2cffea1a8b250322814985924dbc4a80

Sharing

Copy URL

Twitter E-mail

General

Target

2cffea1a8b250322814985924dbc4a80
Size

268KB
MD5

2cffea1a8b250322814985924dbc4a80
SHA1

396e72627e1aca3faab789a3bc9f145960f8a95a
SHA256

647615ccb7d1795429d5720476049f3a087d72f1bd67cc61fff9aa3835feab94
SHA512

f089aabd94ecd2b448f21bf0e420ff708422814e44dc0bc68fde837893e72ecf2b7e5a8a057d3930ae2a02cc8ac04883ab4d8b5ad85c7e518471692b8a8bf384
SSDEEP

6144:AI1v9PfKoXjllMoVpfZLijwDAhtCx6o3yG4/xFk:A4vFfVzv2qZitZFk

Score

1^/10

Malware Config

Signatures

Files

2cffea1a8b250322814985924dbc4a80
.exe windows:4 windows x86 arch:x86

4e3bb605b45edf01ef6ad1dcd6cacc0e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:43:bb:5c:63:bc:31:7f:31:04:be:c8:75:43:9c:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05-02-2010 00:00

Not After

14-04-2012 23:59

Subject

CN=Malwarebytes Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Malwarebytes Corporation,L=Champaign,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9f:3e:18:fb:96:06:39:45:96:f7:55:f4:44:c3:d7:1c:2f:a3:d2:40
Signer

Actual PE Digest

9f:3e:18:fb:96:06:39:45:96:f7:55:f4:44:c3:d7:1c:2f:a3:d2:40

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RemoveDirectoryA
CreateDirectoryA
ExpandEnvironmentStringsA
GetVersionExW
WaitForMultipleObjects
GetTimeFormatW
GetModuleHandleA
SetCurrentDirectoryA
GlobalDeleteAtom
GetCalendarInfoW
ConnectNamedPipe
QueryPerformanceFrequency
CreateEventW
GetModuleHandleW
GetAtomNameA
CreateSemaphoreW
SearchPathW
CreateEventA
lstrcatW
SetComputerNameW
FatalAppExitW
LoadResource
CreateDirectoryW
LocalFree
lstrcmpiA
GetEnvironmentStringsW
GetProcessHeap
lstrcatA
GetFullPathNameA
GetComputerNameA
SetCalendarInfoA
lstrlen
GetSystemInfo
GetExitCodeThread
EnumDateFormatsA
lstrcmpW
DeleteAtom
GetModuleFileNameA
WinExec
CreateNamedPipeA
lstrcpyn
SetComputerNameA
SearchPathA
OpenEventW
HeapCreate
DuplicateHandle
GetWindowsDirectoryA
OpenMutexA
CreateMutexA
LoadLibraryA
GetDiskFreeSpaceW
GetNumberFormatW
lstrcmpA
EnumDateFormatsW
GetLogicalDriveStringsW
IsBadStringPtrA
EnumCalendarInfoW
LoadLibraryA
IsValidLocale
lstrcat
GetCurrentProcessId
lstrcpynA
CreateMailslotA
GetProcessHeaps
GlobalGetAtomNameW
IsBadCodePtr
ExitProcess
GetProcAddress
FindAtomA
GetDateFormatW
OpenWaitableTimerA
CompareFileTime
GlobalGetAtomNameA
GetExpandedNameA
lstrcmpiW
BeginUpdateResourceW
TlsAlloc
GlobalFindAtomA
LocalAlloc
SetUnhandledExceptionFilter
GetLongPathNameW
GetStringTypeW
GlobalFindAtomW
GlobalAlloc
CreatePipe
MoveFileA
GetShortPathNameA
GetSystemDefaultLCID
IsBadWritePtr
FileTimeToSystemTime
GetFileAttributesW

user32

GetMenuStringA
GetSysColor
LoadCursorA
MonitorFromPoint
GetIconInfo
PostMessageA
RegisterClassA
wsprintfW
DialogBoxIndirectParamA
CheckMenuItem
CreateDialogIndirectParamA
GetClassInfoExW
GetMessageW
SetCapture
TrackPopupMenu
AdjustWindowRect
GetMenuItemInfoW
EnableWindow
CreateDesktopW
CopyIcon
CharNextA
CharNextW
LoadIconA
GetCapture
CreateDialogParamA
IsWindow
EnumClipboardFormats
PeekMessageA
CopyRect
OffsetRect
GetActiveWindow
GetMenuItemCount
MessageBoxW
CharUpperA
GetTopWindow
DestroyIcon
MessageBoxIndirectW
DialogBoxParamA
wvsprintfA
CreateDialogIndirectParamW
SetParent
PeekMessageW
GetDlgItemInt
InvalidateRect
TrackPopupMenuEx
WinHelpA
SetWindowTextA
LoadBitmapW
SendMessageW
RegisterClassW
IsDlgButtonChecked
SetActiveWindow
GetMessageA
SetDlgItemInt
LoadImageW
SendDlgItemMessageA
MonitorFromRect
AppendMenuW
DefWindowProcA
GetCursorPos
MessageBoxIndirectA
GetCaretPos
GetClassInfoExA
GetSystemMetrics
ShowCaret
MessageBeep
WaitMessage
InvalidateRgn
OpenClipboard
PostMessageW
SetCursorPos
DefWindowProcW
EndMenu
GetMenuStringW
GetSubMenu
SetForegroundWindow
SetWindowRgn
CreateAcceleratorTableA
AppendMenuA
GetAsyncKeyState
GetMenuItemID
InsertMenuA
GetMenuItemInfoA
FindWindowA
EndDialog
GetDlgItemTextW
DialogBoxParamW
GetMenuState
EnableMenuItem
MessageBoxA
GetSysColorBrush
SetWindowLongW
SetWindowPos
LoadMenuIndirectA
LoadMenuW
LoadBitmapA
GetDlgItemTextA
GetMenuItemRect
GetForegroundWindow
GetMenu
WinHelpW
IsChild
LoadIconW
CreatePopupMenu
SetDlgItemTextA
ShowWindow
LoadCursorW
DialogBoxIndirectParamW

gdi32

CreateBrushIndirect
CreateFontIndirectW
CreateColorSpaceA
CreatePolygonRgn
GetTextExtentPointW
RemoveFontResourceA
CreateHatchBrush
UpdateICMRegKeyW
GdiGetBatchLimit
AddFontResourceA
CreateScalableFontResourceA
GetMetaFileA
CreatePen
CreatePalette
CreateDIBPatternBrushPt
CreateDIBSection
CreatePatternBrush
RemoveFontResourceW
AddFontResourceW
UpdateICMRegKeyA
CreateMetaFileA
CreateSolidBrush
CreatePolyPolygonRgn
CreateEllipticRgn
RemoveFontResourceExA
CreateCompatibleDC
CreateBitmapIndirect
CreateBitmap
GetStockObject
CreateRectRgn
CreateFontIndirectExA
CreateColorSpaceW
StretchDIBits
SetMetaFileBitsEx
SetWinMetaFileBits
GetEnhMetaFileA

wininet

InternetReadFileExA
InternetSecurityProtocolToStringA
FtpFindFirstFileW
InternetQueryOptionA
FtpCommandW
FindNextUrlCacheEntryExW
FindNextUrlCacheContainerW
ReadUrlCacheEntryStream
InternetHangUp
GopherCreateLocatorW
CreateUrlCacheContainerW
FindFirstUrlCacheGroup
PrivacySetZonePreferenceW
CommitUrlCacheEntryW
GetUrlCacheEntryInfoW
FtpFindFirstFileA

olecli32

ErrExecute
ErrClose

sqlunirl

_GetTextExtentExPoint_@28
_BackupEventLog_@8
__hwrite_@12
_AddAtom_@4
_CallWindowProc@20
_CharNext_@4
_ReadEventLog_@28
_GetICMProfile_@12
_GetEnvironmentVariable_@12
_GetCharWidth32_@16
_MessageBox@16
_ExpandEnvironmentStrings_@12
_GetKerningPairs_@12
_FindFirstFileEx_@24

Sections

.xUdhLN
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ydE
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.igPhP
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gaxpJ
Size: 16KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.t
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.s
Size: 7KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iTmByk
Size: 3KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e3bb605b45edf01ef6ad1dcd6cacc0e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

39:43:bb:5c:63:bc:31:7f:31:04:be:c8:75:43:9c:1cCertificate

Extended Key Usages

Key Usages

9f:3e:18:fb:96:06:39:45:96:f7:55:f4:44:c3:d7:1c:2f:a3:d2:40Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wininet

olecli32

sqlunirl

Sections

.xUdhLN Size: 5KB - Virtual size: 5KB

.ydE Size: 11KB - Virtual size: 11KB

.igPhP Size: 106KB - Virtual size: 106KB

.gaxpJ Size: 16KB - Virtual size: 58KB

.t Size: 105KB - Virtual size: 105KB

.s Size: 7KB - Virtual size: 30KB

.iTmByk Size: 3KB - Virtual size: 78KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1024B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

39:43:bb:5c:63:bc:31:7f:31:04:be:c8:75:43:9c:1c
Certificate

9f:3e:18:fb:96:06:39:45:96:f7:55:f4:44:c3:d7:1c:2f:a3:d2:40
Signer

.xUdhLN
Size: 5KB - Virtual size: 5KB

.ydE
Size: 11KB - Virtual size: 11KB

.igPhP
Size: 106KB - Virtual size: 106KB

.gaxpJ
Size: 16KB - Virtual size: 58KB

.t
Size: 105KB - Virtual size: 105KB

.s
Size: 7KB - Virtual size: 30KB

.iTmByk
Size: 3KB - Virtual size: 78KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1024B