4539d492ab454855eb6452072655e5a1

Sharing

Copy URL Twitter E-mail

General

Target

4539d492ab454855eb6452072655e5a1
Size

2.5MB
MD5

4539d492ab454855eb6452072655e5a1
SHA1

1a52711b7dec737baba3016c1c27ef6f03e7d0b1
SHA256

43ded01d86e3e946a092aee7ebc6e52b6c84be978bdd1af2650c9f04ed18c3e7
SHA512

a962fde73afd62106a2c1bdcab1ec5b163fd01835c3e596bb2d978f895b0c373023e6986156817645b0ac109641a2be52277ed0f0d37dfcdeb36c8579cbf5133
SSDEEP

49152:AiVQpNvD+F/vlCmUHxTmTqoDksqCYj/rUGz7LJK7CTCUPYmi3YA1KIGY9:kpNviF/vAjTmDks2jzU8E7CXXXqv9

Score

1^/10

Malware Config

Signatures

Files

4539d492ab454855eb6452072655e5a1
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

9c6f9071df48852cc76ec5164c0c317f

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:88:cf:08:16:0f:e7:d4:d4:a9:18:1c:d9:04:df:80
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/02/2012, 00:00

Not After

20/02/2013, 23:59

Subject

CN=杭州雷龙网络技术有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Provided by TrustAsia,O=杭州雷龙网络技术有限公司,L=杭州,ST=浙江,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:e3:75:46:27:88:b2:22:21:9a:95:ef:95:e5:a2:ef:b3:a8:f4:6b
Signer

Actual PE Digest

12:e3:75:46:27:88:b2:22:21:9a:95:ef:95:e5:a2:ef:b3:a8:f4:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExW

user32

LoadStringW

msimg32

AlphaBlend

gdi32

UnrealizeObject

version

VerQueryValueW

shfolder

SHGetFolderPathW

ole32

OleUninitialize

comctl32

InitializeFlatSB

winspool.drv

OpenPrinterW

shell32

ShellExecuteExW

Sections

.text
Size: 2.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9c6f9071df48852cc76ec5164c0c317f

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

31:88:cf:08:16:0f:e7:d4:d4:a9:18:1c:d9:04:df:80Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

12:e3:75:46:27:88:b2:22:21:9a:95:ef:95:e5:a2:ef:b3:a8:f4:6bSigner

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

msimg32

gdi32

version

shfolder

ole32

comctl32

winspool.drv

shell32

Sections

.text Size: 2.5MB - Virtual size: 3.5MB

.rsrc Size: 47KB - Virtual size: 48KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

31:88:cf:08:16:0f:e7:d4:d4:a9:18:1c:d9:04:df:80
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

12:e3:75:46:27:88:b2:22:21:9a:95:ef:95:e5:a2:ef:b3:a8:f4:6b
Signer

.text
Size: 2.5MB - Virtual size: 3.5MB

.rsrc
Size: 47KB - Virtual size: 48KB