1ad9fa1211b7a4bfebfe6ae93ef108e8

Sharing

Copy URL Twitter E-mail

General

Target

1ad9fa1211b7a4bfebfe6ae93ef108e8
Size

287KB
MD5

1ad9fa1211b7a4bfebfe6ae93ef108e8
SHA1

25e7a9cb6493d25a8fde43a1af4290f6952519f8
SHA256

2d1a412c382ec80bda44c8879d120ab67a841f0c6b96c214326664b33c7a9407
SHA512

5695191dbe4fa58b3f4e86bebe616d07495e18f4be1ed6418aa6020647f02e6130f0e9120aa4f8fc4a20b047c0420768c701788650a5781687e102a6fad5fffe
SSDEEP

3072:qqx8UW8/b2WrYaHwfJcbbQp4Z3bpHbsu6DEJ9SwxyH6Rb6QtGQtea5Cui5rroimu:FPRbbQUpHYu64J9Swxm73I5Ni5voBu

Score

1^/10

Malware Config

Signatures

Files

1ad9fa1211b7a4bfebfe6ae93ef108e8
.dll windows:5 windows x86 arch:x86

62143ad3602394f4683fcef1ac7af882

Code Sign

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70
Certificate

Issuer

CN=nHyf1yTMeGbZX4U

Not Before

13/04/2012, 11:21

Not After

31/12/2039, 23:59

Subject

CN=nHyf1yTMeGbZX4U

Extended Key Usages

ExtKeyUsageCodeSigning

b6:b5:6f:9d:2d:cc:7e:15:de:3a:e9:25:45:50:3b:d9:37:42:65:39
Signer

Actual PE Digest

b6:b5:6f:9d:2d:cc:7e:15:de:3a:e9:25:45:50:3b:d9:37:42:65:39

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetWindowsDirectoryA
DosDateTimeToFileTime
VirtualAllocEx
AddAtomW
AddConsoleAliasW
CallNamedPipeW
CancelDeviceWakeupRequest
CompareStringW
ContinueDebugEvent
CopyFileA
CopyFileExW
CopyFileW
CreateFiber
CreateFileW
CreateMailslotW
CreateNamedPipeA
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateWaitableTimerW
DebugBreak
DeleteAtom
DeleteCriticalSection
DeleteTimerQueueEx
DisconnectNamedPipe
DnsHostnameToComputerNameA
DuplicateHandle
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoW
EnumDateFormatsExA
EnumLanguageGroupLocalesA
EnumSystemCodePagesW
EnumTimeFormatsA
EnumUILanguagesW
EscapeCommFunction
ExpandEnvironmentStringsW
FillConsoleOutputAttribute
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextVolumeA
FindNextVolumeMountPointW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FlushInstructionCache
FreeLibraryAndExitThread
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetAtomNameA
GetCalendarInfoW
GetCommMask
GetCommModemStatus
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeW
GetComputerNameA
GetConsoleAliasExesA
GetConsoleAliasesLengthA
GetConsoleTitleA
GetCurrentThreadId
GetDefaultCommConfigW
GetEnvironmentStrings
GetEnvironmentStringsA
GetExitCodeThread
GetFileAttributesExW
GetHandleInformation
GetLocaleInfoA
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNumberFormatW
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetPrivateProfileStructW
GetProcessAffinityMask
GetProcessShutdownParameters
GetProcessTimes
GetProfileIntA
GetProfileIntW
GetProfileStringW
lstrcatA
GetStartupInfoA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemTimeAdjustment
GetThreadLocale
GetThreadPriorityBoost
GetUserDefaultLangID
GetWindowsDirectoryW
GlobalAddAtomA
GlobalAlloc
GlobalCompact
GlobalFindAtomA
GlobalFlags
GlobalGetAtomNameW
GlobalMemoryStatus
Heap32ListFirst
Heap32Next
HeapValidate
InitAtomTable
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
IsBadStringPtrW
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExW
LoadResource
LocalAlloc
LocalCompact
LocalLock
MapViewOfFile
Module32First
MoveFileExA
MoveFileW
OpenSemaphoreA
OpenWaitableTimerA
PeekConsoleInputW
Process32First
Process32FirstW
Process32NextW
QueryPerformanceFrequency
QueueUserAPC
ReadConsoleInputW
ReadFileScatter
ReadProcessMemory
RemoveDirectoryW
ReplaceFileW
RtlZeroMemory
SetCommConfig
SetConsoleScreenBufferSize
SetCurrentDirectoryA
SetDefaultCommConfigA
SetEvent
SetFileApisToANSI
SetFileAttributesA
SetLastError
SetLocalTime
SetProcessAffinityMask
SetStdHandle
SetSystemPowerState
SetThreadLocale
SleepEx
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TlsGetValue
Toolhelp32ReadProcessMemory
TransactNamedPipe
TransmitCommChar
UnhandledExceptionFilter
UnlockFileEx
VerLanguageNameA
VirtualLock
VirtualProtect
VirtualUnlock
WaitForDebugEvent
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObjectEx
WriteConsoleOutputAttribute
WritePrivateProfileStringA
WritePrivateProfileStructW
_lclose
_llseek
_lopen
_lread
lstrcat
lstrcmp
lstrcmpA
lstrcmpi
lstrlen
GetShortPathNameA
CreateFileA
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

