1e82c34124ce41b8a5ff1e337c83be9d

Sharing

Copy URL Twitter E-mail

General

Target

1e82c34124ce41b8a5ff1e337c83be9d
Size

65KB
MD5

1e82c34124ce41b8a5ff1e337c83be9d
SHA1

05d48e8a3123af7398248e1c96a347cdcbf29536
SHA256

3733e66ef541012e09abf2948f336468c7acc1bd6eae57e27d02e754e0606ae9
SHA512

7a89dca4c105738008a0e3eb2cc9d0040d6b9d33d718b151f1039d300dbc7f02ae0b4b24af57d1ac5c631291cf80077e711b0e6b3f947fb1802ae06a63728732
SSDEEP

1536:K/DLzf0qeMGzPQobURD0zakqX2wqnXYeDcJb:KLLb0q6zZUAqmgeDcV

Score

1^/10

Malware Config

Signatures

Files

1e82c34124ce41b8a5ff1e337c83be9d
.exe windows:4 windows x86 arch:x86

691eda451add6f8638b04fb55e6ad9e2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryA
GetWindowsDirectoryA
WaitForSingleObject
LocalAlloc
LocalFileTimeToFileTime
GetPrivateProfileSectionNamesA
SetMailslotInfo
SetProcessAffinityMask
GlobalCompact
GetComputerNameA
InitializeCriticalSection
GetCurrentProcessId
DuplicateHandle
WriteProfileStringA
WriteConsoleOutputAttribute
lstrcat
Process32Next
PurgeComm
WriteProcessMemory
FoldStringA
MoveFileA
UpdateResourceA
FlushInstructionCache
IsBadReadPtr
GetSystemTimeAdjustment
WritePrivateProfileStringA
VirtualQueryEx
GetLogicalDriveStringsA
lstrcmpi
TerminateThread
IsProcessorFeaturePresent
GetStringTypeExA
GetPrivateProfileIntA
GetStdHandle
GetFullPathNameA
CommConfigDialogA
MulDiv
WaitNamedPipeA
SetTimeZoneInformation
VirtualAlloc
CloseHandle
GetExitCodeThread
GetCommState
CompareStringA
SizeofResource
FindResourceA
ResetEvent
SleepEx
GetCurrentThreadId
GetProfileStringA
SetDefaultCommConfigA
WaitForMultipleObjects
HeapWalk
CreateFiber
OpenFileMappingA
GetSystemPowerStatus
CreateProcessA
ResumeThread
SetFileApisToOEM
GetCommConfig
TlsFree

shlwapi

PathStripToRootA
UrlGetLocationA
StrIsIntlEqualA
AssocQueryStringA
PathFileExistsA
PathSearchAndQualifyA
StrChrIA
PathMakePrettyA
PathIsUNCA
SHIsLowMemoryMachine
PathIsFileSpecA
ColorHLSToRGB
HashData
PathRemoveBlanksA
PathQuoteSpacesA
SHCreateStreamWrapper
SHDeleteValueA
PathAppendA
StrCSpnA
UrlIsOpaqueA
PathFindOnPathA
PathIsRelativeA
SHAutoComplete
StrToIntExA
SHRegWriteUSValueA
StrFormatByteSize64A
PathCommonPrefixA
PathGetDriveNumberA
UrlCombineA

advapi32

CryptSignHashA

Sections

.yzw
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gzu
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vyv
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pmxk
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

691eda451add6f8638b04fb55e6ad9e2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.yzw Size: 22KB - Virtual size: 45KB

.gzu Size: 5KB - Virtual size: 10KB

.vyv Size: 1KB - Virtual size: 2KB

.pmxk Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.yzw
Size: 22KB - Virtual size: 45KB

.gzu
Size: 5KB - Virtual size: 10KB

.vyv
Size: 1KB - Virtual size: 2KB

.pmxk
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB