6241355c08e8b9ae3c47069cece7529b

Sharing

Copy URL Twitter E-mail

General

Target

6241355c08e8b9ae3c47069cece7529b
Size

1.8MB
MD5

6241355c08e8b9ae3c47069cece7529b
SHA1

c6493bfa4b83abaa40794158815ab6fe0f116b17
SHA256

225acc8df899cf59befe7042c45f7a9d9d53f0ff9f08f13ff7f88f64021fa7d1
SHA512

e3143ac2abae187b1c6420230c5b2bcc65c0191730b5b39f36cb478701c376bf37111803e7bc45453e5f0766fe40221d0df839ceb662f01017838c76e804ba8a
SSDEEP

24576:UztH13tUo+ss6mKeAMGXdVOtVasxzF5M5FVyJ1PfatFUT:UjV+8mKHMGtVOtVFxeyJ1Pf0U

Score

1^/10

Malware Config

Signatures

Files

6241355c08e8b9ae3c47069cece7529b
.exe windows:5 windows x86 arch:x86

457e477bf25755903814c9c2f8182f2e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:23:9c:21:87:ef:ae:7b:a9:f3:cd:89:c4:fe:9d:84
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/08/2012, 00:00

Not After

03/09/2015, 23:59

Subject

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:04:ac:d3:2a:60:95:65:6c:a2:91:6b:56:57:01:83:95:57:32:c6
Signer

Actual PE Digest

ed:04:ac:d3:2a:60:95:65:6c:a2:91:6b:56:57:01:83:95:57:32:c6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileStringW
GetPrivateProfileStringA
WritePrivateProfileStringW
WritePrivateProfileStringA
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
HeapFree
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
RtlUnwind
RaiseException
ExitThread
CreateThread
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
WideCharToMultiByte
GetCurrentProcess
GetEnvironmentVariableW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateDirectoryW
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryW
SetLastError
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingW
WaitForSingleObject
CreateMutexW
LocalFree
FormatMessageW
SearchPathW
GetLongPathNameW
GetTempFileNameW
GetFileAttributesExW
OpenProcess
QueryPerformanceCounter
GetCurrentThreadId
OutputDebugStringW
CloseHandle
WriteFile
SetFilePointer
Sleep
CreateFileW
GetTickCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetCurrentProcessId
InitializeCriticalSection
ExpandEnvironmentStringsW
GetModuleFileNameW
GetFileSize
CancelIo
GetOverlappedResult
lstrcmpiW
RemoveDirectoryW
GetFullPathNameW
FileTimeToSystemTime
GetCommandLineW
IsProcessorFeaturePresent
lstrlenW
SetEndOfFile
ReleaseSemaphore
GetVersionExW
CreateProcessW
GetTempPathW
GetDiskFreeSpaceExW
GetExitCodeThread
GetExitCodeProcess
TerminateThread
CreateEventW
OpenEventW
ResetEvent
SetEvent
GetLocalTime
GetSystemTime
OpenMutexW
GetShortPathNameW
GetFileSizeEx
PeekNamedPipe
TryEnterCriticalSection
WaitForMultipleObjects
CreatePipe
GlobalMemoryStatusEx
OpenFileMappingW
FlushViewOfFile
GetSystemDefaultLCID
GetSystemDefaultUILanguage
DeleteFileW
GetComputerNameExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetUserDefaultLangID
LocalAlloc
GlobalAlloc
ProcessIdToSessionId
GlobalLock
GlobalUnlock
GlobalFree
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileTime
DeviceIoControl
GetSystemDirectoryW
MoveFileExW
CopyFileW
SetFileAttributesW
GetComputerNameW
GetProcessHeap
SetHandleInformation
CreateSemaphoreW
GetLastError

user32

SetThreadDesktop
SetProcessWindowStation
GetProcessWindowStation
CloseWindowStation
OpenWindowStationW
wsprintfW
GetAsyncKeyState
WaitForInputIdle
MsgWaitForMultipleObjectsEx
GetThreadDesktop
OpenDesktopW
CloseDesktop
DispatchMessageW
TranslateMessage
GetDesktopWindow
GetKeyState
SendMessageCallbackW
GetMessageW
SetTimer
RegisterWindowMessageW
DestroyIcon
LoadIconW
SystemParametersInfoW
GetSystemMetrics
MsgWaitForMultipleObjects
PeekMessageW
AllowSetForegroundWindow
ExitWindowsEx

advapi32

OpenProcessToken
CheckTokenMembership
GetUserNameW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
StartServiceW
ControlService
QueryServiceConfigW
ChangeServiceConfigW
CreateProcessAsUserW
AllocateAndInitializeSid
FreeSid
OpenEventLogW
CloseEventLog
BackupEventLogW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorW
ImpersonateLoggedOnUser
DuplicateToken
RevertToSelf
CryptCreateHash
CryptAcquireContextW
RegEnumKeyExW

ole32

CoInitialize
CoCreateInstance
OleRun
GetHGlobalFromStream
PropVariantClear
OleUninitialize
OleInitialize
CoInitializeEx
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal
CLSIDFromString

shlwapi

PathFindExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathIsFileSpecW

psapi

EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcesses

shell32

ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
ExtractIconW
SHGetFolderPathW
CommandLineToArgvW

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
GetErrorInfo
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantCopy
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen

setupapi

SetupDiCreateDeviceInfoW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiOpenDeviceInfoW
SetupDiOpenClassRegKey
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupDiDestroyDriverInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiRemoveDevice
SetupDiGetSelectedDriverW
SetupDiGetDriverInfoDetailW
SetupOpenInfFileW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
CM_Disable_DevNode
CM_Set_DevNode_Registry_PropertyW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Device_IDW
CM_Get_DevNode_Status
SetupFindFirstLineW
SetupGetLineTextW
SetupCloseInfFile
CMP_WaitNoPendingInstallEvents
SetupDiSetClassInstallParamsW
CM_Locate_DevNodeW
SetupDiCallClassInstaller

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

secur32

GetUserNameExW

wininet

InternetConnectW
HttpOpenRequestW
InternetCloseHandle
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
InternetOpenW
InternetErrorDlg
HttpAddRequestHeadersW
InternetReadFileExA
HttpQueryInfoA
HttpQueryInfoW

ws2_32

listen
WSAStartup
WSAStringToAddressW
WSACleanup
WSASocketW
setsockopt
WSACreateEvent
WSAEventSelect
WSAConnect
WSAEnumNetworkEvents
WSAResetEvent
shutdown
closesocket
WSACloseEvent
WSADuplicateSocketW
bind
WSAGetLastError
accept
recv
send
getaddrinfo
freeaddrinfo
WSAAddressToStringW

crypt32

CertDeleteCertificateFromStore
CertCloseStore
CertOpenStore
CryptUnprotectData
CertAddEncodedCertificateToStore

winspool.drv

ClosePrinter
DeletePrinter
OpenPrinterW
GetPrinterDataExW
SetPrinterDataExW
GetPrinterDriverW
XcvDataW
GetPrinterW
DeletePrinterDriverExW
GetPrinterDriverDirectoryW
EnumPrinterDriversW
SetPrinterW
SetJobW
GetJobW
EnumJobsW
ord204
ord203
AddMonitorW
DeleteMonitorW
EnumMonitorsW
EnumPortsW
StartDocPrinterW
StartPagePrinter
WritePrinter
EndPagePrinter
EndDocPrinter
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification
DocumentPropertiesW
EnumPrintersW

iphlpapi

GetAdaptersAddresses
GetIfEntry
GetAdaptersInfo
IpReleaseAddress
IpRenewAddress
AddIPAddress
DeleteIPAddress
IcmpCreateFile
IcmpSendEcho
IcmpCloseHandle
NotifyAddrChange
GetInterfaceInfo

Exports

Exports

Create_LEDM_Scan_JobFactory

Sections

.text
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 870KB - Virtual size: 869KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 193KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

457e477bf25755903814c9c2f8182f2e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

44:23:9c:21:87:ef:ae:7b:a9:f3:cd:89:c4:fe:9d:84Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ed:04:ac:d3:2a:60:95:65:6c:a2:91:6b:56:57:01:83:95:57:32:c6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shlwapi

psapi

shell32

oleaut32

setupapi

version

secur32

wininet

ws2_32

crypt32

winspool.drv

iphlpapi

Exports

Exports

Sections

.text Size: 692KB - Virtual size: 691KB

.rdata Size: 870KB - Virtual size: 869KB

.data Size: 19KB - Virtual size: 48KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 193KB - Virtual size: 194KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

44:23:9c:21:87:ef:ae:7b:a9:f3:cd:89:c4:fe:9d:84
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ed:04:ac:d3:2a:60:95:65:6c:a2:91:6b:56:57:01:83:95:57:32:c6
Signer

.text
Size: 692KB - Virtual size: 691KB

.rdata
Size: 870KB - Virtual size: 869KB

.data
Size: 19KB - Virtual size: 48KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 193KB - Virtual size: 194KB