35f483065a32d7729b16b05b12801fb7975aa7b2f381d805def12e2115b48c85

Sharing

Copy URL

Twitter E-mail

General

Target

35f483065a32d7729b16b05b12801fb7975aa7b2f381d805def12e2115b48c85
Size

20KB
MD5

31db28b9ce74092f277ec2b0f4b4420c
SHA1

3f227b4e84394a90e840957118612950ee8795c8
SHA256

35f483065a32d7729b16b05b12801fb7975aa7b2f381d805def12e2115b48c85
SHA512

fcd97a0f032a88efc00f83fe790e99111ee31717fd9d276f58ec149fb955c4c698049fb93b2c80268619db3adeda15c567fde1cbf460159e385da8c23d2a14e6
SSDEEP

384:U3UMokyvpTXutpRR2doYYG5MM1HMVfvNYJLjp11diXht:a1/gLipRR6cnMmVfv4L

Score

1^/10

Malware Config

Signatures

Files

35f483065a32d7729b16b05b12801fb7975aa7b2f381d805def12e2115b48c85
.exe windows:4 windows x86

43055d306256530314b1ccd147be8af4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:a8:8e:b5:3a:85:c7:29:b1:0b:3c:9c:fe:8a:90:1f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/02/2011, 00:00

Not After

29/05/2012, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=System Engineering,O=ShenZhen Thunder Networking Technologies Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

98:31:b3:ad:04:d0:80:29:50:80:fc:bd:00:23:a1:62:57:65:75:09
Signer

Actual PE Digest

98:31:b3:ad:04:d0:80:29:50:80:fc:bd:00:23:a1:62:57:65:75:09

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

ws2_32

gethostbyname
socket
htons
WSAStartup
recv
shutdown
closesocket
WSACleanup
send
connect

kernel32

GetModuleHandleA
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WritePrivateProfileStringW
lstrcatW
Sleep
DeleteFileW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW

shell32

SHGetSpecialFolderPathW

msvcr71

_CxxThrowException
_except_handler3
wcscpy
memset
wcsstr
??_V@YAXPAX@Z
wcstombs
??_U@YAPAXI@Z
wcslen
free
memmove
__CxxFrameHandler
swprintf
fclose
_locking
_filelength
_wfopen
wcscmp
__security_error_handler
??3@YAXPAX@Z
??1type_info@@UAE@XZ
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
wcsncpy
fwscanf

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

43055d306256530314b1ccd147be8af4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

7d:a8:8e:b5:3a:85:c7:29:b1:0b:3c:9c:fe:8a:90:1fCertificate

Extended Key Usages

Key Usages

98:31:b3:ad:04:d0:80:29:50:80:fc:bd:00:23:a1:62:57:65:75:09Signer

Headers

File Characteristics

Imports

shlwapi

ws2_32

kernel32

shell32

msvcr71

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 232B

.rsrc Size: 8KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

7d:a8:8e:b5:3a:85:c7:29:b1:0b:3c:9c:fe:8a:90:1f
Certificate

98:31:b3:ad:04:d0:80:29:50:80:fc:bd:00:23:a1:62:57:65:75:09
Signer

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 232B

.rsrc
Size: 8KB - Virtual size: 8KB