advapi32

RegOpenKeyExW

oleaut32

DispCallFunc
DispGetIDsOfNames
DispGetParam
ClearCustData
GetActiveObject
GetAltMonthNames
LHashValOfNameSys
LHashValOfNameSysA
LPSAFEARRAY_Size
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserMarshal
LoadTypeLibEx
OaBuildVersion
OleCreateFontIndirect
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
OleIconToCursor
OleLoadPictureEx
OleLoadPictureFile
OleLoadPictureFileEx
OleLoadPicturePath
QueryPathOfRegTypeLi
RegisterActiveObject
RevokeActiveObject
SafeArrayAccessData
SafeArrayAllocDescriptorEx
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayDestroyData
SafeArrayGetDim
SafeArrayGetRecordInfo
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArraySetIID
SafeArraySetRecordInfo
SafeArrayUnlock
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
VARIANT_UserSize
VarAdd
VarAnd
VarBoolFromCy
VarBoolFromDate
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI1
VarBoolFromR4
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI1
VarBstrCat
VarBstrCmp
VarBstrFromCy
VarBstrFromDisp
VarBstrFromI1
VarBstrFromR4
VarBstrFromUI1
VarBstrFromUI2
VarCyCmp
VarCyCmpR8
VarCyFromBool
VarCyFromDate
VarCyFromDec
VarCyFromDisp
VarCyFromI1
VarCyFromR4
VarCyFromStr
VarCyFromUI1
VarCyInt
VarCyMul
VarCyRound
VarDateFromBool
VarDateFromCy
VarDateFromDec
VarDateFromDisp
VarDateFromI1
VarDateFromI2
VarDateFromR4
VarDateFromUI2
VarDateFromUI4
VarDateFromUdate
VarDateFromUdateEx
VarDecAdd
VarDecCmp
VarDecDiv
VarDecFix
VarDecFromDisp
VarDecFromI4
VarDecFromR4
VarDecFromStr
VarDecFromUI1
VarDecFromUI2
VarDecInt
VarDecNeg
VarDiv
VarEqv
VarFix
VarFormatCurrency
VarFormatFromTokens
VarI1FromBool
VarI1FromCy
VarI1FromDate
VarI1FromDec
VarI1FromI4
VarI1FromR4
VarI1FromR8
VarI1FromStr
VarI1FromUI1
VarI2FromCy
VarI2FromDate
VarI2FromDec
VarI2FromDisp
VarI2FromI4
VarI2FromR4
VarI2FromR8
VarI2FromStr
VarI2FromUI1
VarI2FromUI2
VarI2FromUI4
VarI4FromCy
VarI4FromDate
VarI4FromDec
VarI4FromDisp
VarI4FromI2
VarI4FromR8
VarI4FromUI1
VarI4FromUI2
VarI4FromUI4
VarIdiv
VarMonthName
VarMul
VarNeg
VarPow
VarR4CmpR8
VarR4FromDate
VarR4FromDec
VarR4FromI4
VarR4FromR8
VarR4FromStr
VarR4FromUI1
VarR4FromUI2
VarR8FromBool
VarR8FromCy
VarR8FromDate
VarR8FromDec
VarR8FromDisp
VarR8FromI1
VarR8FromI4
VarR8FromStr
VarR8FromUI4
VarR8Pow
VarSu
VarTokenizeFormatString
VarUI1FromCy
VarUI1FromDate
VarUI1FromDec
VarUI1FromDisp
VarUI1FromI4
VarUI1FromR8
VarUI1FromStr
VarUI1FromUI4
VarUI2FromBool
VarUI2FromDate
VarUI2FromDisp
VarUI2FromI1
VarUI2FromI4
VarUI2FromR4
VarUI2FromR8
VarUI2FromStr
VarUI2FromUI1
VarUI4FromBool
VarUI4FromCy
VarUI4FromDate
VarUI4FromI1
VarUI4FromI4
VarUI4FromStr
VarUI4FromUI1
VarUI4FromUI2
VarXor
VariantChangeTypeEx
VariantCopyInd
VariantInit
VariantTimeToDosDateTime
VariantTimeToSystemTime
VectorFromBstr
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree
DosDateTimeToVariantTime

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62143ad3602394f4683fcef1ac7af882

Code Sign

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70Certificate

Extended Key Usages

b6:b5:6f:9d:2d:cc:7e:15:de:3a:e9:25:45:50:3b:d9:37:42:65:39Signer

Headers

File Characteristics

Imports

kernel32

advapi32

oleaut32

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 267KB - Virtual size: 267KB

.data2 Size: 1024B - Virtual size: 1000B

.data3 Size: 1024B - Virtual size: 1000B

.CRT Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 2KB

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70
Certificate

b6:b5:6f:9d:2d:cc:7e:15:de:3a:e9:25:45:50:3b:d9:37:42:65:39
Signer

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 267KB - Virtual size: 267KB

.data2
Size: 1024B - Virtual size: 1000B

.data3
Size: 1024B - Virtual size: 1000B

.CRT
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 2KB