53d1940807e81cd73e17411ff01b05ca

Sharing

Copy URL Twitter E-mail

General

Target

53d1940807e81cd73e17411ff01b05ca
Size

169KB
MD5

53d1940807e81cd73e17411ff01b05ca
SHA1

7990ad54cb45220f30734f047ded7ba41d86fc0a
SHA256

12a98a5c1525a6872cff858f75f182e44541d38929e9938347e3a07c30009d65
SHA512

64e92c928c717d868178b397132cbfcd0631580296b5f87ec8c824974051e30cc66cb83e2660f3872f081f7ec85344f9b8196b8115d03effb1c594bcfe8bc1fe
SSDEEP

3072:gbCmJlOpu3OLRkJpXHNOk0T8qtr371huoITd9FgmH:WCmDjYUpNOk0d37vABH

Score

1^/10

Malware Config

Signatures

Files

53d1940807e81cd73e17411ff01b05ca
.exe windows:4 windows x86 arch:x86

baa5bbb3a0b94d3b48ae5b10d64310c2

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/02/2009, 00:00

Not After

12/04/2012, 23:59

Subject

CN=CyberLink,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CyberLink,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:0a:b5:2a:b6:1e:66:13:e5:d8:cd:38:ab:19:85:08:e3:fc:3a:e7
Signer

Actual PE Digest

ef:0a:b5:2a:b6:1e:66:13:e5:d8:cd:38:ab:19:85:08:e3:fc:3a:e7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80u

ord4716
ord3397
ord5210
ord4179
ord5067
ord1899
ord5148
ord4238
ord1393
ord3940
ord1608
ord1611
ord5911
ord6721
ord4347
ord6086
ord6271
ord3983
ord6140
ord1386
ord3678
ord2366
ord3677
ord3327
ord4475
ord2832
ord5562
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord3800
ord5579
ord2054
ord6274
ord3795
ord6272
ord4008
ord4032
ord757
ord1155
ord5209
ord1095
ord1049
ord1117
ord1121
ord2239
ord6001
ord1176
ord5710
ord6002
ord530
ord265
ord266
ord3857
ord5440
ord4276
ord745
ord5442
ord722
ord631
ord1431
ord3925
ord2279
ord386
ord3204
ord1925
ord3198
ord1271
ord1178
ord1182
ord3331
ord6061
ord6279
ord774
ord577
ord776
ord1058
ord1590
ord1646
ord1647
ord2397
ord2409
ord2386
ord2390
ord2392
ord2394
ord2384
ord5229
ord5231
ord280
ord4026
ord283
ord566
ord5096
ord1007
ord2009
ord4320
ord5971
ord5712
ord3860
ord5711
ord5398
ord2468
ord3990
ord293
ord2261
ord2745
ord2271
ord2460
ord6172
ord4074
ord1472
ord2311
ord1476
ord899
ord1118
ord4078
ord1156
ord1591
ord5956
ord920
ord925
ord929
ord927
ord931
ord2404
ord2388
ord2407
ord2402
ord2379
ord2381
ord2399
ord2169
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5171
ord1955
ord5196
ord2531
ord2725
ord2829
ord4301
ord2708
ord2856
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4480
ord4255
ord572
ord760
ord3590
ord1894
ord1274
ord2365
ord1946
ord4094
ord2085
ord3238
ord1079
ord762
ord557
ord764
ord1198

msvcr80

_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_invoke_watson
_cexit
__wgetmainargs
_amsg_exit
_recalloc
calloc
free
memcpy_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_wtoi
_wcslwr
wcsstr
_swprintf
_wcsicmp
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_exit
__CxxFrameHandler3
_wcsnicmp
_wsplitpath
memset
_vsnwprintf
_vsnprintf
_itow
memcpy
_i64tow
wcsncpy
_crt_debugger_hook
_wmkdir
fclose
_wfopen

kernel32

GetFileAttributesW
RemoveDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetFileTime
CreateFileW
GetPrivateProfileStringW
GetVersionExW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
lstrlenW
GetTempPathW
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
SetFileAttributesW
GetTempFileNameW
OutputDebugStringA
OutputDebugStringW
FreeLibrary
GetCommandLineW
CreateToolhelp32Snapshot
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateFileMappingW
InterlockedExchange
CloseHandle
GetLastError

user32

IsWindowVisible
InvalidateRect
UpdateWindow
DefWindowProcW
LoadCursorW
SetForegroundWindow
IsIconic
IsWindow
GetSystemMenu
BringWindowToTop
LoadMenuW
EnableWindow
LoadIconW
PostQuitMessage
SendMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterWindowMessageW
CopyRect
GetSystemMetrics
GetLastActivePopup
CheckMenuItem
GetSubMenu
ModifyMenuW
RemoveMenu
GetCursorPos
GetKeyState
FindWindowW

gdi32

CreateFontIndirectW

advapi32

RegCreateKeyExW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

shell32

Shell_NotifyIconW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
SHAppBarMessage

comctl32

ord17

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathAddBackslashW
PathIsRelativeW
PathIsDirectoryW
PathFindExtensionW
PathGetCharTypeW
PathCanonicalizeW
PathAddExtensionW
PathAppendW
PathFileExistsW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa5bbb3a0b94d3b48ae5b10d64310c2

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5fCertificate

Extended Key Usages

Key Usages

ef:0a:b5:2a:b6:1e:66:13:e5:d8:cd:38:ab:19:85:08:e3:fc:3a:e7Signer

Headers

File Characteristics

Imports

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

msvcp80

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 89KB - Virtual size: 89KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

ef:0a:b5:2a:b6:1e:66:13:e5:d8:cd:38:ab:19:85:08:e3:fc:3a:e7
Signer

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 89KB - Virtual size: 89KB