ba195573fd36335a022dace93747733e90a2d7558a4aec25b0b04d1129e37650

Sharing

Copy URL Twitter E-mail

General

Target

ba195573fd36335a022dace93747733e90a2d7558a4aec25b0b04d1129e37650
Size

260KB
MD5

294da61948543a8ae0a9b7d97dc3e8da
SHA1

eb1a232ee2f354d56b9d8b720d13e011cbb0823d
SHA256

ba195573fd36335a022dace93747733e90a2d7558a4aec25b0b04d1129e37650
SHA512

611699e859a41aef835056a65f413cfcfe4de01d8e7b2ada75cdd2a0a1fcec514abe091dc229e2de9463b63272405fab80e3b078cf66c170de6a14bde5cf322f
SSDEEP

3072:wUnPk13/I5JZdRtRs5GI34DayQrO96mZIuJLVLtRHhjHqRMO1KqKTCiIHhfLl3l:jY3/I5JZ7jxgrSnxHqVKE

Score

1^/10

Malware Config

Signatures

Files

ba195573fd36335a022dace93747733e90a2d7558a4aec25b0b04d1129e37650
.exe windows:4 windows x86

822f8d4d6cff9b98a9fd369c0a8672f8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:5e:20:a8:0b:54:a4:5d:36:f6:c0:6b:9b:02:f9:3a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

27/06/2007, 00:00

Not After

26/06/2009, 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoSizeA

wininet

HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoA
HttpOpenRequestA
InternetGetConnectedState

kernel32

GetConsoleMode
GetConsoleCP
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
IsDBCSLeadByte
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
ResetEvent
SetEvent
GetCommandLineA
CloseHandle
CreateEventA
CreateProcessA
Sleep
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
CreateThread
Process32Next
Process32First
CreateToolhelp32Snapshot
FlushInstructionCache
GetCurrentProcess
SetLastError
WriteFile
SetFilePointer
CreateFileA
ProcessIdToSessionId
GetCurrentProcessId
TerminateThread
GetExitCodeThread
CopyFileW
FlushFileBuffers
CreateFileW
OutputDebugStringA
SetStdHandle
DebugBreak
GlobalFree
GlobalAlloc
GetLocaleInfoW
GetUserDefaultLCID
GetSystemDefaultLangID
LoadLibraryW
GetProcAddress
VerifyVersionInfoA
VerSetConditionMask
LoadLibraryA
CreateMutexW
ReleaseMutex
CreateMutexA
GetSystemDirectoryA
LCMapStringW
LCMapStringA
HeapSize
GetStdHandle
ExitProcess
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
GetFileAttributesA
GetStartupInfoA
IsDebuggerPresent
SetUnhandledExceptionFilter
HeapFree
UnhandledExceptionFilter
TerminateProcess
GetLocalTime
ExitThread
GetSystemTimeAsFileTime
GetTimeZoneInformation
HeapReAlloc
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsA
InterlockedCompareExchange
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetModuleFileNameW
GetEnvironmentStrings
GetStringTypeW
GetStringTypeA
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapAlloc
GetVersionExA

user32

wsprintfA
LoadStringA
KillTimer
RegisterClassA
CreateWindowExA
GetPropA
DefWindowProcA
SetPropA
GetDesktopWindow
MessageBeep
CreateDialogParamA
GetForegroundWindow
GetWindowThreadProcessId
IsIconic
SetForegroundWindow
PostQuitMessage
ShowWindow
SendMessageA
GetMessageA
DispatchMessageA
TranslateMessage
PostThreadMessageA
CharUpperA
SetWindowLongA
UnhookWindowsHookEx
SetWindowsHookExA
DestroyWindow
CallNextHookEx
CharNextA
SetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
PostMessageA
UnregisterClassA
AttachThreadInput

advapi32

RegOpenKeyW
RegQueryValueExW
RegQueryValueExA
GetUserNameA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExW

ole32

CoInitialize
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoRevokeClassObject
CoUninitialize
CoInitializeEx
GetRunningObjectTable
CreateClassMoniker

oleaut32

LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarBstrCat
SysAllocStringLen
SysStringLen
SysFreeString
VarUI4FromStr

shlwapi

PathFileExistsA

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

822f8d4d6cff9b98a9fd369c0a8672f8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

09:5e:20:a8:0b:54:a4:5d:36:f6:c0:6b:9b:02:f9:3aCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

version

wininet

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Sections

.text Size: 123KB - Virtual size: 123KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 92KB - Virtual size: 91KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

09:5e:20:a8:0b:54:a4:5d:36:f6:c0:6b:9b:02:f9:3a
Certificate

.text
Size: 123KB - Virtual size: 123KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 92KB - Virtual size: 91KB