11c0401e0dfb6e6c144792524e1bd615

Sharing

Copy URL Twitter E-mail

General

Target

11c0401e0dfb6e6c144792524e1bd615
Size

1.2MB
MD5

11c0401e0dfb6e6c144792524e1bd615
SHA1

799a01b03ef70a6887361d8c792503790728846e
SHA256

1e78cb848358f25b4cd4ef26498e7822df4b11d6bdc52b8b1b2474340f7ca9d5
SHA512

47fd08f5846744a201e014448687f01057b2fd59ce629a911312b1d4d263a8204cb0f5aa7b5610fa39d799766cc8458976ad5a7d4d1bf07217b4d93527c4dfcf
SSDEEP

24576:+OEZvd+bEkM1SxPqVe6h4U/XVH38TxK9hwZ:45d+RMQqVe6iWFX8TU9G

Score

1^/10

Malware Config

Signatures

Files

11c0401e0dfb6e6c144792524e1bd615
.exe windows:5 windows x86 arch:x86

89e0a8cd2dec30f62fc87161eddbc115

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

07/04/2014, 00:00

Not After

06/04/2017, 23:59

Subject

SERIALNUMBER=974 529 459,CN=Opera Software ASA,O=Opera Software ASA,L=Oslo,ST=Oslo,C=NO,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e4f

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:2f:b8:d3:77:7a:a4:03:66:5b:f8:64:0e:63:46:e4:ed:30:0b:1a
Signer

Actual PE Digest

58:2f:b8:d3:77:7a:a4:03:66:5b:f8:64:0e:63:46:e4:ed:30:0b:1a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx
ord410
ord413

gdiplus

GdipCreateBitmapFromStream
GdiplusShutdown
GdipAlloc
GdipFree
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdipCloneImage

secur32

GetUserNameExW

crypt32

CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

wintrust

WinVerifyTrust

wininet

InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetOpenW
HttpOpenRequestW
HttpSendRequestW
InternetSetStatusCallbackW
HttpQueryInfoW
InternetErrorDlg
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetOptionW
InternetCloseHandle

msimg32

AlphaBlend

psapi

GetMappedFileNameA
GetProcessMemoryInfo
GetProcessImageFileNameW
GetModuleInformation

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

shlwapi

SHDeleteKeyW
SHStrDupW

kernel32

GetModuleHandleA
VirtualProtect
WaitForSingleObject
SetEvent
GetExitCodeProcess
GetProcessId
OpenEventW
LocalFree
CreateMutexW
DuplicateHandle
ReleaseMutex
OpenProcess
ReadFile
CreateMailslotW
CancelIo
WriteFile
SetFilePointer
SetFileTime
GetDriveTypeW
GetLogicalDrives
DeviceIoControl
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
LoadResource
GlobalLock
GlobalAlloc
SizeofResource
GlobalUnlock
GlobalFree
LockResource
GetCurrentThreadId
LoadLibraryW
MulDiv
AllocConsole
IsProcessorFeaturePresent
RemoveDirectoryW
OpenMutexW
DeleteFileW
OutputDebugStringA
SetLastError
GetTickCount
FormatMessageA
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetLogicalDriveStringsW
GetLongPathNameW
GetTempFileNameW
QueryDosDeviceW
SetFileAttributesW
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
MoveFileW
MoveFileExW
ReplaceFileW
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetStdHandle
SetStdHandle
CreatePipe
ResumeThread
AssignProcessToJobObject
VirtualAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
IsDebuggerPresent
ExpandEnvironmentStringsW
UnregisterWaitEx
GetLastError
GetVersionExW
GetNativeSystemInfo
ResetEvent
RaiseException
CreateThread
GetCurrentThread
GetThreadPriority
FlushFileBuffers
GetFileInformationByHandle
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
HeapSetInformation
GetModuleHandleExA
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetSystemDirectoryW
GetWindowsDirectoryW
QueueUserWorkItem
GetModuleHandleExW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
RtlCaptureContext
InitializeCriticalSection
ReleaseSemaphore
OpenThread
SuspendThread
GetThreadContext
VirtualQueryEx
CreateSemaphoreW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
DeleteFileA
DebugActiveProcess
DebugActiveProcessStop
GetSystemTime
ReadProcessMemory
UnregisterWait
GetFileSize
CreateToolhelp32Snapshot
Thread32First
Thread32Next
Module32FirstW
Module32NextW
LocalAlloc
FindResourceExW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
DecodePointer
lstrlenA
GetCurrentProcessId
WaitForMultipleObjects
CreateEventW
LoadLibraryA
GetProcAddress
GetModuleFileNameW
TerminateProcess
Sleep
GetModuleHandleW
GetCurrentProcess
CreateProcessW
GetEnvironmentVariableW
CloseHandle
GetFileType
RtlUnwind
UnhandledExceptionFilter
GetStartupInfoW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetTimeZoneInformation
GetStringTypeW
ReadConsoleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
CreateFileW
EncodePointer
ExitProcess
AreFileApisANSI
GetConsoleCP
GetConsoleMode
RegisterWaitForSingleObject
GetFullPathNameW
EnumSystemLocalesW
CreateProcessA
OutputDebugStringW
SetEnvironmentVariableA
GetUserDefaultLangID
GetUserDefaultUILanguage
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
GetProcessTimes
SetHandleInformation
LoadLibraryExA
SwitchToThread

