1f1b7c1c7d9cf7f2b47e1def8e98aa65

Sharing

Copy URL Twitter E-mail

General

Target

1f1b7c1c7d9cf7f2b47e1def8e98aa65
Size

49KB
MD5

1f1b7c1c7d9cf7f2b47e1def8e98aa65
SHA1

67a7fdb828866b3a6c168ed375590f308890022c
SHA256

e0e1c5ad35fd83f6912f1ea06a2f5f67c217beece9852ae7fa07a0d4c69e32a6
SHA512

3dfa6bd113b118ea71ead194da4a119555d45ac71296e5ed6fc6652cc678f37c82d658ad14843f478c23adb9d6cc627088d26f3fa312ee6378f59607d990777e
SSDEEP

768:Cahae1TiQ1pbfHjcmbFQbJK5I6Yk6GbioADdL3jb9mU:xjXfHjcmbFIIG2ioADdT9p

Score

1^/10

Malware Config

Signatures

Files

1f1b7c1c7d9cf7f2b47e1def8e98aa65
.exe windows:4 windows x86 arch:x86

785e615ecd3afe99949a9666ff89ef73

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:1e:ed:d7:78:a5:1a:3d:59:d4:19:a8:b0:6c:a0:9c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/03/2007, 00:00

Not After

13/03/2008, 23:59

Subject

CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Enterprise Security Division,O=SafeNet\, Inc.,L=Baltimore,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msi

ord36

kernel32

GetLastError
WaitForSingleObject
GetVersionExA
GetStringTypeA
GetTempPathA
GetEnvironmentVariableA
SetHandleCount
LCMapStringW
LCMapStringA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
CloseHandle
WriteFile
TerminateProcess
GetCurrentProcess
GetFileAttributesA
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
GetExitCodeProcess
CreateProcessA
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
ReadFile
MultiByteToWideChar
CompareStringA
CompareStringW
SetEnvironmentVariableA

advapi32

RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteExA

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

785e615ecd3afe99949a9666ff89ef73

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4d:1e:ed:d7:78:a5:1a:3d:59:d4:19:a8:b0:6c:a0:9cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

msi

kernel32

advapi32

shell32

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4d:1e:ed:d7:78:a5:1a:3d:59:d4:19:a8:b0:6c:a0:9c
Certificate

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB