49f0567aaef92ca100a0c88194cbc253

Sharing

Copy URL

Twitter E-mail

General

Target

49f0567aaef92ca100a0c88194cbc253
Size

428KB
MD5

49f0567aaef92ca100a0c88194cbc253
SHA1

3029f96d6d2b5d53831de59c10e5002d5c6ea8a0
SHA256

5c988940462639cdd0b64f8c4257843914cb973cb6a3d3f7d7ba68fd8579fa5c
SHA512

4011c910663aca727d266eebdae74a24a5dc1c2471d65ee53075632db21fa9b63a7c6ae09231bc6981e3a208fe68c0f9bf111eccf7abd3e270a18c66a0291145
SSDEEP

6144:QKOwNp8ELCuNCPjcieMbFGZijnGR6/w9siQARfTN3X3SjoZcb7VrCmS+mqW3MjkM:61eINTuuWQgfd3SMev1E+MM4vvjpgJ

Score

1^/10

Malware Config

Signatures

Files

49f0567aaef92ca100a0c88194cbc253
.exe windows:5 windows x86 arch:x86

bb1b5425c71d4b6c4b56ea2f464dd884

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:20:74:9d:06:65:6d:26:c7:98:fa:ac:ac:9d:07:78
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-03-2011 00:00

Not After

19-03-2012 23:59

Subject

CN=Memco Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Memco Inc.,L=Greenwich,ST=Connecticut,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:e6:0d:18:3a:af:27:cd:03:75:01:a7:0f:91:7f:e5:97:5f:42:25
Signer

Actual PE Digest

27:e6:0d:18:3a:af:27:cd:03:75:01:a7:0f:91:7f:e5:97:5f:42:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateDirectoryA
GetModuleFileNameA
WinExec
FreeLibrary
GetTempPathA
DeleteFileA
GetFullPathNameA
DosDateTimeToFileTime
GetTickCount
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FindFirstFileA
FindClose
Sleep
InterlockedCompareExchange
InterlockedExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId

user32

wsprintfA

shell32

SHGetSpecialFolderPathA

msvcr90

_read
_close
_open
_lseek
_write
memcpy
memset
_controlfp_s
_invoke_watson
_decode_pointer
memmove
free
malloc
fgetpos
fopen
fread
??3@YAXPAX@Z
fwrite
fseek
fclose
printf
strrchr
??2@YAPAXI@Z
strchr
strncpy
atof
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
__CxxFrameHandler3

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 981KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb1b5425c71d4b6c4b56ea2f464dd884

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

0f:20:74:9d:06:65:6d:26:c7:98:fa:ac:ac:9d:07:78Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

27:e6:0d:18:3a:af:27:cd:03:75:01:a7:0f:91:7f:e5:97:5f:42:25Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msvcr90

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 981KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

0f:20:74:9d:06:65:6d:26:c7:98:fa:ac:ac:9d:07:78
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

27:e6:0d:18:3a:af:27:cd:03:75:01:a7:0f:91:7f:e5:97:5f:42:25
Signer

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 981KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 4KB - Virtual size: 3KB