021cf64c68a27722b7098d53623eafb5

Sharing

Copy URL

Twitter E-mail

General

Target

021cf64c68a27722b7098d53623eafb5
Size

507KB
MD5

021cf64c68a27722b7098d53623eafb5
SHA1

a06caca4326e6adb32b7c9807f1f96b6e765d5ef
SHA256

375a90c59a359dde967d82c764458b90f1a4ff9281e2c70d00b9f963c64785e7
SHA512

8ae7cdaf8e3b1715a1877520ee4f621de8286a578784ac9181638200dca0a03c23af9c4e812ebaaa88d49a707fceb1860dec3241df4b49d376d227c127864066
SSDEEP

12288:L5EsJFlthpr00/IjueEm8LooKZnMqz1wnkTJ4VrVwqhp:9NHprdP5mVnMqzgVVrScp

Score

1^/10

Malware Config

Signatures

Files

021cf64c68a27722b7098d53623eafb5
.exe windows:4 windows x86 arch:x86

fee1dbe302143a5dc1493badbe45f2e4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:da:3e:de:77:ba:07:d8:48:01:8d:41:b8:c5:56:0b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-01-2006 00:00

Not After

24-01-2009 23:59

Subject

CN=America Online\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Nullsoft,O=America Online\, Inc.,L=Dulles,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
ReleaseSemaphore
GetLastError
CreateSemaphoreW
CloseHandle
GetTickCount
LeaveCriticalSection
TryEnterCriticalSection
CreateEventW
Sleep
SetEvent
InterlockedDecrement
ResetEvent
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcess
EnterCriticalSection
GetModuleFileNameW
CreateDirectoryW
CreateFileW
SetLastError
GetLocaleInfoW
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
DeleteFileW
SetFilePointer
GetFileSize
WriteFile
LocalFree
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GetCurrentProcessId
FormatMessageA
FormatMessageW
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
GetComputerNameW
GetSystemTimeAsFileTime
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
GetVersion
SwitchToThread
GlobalAlloc

esent

JetGetCursorInfo
JetCreateDatabaseWithStreaming
JetGetCounter
JetGetDatabaseFileInfo
JetRetrieveColumns
JetGetTableColumnInfo
JetCloseDatabase
JetCloseFileInstance
JetRetrieveKey
JetGetIndexInfo

pdh

PdhVbOpenQuery
PdhOpenLogA
PdhExpandWildCardPathHW
PdhEnumMachinesW
PdhCloseLog
PdhOpenQueryA
PdhTranslate009CounterA
PdhEnumLogSetNamesA
PdhLookupPerfNameByIndexW
PdhAdd009CounterA
PdhConnectMachineA
PdhGetDataSourceTimeRangeA

stobject

DllCanUnloadNow

cryptui

CryptUIFreeCertificatePropertiesPagesW

ole32

OleInitialize

Sections

Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc104
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fee1dbe302143a5dc1493badbe45f2e4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

24:da:3e:de:77:ba:07:d8:48:01:8d:41:b8:c5:56:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

esent

pdh

stobject

cryptui

ole32

Sections

Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 412KB

.rdata Size: 418KB - Virtual size: 418KB

.rsrc104 Size: 37KB - Virtual size: 36KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

24:da:3e:de:77:ba:07:d8:48:01:8d:41:b8:c5:56:0b
Certificate

.data
Size: 2KB - Virtual size: 412KB

.rdata
Size: 418KB - Virtual size: 418KB

.rsrc104
Size: 37KB - Virtual size: 36KB