225678ac0a8549dc8dab30dbfbe97207

Sharing

Copy URL

Twitter E-mail

General

Target

225678ac0a8549dc8dab30dbfbe97207
Size

258KB
MD5

225678ac0a8549dc8dab30dbfbe97207
SHA1

78c97bc98167b5529ca051e7415ec1789f979132
SHA256

198bf33611ab28c0c34a692e33ab2733eb5956a1b8e9c77a0cc4eb41ab823df6
SHA512

571a94ed56948a753eacea625559fc392c8d886aea7c26c2385fe3492771dbad26ce793462041a15dc927eeed7b0a763c75c2bfe5f572776114d7da7ce537fe1
SSDEEP

3072:jSa6xSZx+G8Dtt7CsF3vIs0VXotzK6dvqfxbfxTL++wlun75pKTE8UeFf:jSPSZ9A7/1eXoIEUxkaq

Score

1^/10

Malware Config

Signatures

Files

225678ac0a8549dc8dab30dbfbe97207
.exe windows:4 windows x64 arch:x64

ab877873d861e8af0e3b02f7fce4cae8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:38:5d:e6:14:bc:be:5b:ae:4d:49:d9:ae:89:5c:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

25/11/2008, 00:00

Not After

09/12/2011, 23:59

Subject

CN=Synaptics Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical Marketing,O=Synaptics Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:17:c0:8c:b6:33:21:60:e1:9a:a0:fa:35:48:93:55:13:e4:67:4a
Signer

Actual PE Digest

77:17:c0:8c:b6:33:21:60:e1:9a:a0:fa:35:48:93:55:13:e4:67:4a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcess
CreateProcessW
lstrlenW
GetLastError
GetEnvironmentVariableW
TerminateProcess
GetCurrentThreadId
GetCurrentDirectoryW
lstrcmpiW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetConsoleMode
ExpandEnvironmentStringsW
CreateMutexW
WaitForSingleObject
ReleaseMutex
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReadFile
FlushFileBuffers
GetCommandLineA
GetConsoleCP
SetFilePointer
HeapSize
Sleep
LCMapStringW
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RaiseException
RtlPcToFileHeader
GetModuleHandleA
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
FlsAlloc
RtlVirtualUnwind
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA

user32

MessageBeep
WaitForInputIdle
AttachThreadInput
SetForegroundWindow
GetForegroundWindow
GetDesktopWindow
GetWindowThreadProcessId
RegisterClassW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
DefWindowProcW
SendMessageW
FindWindowW

advapi32

RegCreateKeyW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteExW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab877873d861e8af0e3b02f7fce4cae8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

76:38:5d:e6:14:bc:be:5b:ae:4d:49:d9:ae:89:5c:f7Certificate

Extended Key Usages

Key Usages

77:17:c0:8c:b6:33:21:60:e1:9a:a0:fa:35:48:93:55:13:e4:67:4aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 92KB - Virtual size: 91KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 6KB - Virtual size: 16KB

.pdata Size: 6KB - Virtual size: 6KB

� Size: 114KB - Virtual size: 113KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

76:38:5d:e6:14:bc:be:5b:ae:4d:49:d9:ae:89:5c:f7
Certificate

77:17:c0:8c:b6:33:21:60:e1:9a:a0:fa:35:48:93:55:13:e4:67:4a
Signer

.text
Size: 92KB - Virtual size: 91KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 16KB

.pdata
Size: 6KB - Virtual size: 6KB

�
Size: 114KB - Virtual size: 113KB