrcmpA
GlobalDeleteAtom
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
ActivateActCtx
DeactivateActCtx
LoadLibraryExW
InterlockedExchange
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
SetLastError
Sleep
GetFileSize
GetCurrentThreadId
FindResourceExW
GetUserDefaultLCID
GetNumberFormatW
GetFileAttributesExW
lstrcmpiW
GetTempPathW
lstrcmpW
LoadLibraryW
FreeLibrary
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
DeleteFileW
GetFileTime
GetLastError
GetTickCount
lstrlenW
lstrcpyW
CreateFileW
CloseHandle
CopyFileW
GetFileAttributesW
FindClose
MultiByteToWideChar
GetWindowsDirectoryW
WideCharToMultiByte
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetVersion
GetVersionExW

user32

MonitorFromPoint
UnionRect
UpdateLayeredWindow
IsMenu
CreateMenu
PostThreadMessageW
SetMenuDefaultItem
IsClipboardFormatAvailable
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
CopyIcon
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
SubtractRect
MapDialogRect
GetWindowRgn
MessageBeep
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
CreatePopupMenu
DestroyAcceleratorTable
SetParent
CopyImage
DestroyIcon
UnregisterClassW
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
RealChildWindowFromPoint
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
DeleteMenu
GetSysColorBrush
LoadMenuW
MapVirtualKeyW
GetKeyNameTextW
CharUpperW
DestroyMenu
GetMenuItemInfoW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetWindowTextW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
RedrawWindow
CreateWindowExW
TranslateMDISysAccel
GetClassInfoW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
GetWindow
GetLastActivePopup
ShowOwnedPopups
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
IsWindowVisible
PeekMessageW
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
EnableMenuItem
CheckMenuItem
UnhookWindowsHookEx
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetWindowLongW
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
DrawIcon
SystemParametersInfoW
DrawFrameControl
DrawEdge
FrameRect
GetKeyState
GetTabbedTextExtentW
SetCursorPos
DrawTextW
IntersectRect
OffsetRect
InflateRect
PtInRect
IsRectEmpty
FindWindowW
SendMessageTimeoutW
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
IsIconic
ShowWindow
WaitForInputIdle
SetFocus
PostQuitMessage
PostMessageW
LoadCursorW
EnableWindow
RegisterClassW
LoadIconW
GetSystemMetrics
CopyRect
GetDlgItem
MessageBoxW
RegisterWindowMessageW
GetSysColor
LoadImageW
LoadCursorFromFileW
DestroyCursor
IsWindow
SetCursor
GetCursorPos
GetCursor
ShowCursor
GetForegroundWindow
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
GetNextDlgGroupItem
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
TranslateAcceleratorW
LockWindowUpdate
BringWindowToTop
SetRect
CreateAcceleratorTableW
KillTimer
SetTimer
InvalidateRect
UpdateWindow
ReleaseDC
GetDC
ScreenToClient
GetClientRect
GetWindowRect
SetWindowRgn
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
DrawStateW
DrawFocusRect
GetClassInfoExW
DrawIconEx
FillRect
AppendMenuW
ModifyMenuW
SendMessageW
GetSystemMenu
IsZoomed
CopyAcceleratorTableW

gdi32

DeleteDC
GetTextExtentPoint32W
Rectangle
RoundRect
Ellipse
GetTextMetricsW
GetDeviceCaps
CopyMetaFileW
CreateDCW
CreateBitmap
SaveDC
RestoreDC
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SetBkMode
GetObjectType
CreateHatchBrush
CreateRectRgnIndirect
SetRectRgn
PatBlt
DPtoLP
CreateDIBitmap
CreateCompatibleBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreatePolygonRgn
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Polygon
CreatePalette
GetNearestPaletteIndex
GetSystemPaletteEntries
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceW
SetPixelV
SetTextColor
SetBkColor
SelectPalette
RealizePalette
SetStretchBltMode
StretchDIBits
SetPixel
GetPixel
GetObjectW
CreateFontIndirectW
CreatePen
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
GetPaletteEntries
CombineRgn
CreateRectRgn
CreateBrushIndirect
DeleteObject
UpdateColors
CreateRoundRectRgn
CreateEllipticRgnIndirect
GetStockObject
GetDIBColorTable
CreateHalftonePalette
CreateSolidBrush

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
RegCloseKey
RegEnumValueW
RegQueryValueW

shell32

ShellExecuteW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHAppBarMessage
SHGetDesktopFolder
DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteExW
SHBrowseForFolderW

comctl32

ImageList_GetIconSize

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW

ole32

OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoTaskMemAlloc
ReleaseStgMedium
DoDragDrop
CreateStreamOnHGlobal
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
OleDuplicateData
CoCreateGuid
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

053c785164f4e6069a294a58398e4b9e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

1e:f0:ac:7f:b1:03:a0:25:c1:e8:11:88:99:c5:99:97Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

31:f8:9d:64:97:4c:58:64:7e:a8:a9:3b:7e:34:79:2d:0e:4a:bb:42Signer

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

gdiplus

imm32

winmm

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 288KB - Virtual size: 288KB

.data Size: 24KB - Virtual size: 54KB

.rsrc Size: 88KB - Virtual size: 87KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

1e:f0:ac:7f:b1:03:a0:25:c1:e8:11:88:99:c5:99:97
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

31:f8:9d:64:97:4c:58:64:7e:a8:a9:3b:7e:34:79:2d:0e:4a:bb:42
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 288KB - Virtual size: 288KB

.data
Size: 24KB - Virtual size: 54KB

.rsrc
Size: 88KB - Virtual size: 87KB