gdi32

SetTextColor
GetDeviceCaps
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateFontW
GetObjectW
GetTextExtentExPointW
GetStockObject
BitBlt

advapi32

AllocateAndInitializeSid
SetSecurityInfo
SetEntriesInAclW
BuildTrusteeWithSidW
RegGetKeySecurity
AdjustTokenPrivileges
CheckTokenMembership
LookupPrivilegeValueW
DuplicateToken
AccessCheck
GetExplicitEntriesFromAclW
GetUserNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW
RegCloseKey
RegOpenKeyExW
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExA
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
FreeSid
GetSecurityInfo

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

VariantChangeType
SysAllocString
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VariantTimeToSystemTime

user32

GetWindowLongW
LoadIconW
DestroyWindow
HideCaret
EnumThreadWindows
IsWindowVisible
IsWindowEnabled
SetForegroundWindow
DestroyIcon
MessageBoxW
UnhookWindowsHookEx
SetWindowsHookExW
CreateWindowExW
SetWindowPos
GetSysColor
ReleaseDC
GetWindowTextW
InvalidateRect
GetDC
BeginPaint
SetFocus
GetClientRect
FillRect
GetWindowRect
ScreenToClient
GetWindowTextLengthW
EndPaint
GetDlgItem
CharUpperW
TranslateMessage
DispatchMessageW
PeekMessageW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
ShowWindow
CreateDialogParamW
SendMessageW
EnableWindow
SetWindowTextW
AllowSetForegroundWindow
SendNotifyMessageW
IsDialogMessageW
SetWindowLongW
GetSysColorBrush

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 724KB - Virtual size: 724KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 342KB - Virtual size: 341KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

89e0a8cd2dec30f62fc87161eddbc115

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

58:2f:b8:d3:77:7a:a4:03:66:5b:f8:64:0e:63:46:e4:ed:30:0b:1aSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

gdiplus

secur32

crypt32

wintrust

wininet

msimg32

psapi

winmm

shlwapi

kernel32

gdi32

advapi32

ole32

oleaut32

user32

userenv

version

Sections

.text Size: 724KB - Virtual size: 724KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 8KB - Virtual size: 31KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 342KB - Virtual size: 341KB

.reloc Size: 70KB - Virtual size: 70KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:ca:c9:8f:65:06:05:95:5d:9a:d8:6c:f2:bd:56:b6
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

58:2f:b8:d3:77:7a:a4:03:66:5b:f8:64:0e:63:46:e4:ed:30:0b:1a
Signer

.text
Size: 724KB - Virtual size: 724KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 8KB - Virtual size: 31KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 342KB - Virtual size: 341KB

.reloc
Size: 70KB - Virtual size: 70KB