General

Malware Config

Signatures

Files

• 43b3cb0d8ead9a35e8bcda2048c3312f

  .exe windows:4 windows x86 arch:x86

  ef6659516d9d7c310b53b70bd050ba3a

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:05:a2:30:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:01

  Not After

  25-07-2013 19:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  72:e9:ba:34:f0:4a:85:fa:82:e1:27:32:07:8c:1d:6f:7c:15:4b:cd

  Signer

  Actual PE Digest

  72:e9:ba:34:f0:4a:85:fa:82:e1:27:32:07:8c:1d:6f:7c:15:4b:cd

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvbvm60

  __vbaVarTstGt

  __vbaVarSub

  _CIcos

  _adj_fptan

  __vbaVarMove

  __vbaFreeVar

  __vbaCyMul

  __vbaFreeVarList

  ord697

  _adj_fdiv_m64

  _adj_fprem1

  ord628

  __vbaStrCat

  ord661

  __vbaSetSystemError

  ord662

  __vbaHresultCheckObj

  _adj_fdiv_m32

  __vbaAryDestruct

  _adj_fdiv_m16i

  _adj_fdivr_m16i

  _CIsin

  __vbaChkstk

  EVENT_SINK_AddRef

  __vbaStrCmp

  __vbaCyI2

  __vbaCyI4

  DllFunctionCall

  _adj_fpatan

  __vbaRedim

  EVENT_SINK_Release

  _CIsqrt

  EVENT_SINK_QueryInterface

  __vbaExceptHandler

  __vbaStrToUnicode

  _adj_fprem

  _adj_fdivr_m64

  __vbaFPException

  __vbaI2Var

  _CIlog

  __vbaNew2

  __vbaR8Str

  _adj_fdiv_m32i

  _adj_fdivr_m32i

  __vbaStrCopy

  __vbaFreeStrList

  _adj_fdivr_m32

  _adj_fdiv_r

  ord100

  __vbaAryLock

  __vbaVarDup

  __vbaStrToAnsi

  __vbaFpI2

  __vbaVarCopy

  __vbaFpI4

  _CIatan

  __vbaStrMove

  _allmul

  _CItan

  ord546

  __vbaUI1Var

  __vbaAryUnlock

  _CIexp

  __vbaFreeStr

  Sections

  .text

  Size: 44KB - Virtual size: 43KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 144KB - Virtual size: 140KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