001f2ec9cef84f6b6ee9aa7412be6f9a

Sharing

Copy URL Twitter E-mail

General

Target

001f2ec9cef84f6b6ee9aa7412be6f9a
Size

65KB
MD5

001f2ec9cef84f6b6ee9aa7412be6f9a
SHA1

11234a97dabbd30fdb11d1ef6d3a871abb0543a5
SHA256

235484e66fe75b73b351a1856348b80a693a69cf6569b43c4c97c8dcdae36a3f
SHA512

5fc086a56abc75cf7535be09041575ad9ada6e0e22b31bc5de680c077164e69ee6bce395cb1aa216bd6590abc0cdf3002d436c4f6ec0c48b05b1afeae7bc6745
SSDEEP

768:Ba4qYXiw91xuQst0zmR3inx2EKrb5J+Ck7bzVGwfTQd06Ie9b+lAf7nHpG+rqrD5:kYb2t05WhU7QtIe3WrDItDYRb

Score

1^/10

Malware Config

Signatures

Files

001f2ec9cef84f6b6ee9aa7412be6f9a
.exe windows:4 windows x86 arch:x86

a2c07eced424e356c1635991e2f9bafb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrIA
UrlGetLocationA
UrlIsOpaqueA
PathSearchAndQualifyA
PathRemoveBlanksA
PathGetDriveNumberA
PathCommonPrefixA
PathAppendA
SHRegEnumUSKeyA
SHDeleteValueA
StrIsIntlEqualA
SHRegOpenUSKeyA
StrSpnA
AssocQueryStringA
PathFindOnPathA
ColorHLSToRGB
HashData
UrlCombineA
PathIsFileSpecA
PathIsRelativeA
PathMakePrettyA
StrRChrIA
StrCSpnA
PathQuoteSpacesA
SHCreateStreamWrapper
SHRegCreateUSKeyA
SHAutoComplete
PathStripToRootA
PathIsUNCA

kernel32

FreeConsole
SleepEx
CopyFileA
GetTickCount
CreateProcessA
WriteFileGather
GetFullPathNameA
MoveFileA
FlushInstructionCache
InterlockedIncrement
GetCPInfoExA
EnumResourceTypesA
InterlockedExchange
ReleaseSemaphore
CreateMailslotA
_lclose
CallNamedPipeA
WriteProfileStringA
IsValidCodePage
GetCommConfig
GlobalUnlock
SetupComm
GetBinaryTypeA
GetCurrentDirectoryA
CreateThread
lstrcmp
SwitchToFiber
GetConsoleCursorInfo
AddAtomA
LocalLock
GetPrivateProfileSectionNamesA
GlobalCompact
ExpandEnvironmentStringsA
FatalExit
FoldStringA
LoadModule
VirtualLock
GetTapeParameters
GetCommModemStatus
SetNamedPipeHandleState
_hread
FindCloseChangeNotification
GetLongPathNameA
IsProcessorFeaturePresent
SetProcessShutdownParameters
GetProcessVersion
MapViewOfFile
EnumCalendarInfoA
WriteFile
ReadFileEx
GetSystemDirectoryA
lstrcat
GetConsoleTitleA
HeapCompact
ContinueDebugEvent
LocalUnlock
OpenFileMappingA
SetFileApisToOEM
SetEvent
lstrlen
EraseTape

advapi32

RegSaveKeyA

Sections

.nihs
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qrcjg
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jslof
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hqz
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2c07eced424e356c1635991e2f9bafb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

Sections

.nihs Size: 22KB - Virtual size: 45KB

.qrcjg Size: 5KB - Virtual size: 10KB

.jslof Size: 1KB - Virtual size: 2KB

.hqz Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.nihs
Size: 22KB - Virtual size: 45KB

.qrcjg
Size: 5KB - Virtual size: 10KB

.jslof
Size: 1KB - Virtual size: 2KB

.hqz
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB