bd9a13b6c5ab78f73c2b9493c3ebb45945f11554c36d55c01aff5e753594a88a

Sharing

Copy URL Twitter E-mail

General

Target

bd9a13b6c5ab78f73c2b9493c3ebb45945f11554c36d55c01aff5e753594a88a
Size

4.3MB
MD5

a3250bd21f2219eff9b3f9da659c4d52
SHA1

76226c45626e81c140fb609365895fec1e3df049
SHA256

bd9a13b6c5ab78f73c2b9493c3ebb45945f11554c36d55c01aff5e753594a88a
SHA512

13f6cb1bb80e308c5ef541093d9c0bf09ceac084e4710bd7b231cb4fff09b0205d8907815d21122110064ef247d356f32f6793f2540a2259221c813b9f945ea5
SSDEEP

49152:NGxhfs/0HaWWjpjGrzDfKlY6wMPZyH4DvPmMcYz6bXr4eWLWlZ7ViUvwf/lT0f/0:oxhfs/06ZpGrwtHmMc1DiPYtu

Score

1^/10

Malware Config

Signatures

Files

bd9a13b6c5ab78f73c2b9493c3ebb45945f11554c36d55c01aff5e753594a88a
.exe windows:5 windows x86

a795d7065cf61c7d951905f45dc470c1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/11/2007, 00:00

Not After

10/12/2008, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:c5:40:3e:17:f4:28:67:15:ba:79:c8:5e:d8:b3:f2:59:6b:f5:20
Signer

Actual PE Digest

bd:c5:40:3e:17:f4:28:67:15:ba:79:c8:5e:d8:b3:f2:59:6b:f5:20

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoA

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CryptVerifyMessageSignature
CertCloseStore

urlmon

CopyStgMedium

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

waveOutGetDevCapsA
waveInGetDevCapsA
waveOutGetNumDevs
waveOutOpen
waveInStart
waveInAddBuffer
waveInGetNumDevs
waveInOpen
timeSetEvent
timeKillEvent
waveOutGetPosition
timeBeginPeriod
timeGetTime
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetDevCaps
waveInPrepareHeader
timeEndPeriod

oleaut32

SysFreeString

kernel32

FreeLibrary
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetFileAttributesA
GetSystemInfo
GetUserDefaultLangID
ExitThread
GlobalFree
WriteFile
SetFilePointer
CreateFileA
ReadFile
GetFileSize
LockResource
LoadResource
FindResourceExA
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
CreateDirectoryA
GetModuleFileNameA
CreateMutexA
CreateFileW
GetCurrentDirectoryA
GlobalAlloc
GetFullPathNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetFileAttributesExA
SetCurrentDirectoryA
RemoveDirectoryA
SetFilePointerEx
GetFileSizeEx
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
lstrcpyA
lstrlenA
IsDBCSLeadByteEx
GetModuleHandleA
GetCommandLineW
DeleteFileW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
VirtualProtect
CreateSemaphoreA
ReleaseSemaphore
UnhandledExceptionFilter
GetStdHandle
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetCurrentProcess
GetProcessTimes
CreateWaitableTimerA
CreateThread
SetWaitableTimer
WaitForSingleObject
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
CreateProcessA
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
FlushInstructionCache
GetLocaleInfoA
SetErrorMode
GetLastError
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
VirtualQuery
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ResetEvent
CreateEventA
CloseHandle
WaitForMultipleObjects
SetEvent
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
VirtualProtectEx
IsDebuggerPresent
HeapCreate
HeapReAlloc
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
RaiseException
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetTempFileNameA

