227173451e3aafc6a8d6f6a5e036e0d0

Sharing

Copy URL

Twitter E-mail

General

Target

227173451e3aafc6a8d6f6a5e036e0d0
Size

512KB
MD5

227173451e3aafc6a8d6f6a5e036e0d0
SHA1

b49d832219c75fdedafc13be58b95a3c7dbe4de5
SHA256

5cff72276429496823dd022b8cab32e4ecc57a3698b8daaf77c2fa7b30273fd9
SHA512

936fa091129d49305ab4e1771fe6c2efa676e0ccddc06d4ca15ae602218090ec55d686e7a9f85ca622745252fb1175c4c500ddad81226689d8822b4b1f7d10d3
SSDEEP

6144:uNffdg5cxWi+V5B5wKgj8raVLA8uc18zP2WLIL:+d0yWi+V5Bpgj8raW8ucWzPpML

Score

1^/10

Malware Config

Signatures

Files

227173451e3aafc6a8d6f6a5e036e0d0
.exe windows:6 windows x86 arch:x86

1d02088ca15870f2ae2d5628bb82b83c

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c3:1c:f5:b3:9b:05:65:8d:da:ff:09:25:5a:06:2f:bf:d0:e6:a8:0d
Signer

Actual PE Digest

c3:1c:f5:b3:9b:05:65:8d:da:ff:09:25:5a:06:2f:bf:d0:e6:a8:0d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
Sleep
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
WaitForSingleObject
ResumeThread
InitializeCriticalSection
CreateSemaphoreW
LoadLibraryW
WriteFile
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
CreateFileMappingW
GetSystemInfo
ReadFile
FlushFileBuffers
SetFilePointerEx
GetProcAddress
FreeLibrary
DeleteFileW
GetFileAttributesW
CreateDirectoryW
CreateFileW
GetFileSizeEx
CloseHandle
GetDiskFreeSpaceExW
GetFullPathNameW
ExpandEnvironmentStringsW
GetVersionExA
lstrlenW
QueryPerformanceFrequency
GetModuleFileNameW
GetLastError
SetThreadExecutionState
GetCommandLineW
LocalFree
GetVersionExW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
lstrlenA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange

user32

ReleaseDC
GetDC
GetIconInfo
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
SystemParametersInfoW
GetClientRect
GetSystemMetrics
SendMessageW
ClipCursor
GetWindowRect
GetClassLongW
SetCursor
ShowWindow
IsWindowVisible
IsZoomed
AdjustWindowRect
IsIconic
SetWindowPos
SetWindowPlacement
GetMenu
GetWindowPlacement
SetMenu
SetWindowLongW
GetWindowLongW
DefWindowProcW
GetCursorPos
DestroyWindow
DestroyMenu
ScreenToClient
CreateWindowExW
MessageBoxW
RegisterClassW
LoadCursorW
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
PeekMessageW
SystemParametersInfoA
EnumDisplaySettingsW
GetMonitorInfoW
OffsetRect
ReleaseCapture
SetCapture
PtInRect
SetRectEmpty
GetKeyState
SetCursorPos
SetDlgItemTextW
LoadIconW
SetWindowTextW
EnableWindow
GetDlgItem
CheckDlgButton
EndDialog
IsDlgButtonChecked
DialogBoxIndirectParamW
PostQuitMessage
SetRect
UnregisterClassW

msvcr100

wcsrchr
_CIatan2
qsort
_stricmp
wcsstr
wcsncmp
_wtoi
wcstod
_wcsnicmp
wcscpy_s
??3@YAXPAX@Z
??2@YAPAXI@Z
_CIpow
rand
wcscat_s
memset
srand
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memcpy
_purecall
_CIsqrt
floor
_beginthreadex
memmove
free
realloc
__CxxFrameHandler3
swprintf_s

shell32

SHGetFolderPathW
ExtractIconW
CommandLineToArgvW
ShellExecuteW

ole32

CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString

d3dx9_43

D3DXMatrixScaling
D3DXMatrixOrthoOffCenterLH
D3DXMatrixTranslation
D3DXCreateTextureFromFileExW
D3DXCreateTextureFromResourceExW
D3DXMatrixInverse
D3DXMatrixLookAtLH
D3DXMatrixPerspectiveFovLH
D3DXMatrixMultiply
D3DXVec3TransformCoord
D3DXMatrixRotationYawPitchRoll
D3DXCreateTextureFromFileInMemoryEx
D3DXVec3TransformNormal
D3DXMatrixRotationY
D3DXVec3Normalize
D3DXCreateEffectFromFileW
D3DXCreateFontW
D3DXCreateSprite

d3dx10_43

D3DX10GetImageInfoFromMemory
D3DX10CreateTextureFromMemory
D3DX10CreateEffectFromMemory
D3DX10GetImageInfoFromResourceW
D3DX10CreateTextureFromResourceW
D3DX10GetImageInfoFromFileW
D3DX10CreateTextureFromFileW
D3DX10CreateEffectFromFileW
D3DX10CreateFontW
D3DX10CreateSprite

gdi32

CreateCompatibleDC
GetObjectW
GetStockObject
SelectObject
GetDIBits
DeleteDC
DeleteObject

comctl32

ord17

Sections

.text
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d02088ca15870f2ae2d5628bb82b83c

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

c3:1c:f5:b3:9b:05:65:8d:da:ff:09:25:5a:06:2f:bf:d0:e6:a8:0dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcr100

shell32

ole32

oleaut32

d3dx9_43

d3dx10_43

gdi32

comctl32

Sections

.text Size: 444KB - Virtual size: 443KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 32KB - Virtual size: 31KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

c3:1c:f5:b3:9b:05:65:8d:da:ff:09:25:5a:06:2f:bf:d0:e6:a8:0d
Signer

.text
Size: 444KB - Virtual size: 443KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 32KB - Virtual size: 31KB