0e99604f56a1ce846be0f329026e25b3

Sharing

Copy URL Twitter E-mail

General

Target

0e99604f56a1ce846be0f329026e25b3
Size

772KB
MD5

0e99604f56a1ce846be0f329026e25b3
SHA1

002fca16a02f5eee673967b3d73d419eea8a86c5
SHA256

e4a3a78d1466e133d18332cccbfded0aa2b0ab6eead1225fef9fa70da8aef303
SHA512

0f0a0b7bf83e1b2bcd6b929d13c4d1089bd8c2eb17e7bdc92106d1cc013e58df7401d7348da27e92a1033af9fb52fb29db6fbf5fa7d415c53bd3b6ba077190a1
SSDEEP

24576:XNKXlooZ3+qUlUZ3glN7Xd+ByB4IXGINzOS/3enrN:cXlxZ3D3glNwBeP1NH2x

Score

1^/10

Malware Config

Signatures

Files

0e99604f56a1ce846be0f329026e25b3
.exe windows:4 windows x86 arch:x86

aecd6c0a2280c5f079ef9d227eb6317f

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:05:be:f8:3b:02:f6:bf:0e:85:d5:88:5f:5a:57:84:05:79:b4:81
Signer

Actual PE Digest

c2:05:be:f8:3b:02:f6:bf:0e:85:d5:88:5f:5a:57:84:05:79:b4:81

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

shell32

SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW

kernel32

SetCurrentDirectoryW
CreateProcessW
GetCurrentDirectoryW
LocalFree
WaitForSingleObject
SetFileApisToOEM
GetCurrentProcess
GetCurrentThread
SetPriorityClass
SetThreadPriority
GetLastError
GetEnvironmentVariableW
GetCommandLineW
FormatMessageW
GetModuleHandleW
FindResourceW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
InterlockedIncrement
InterlockedDecrement
FindFirstFileW
FindClose
FindNextFileW
FileTimeToSystemTime
FreeLibrary
GetProcAddress
GetFileSize
ReadFile
CreateFileW
SetFilePointer
SetFileTime
SetEndOfFile
WriteFile
Sleep
GetCurrentThreadId
ResumeThread
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetFullPathNameW
GetTempFileNameW
GetLongPathNameW
MoveFileW
CloseHandle
GetTempPathW
GetWindowsDirectoryW
GetVersionExW
ExpandEnvironmentStringsW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
GetModuleFileNameW
lstrlenW
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
ExitThread
CreateThread
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError

user32

GetActiveWindow
LoadStringW
GetDesktopWindow
IsDialogMessageW
KillTimer
IsWindowVisible
LoadIconW
EnableWindow
CreateDialogParamW
DispatchMessageW
SetTimer
TranslateMessage
ScreenToClient
ShowWindow
GetMessageW
DestroyIcon
IsWindow
SendMessageW
MessageBoxW
GetWindowRect
GetSystemMetrics
PostMessageW
DialogBoxParamW
SetWindowPos
GetWindowTextW
SetWindowTextW
GetDlgItem
EndDialog
PostQuitMessage

gdi32

CreateSolidBrush
DeleteObject

advapi32

RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aecd6c0a2280c5f079ef9d227eb6317f

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

c2:05:be:f8:3b:02:f6:bf:0e:85:d5:88:5f:5a:57:84:05:79:b4:81Signer

Headers

File Characteristics

Imports

comctl32

shell32

kernel32

user32

gdi32

advapi32

ole32

Sections

.text Size: 268KB - Virtual size: 267KB

.rdata Size: 67KB - Virtual size: 67KB

.data Size: 16KB - Virtual size: 41KB

.rsrc Size: 65KB - Virtual size: 64KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

c2:05:be:f8:3b:02:f6:bf:0e:85:d5:88:5f:5a:57:84:05:79:b4:81
Signer

.text
Size: 268KB - Virtual size: 267KB

.rdata
Size: 67KB - Virtual size: 67KB

.data
Size: 16KB - Virtual size: 41KB

.rsrc
Size: 65KB - Virtual size: 64KB