user32

LoadAcceleratorsA
GetWindowTextLengthA
GetDlgItemTextA
EnableWindow
SetDlgItemTextW
SetDlgItemTextA
GetWindowTextA
ShowWindow
UpdateWindow
UnregisterClassA
RemoveMenu
InsertMenuW
InsertMenuA
SetMenu
MoveWindow
LoadStringW
EnumDisplaySettingsA
GetWindow
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowLongA
GetWindowThreadProcessId
IsWindow
CreateWindowExA
SetCapture
ReleaseCapture
GetMenuItemID
DeleteMenu
InsertMenuItemA
TrackPopupMenu
DefWindowProcA
GetCapture
WindowFromPoint
GetFocus
DestroyWindow
GetMenu
LoadCursorA
SetCursor
GetMessageA
ScreenToClient
KillTimer
SetTimer
LoadMenuA
GetSubMenu
DestroyMenu
BeginPaint
GetWindowTextLengthW
EnableMenuItem
CheckMenuItem
InvalidateRect
MapVirtualKeyA
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
DialogBoxParamA
GetClientRect
LoadStringA
RedrawWindow
DialogBoxIndirectParamW
DialogBoxIndirectParamA
PostMessageA
SetWindowLongA
GetParent
GetWindowRect
GetDesktopWindow
SetWindowPos
LoadIconA
GetDlgItem
SendMessageA
SetWindowTextA
SetFocus
GetMenuItemCount
GetMenuItemInfoA
SystemParametersInfoA
InsertMenuItemW
GetSystemMetrics
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeA
DdeCreateStringHandleA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
RegisterClassA
GetMenuStringW
GetMenuStringA
GetCursorPos
PostQuitMessage
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
SendInput
GetKeyboardLayout
FillRect
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoA
OffsetRect
SetRect
MonitorFromWindow
GetDoubleClickTime
EndPaint
GetDlgItemTextW
EndDialog

gdi32

GetPixel
GetObjectA
CreateDIBSection
DeleteObject
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutA
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
GetICMProfileA
CreateDCA
GetStockObject
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesA
MoveToEx
DeleteDC
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
CreatePen
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
GetSystemPaletteEntries
GetClipBox
LPtoDP
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
CreateCompatibleDC
GdiFlush
RestoreDC
SelectClipPath
PolyBezierTo
LineTo
SetTextAlign
EndPath
BeginPath
SaveDC
SetPolyFillMode
EndPage
GetFontData
SetBkMode
EnumFontFamiliesExW
StartPage

comdlg32

CommDlgExtendedError
GetOpenFileNameA
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW
GetSaveFileNameA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shell32

DragQueryFileA
DragAcceptFiles
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
DragQueryFileW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitialize
CreateBindCtx
ReleaseStgMedium
CoUninitialize
OleUninitialize
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
OleInitialize
OleFlushClipboard

mscms

DeleteColorTransform
OpenColorProfileA
CloseColorProfile
CreateColorTransformW
TranslateBitmapBits

ws2_32

inet_ntoa
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohl
ioctlsocket
select
gethostname
WSAAddressToStringA
WSACleanup
sendto
recvfrom
connect
setsockopt
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
htonl
closesocket
gethostbyname
inet_addr
getsockname
ntohs
bind
send
recv
WSAStartup
WSASocketA
socket
WSAAsyncSelect
WSAIoctl
WSAGetLastError
WSACloseEvent

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 499KB - Virtual size: 499KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a795d7065cf61c7d951905f45dc470c1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6dCertificate

Extended Key Usages

Key Usages

bd:c5:40:3e:17:f4:28:67:15:ba:79:c8:5e:d8:b3:f2:59:6b:f5:20Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

crypt32

urlmon

version

winmm

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

mscms

ws2_32

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 499KB - Virtual size: 499KB

.data Size: 105KB - Virtual size: 960KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 358KB - Virtual size: 358KB

.reloc Size: 96KB - Virtual size: 96KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4b:ea:81:7c:ba:c7:c3:8a:ba:72:e7:be:6f:00:de:6d
Certificate

bd:c5:40:3e:17:f4:28:67:15:ba:79:c8:5e:d8:b3:f2:59:6b:f5:20
Signer

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 499KB - Virtual size: 499KB

.data
Size: 105KB - Virtual size: 960KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 358KB - Virtual size: 358KB

.reloc
Size: 96KB - Virtual size: 96KB