04b0cbb533d0a351cf89c86357c7fefa

Sharing

Copy URL Twitter E-mail

General

Target

04b0cbb533d0a351cf89c86357c7fefa
Size

597KB
MD5

04b0cbb533d0a351cf89c86357c7fefa
SHA1

e45e3379e55735e393aa83627f2349d90a322d2b
SHA256

9076bef90daaffe9d8185cf1594767496d1ff7650e9176342b879a4f27c0db6e
SHA512

36ee6396fdd3b307750c8f9d29660e8354369f035e78c4053f64bd99471a5ac73fe9e2c2af5938baf77d46dd06a12f3c34aad0002da190d0362cef03716d4cb9
SSDEEP

12288:LBfGz2HEVLsAfWP9fp1sf+BxZ0sc1Vd2y9on9ibcJ5YliEZNC047hJMJET:LBfjkVLsAfWL1sf+BH01XlS9G5ZA047l

Score

1^/10

Malware Config

Signatures

Files

04b0cbb533d0a351cf89c86357c7fefa
.exe windows:5 windows x86 arch:x86

c3e516204c5e0a239ff0a283f75e71a0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:a1:22:3e:32:0b:2e:c6:c2:c8:78:9b:5c:b4:bb:4b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/12/2014, 00:00

Not After

22/12/2015, 23:59

Subject

CN=Roll Around,O=Roll Around,L=Los Angeles,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:08:af:5e:51:60:00:d3:1e:a0:ee:97:70:1c:ae:6d:d1:67:83:76
Signer

Actual PE Digest

6a:08:af:5e:51:60:00:d3:1e:a0:ee:97:70:1c:ae:6d:d1:67:83:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RaiseException
GetComputerNameW
ReleaseMutex
CreateMutexW
GetCurrentProcess
InterlockedIncrement
GetModuleFileNameW
GetOverlappedResult
DeleteFileW
GetVersionExW
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
CreateEventW
ResetEvent
WaitForMultipleObjects
SetEvent
CreateNamedPipeW
ConnectNamedPipe
WaitNamedPipeW
Sleep
CancelIo
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
OpenProcess
SetErrorMode
DecodePointer
GetOEMCP
GetACP
WaitForSingleObject
GetProcAddress
GetModuleHandleW
InterlockedDecrement
LocalFree
SetFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
CreateDirectoryW
GetFileAttributesW
SetFilePointer
WriteFile
ReadFile
CreateFileW
CloseHandle
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
IsValidCodePage
GetStdHandle
lstrlenA
SetEndOfFile
LoadLibraryW
SetEnvironmentVariableA
WriteConsoleW
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeZoneInformation
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetTimeFormatW
ReleaseSemaphore
VirtualProtect
HeapDestroy
CopyFileW
GetLastError
VirtualFree
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
FreeLibrary
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetExitCodeThread
GetStringTypeW
GetSystemTimeAsFileTime
EncodePointer
IsProcessorFeaturePresent
GetCPInfo
ExitProcess
GetModuleHandleExW
GetCommandLineW
RtlUnwind
CreateTimerQueue
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetStartupInfoW
GetTickCount
CreateSemaphoreW
ExitThread
LoadLibraryExW
GetDateFormatW
GetFileType

advapi32

CryptDeriveKey
OpenProcessToken
CryptGetHashParam
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptExportKey
CryptDuplicateKey
CryptGenKey
CryptImportKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsValidSid
CryptDestroyHash
CryptHashData
CryptCreateHash
LookupAccountSidW
ConvertSidToStringSidW
CryptReleaseContext
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptAcquireContextW
LookupAccountNameW
GetTokenInformation

shell32

SHGetFolderPathW
ord165

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
StringFromGUID2
CoCreateGuid
CoCreateInstance

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringLen
VariantClear
SysFreeString

shlwapi

PathFindFileNameW
PathAppendW
PathCombineW
PathFileExistsW
PathCombineA
PathFindExtensionW
PathRemoveFileSpecW
PathMakePrettyW
PathRenameExtensionW
PathStripPathW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

winhttp

WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpSendRequest
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpReadData

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3e516204c5e0a239ff0a283f75e71a0

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

02:a1:22:3e:32:0b:2e:c6:c2:c8:78:9b:5c:b4:bb:4bCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

6a:08:af:5e:51:60:00:d3:1e:a0:ee:97:70:1c:ae:6d:d1:67:83:76Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

winhttp

version

Sections

.text Size: 463KB - Virtual size: 462KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 11KB - Virtual size: 28KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

02:a1:22:3e:32:0b:2e:c6:c2:c8:78:9b:5c:b4:bb:4b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6a:08:af:5e:51:60:00:d3:1e:a0:ee:97:70:1c:ae:6d:d1:67:83:76
Signer

.text
Size: 463KB - Virtual size: 462KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 11KB - Virtual size: 28KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB