2098c964feec9720e9dc76f9f5274d2c

Sharing

Copy URL Twitter E-mail

General

Target

2098c964feec9720e9dc76f9f5274d2c
Size

1.3MB
MD5

2098c964feec9720e9dc76f9f5274d2c
SHA1

e9fc7a34ed8ecb4891b5eefa279411d69c3f73f4
SHA256

0569f7b70bf932331f0ccbff552d1a15458c56e58600d2dc9f31c067e19ffa7d
SHA512

1391684da135af49d73aa3d362b88b4763b15385f322b34175a290be3615ba4fb1c0fac2d19f883d6e9e78490340d97355c4719aeed41cff65dafcb423c86db5
SSDEEP

24576:8Y0PMeXBBbLjse/fBAy+CIL1sd0FYnMKJUvDzTL:8dP1sUfxZIhsdcYrULzH

Score

1^/10

Malware Config

Signatures

Files

2098c964feec9720e9dc76f9f5274d2c
.exe windows:5 windows x86 arch:x86

ef1c7a48d9044aa991779608a9efd584

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:90:96:5e:91:33:40:cd:a6:63:4c:ef:31:f7:fd:07
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

28/09/2009, 00:00

Not After

04/11/2012, 23:59

Subject

CN=Adobe Systems\, Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Acrobat Engineering,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c7:bc:ca:2c:97:fb:4c:b1:81:69:43:85:26:74:82:15:af:0f:da:f9
Signer

Actual PE Digest

c7:bc:ca:2c:97:fb:4c:b1:81:69:43:85:26:74:82:15:af:0f:da:f9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
lstrlenA
ReadProcessMemory
WideCharToMultiByte
SetErrorMode
ReleaseSemaphore
CreateSemaphoreW
HeapSetInformation
FindResourceExW
OpenProcess
ExitProcess
GetCurrentDirectoryW
GetSystemDirectoryW
SetCurrentDirectoryW
GetCurrentProcess
GetCommandLineW
GetTempPathW
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetExitCodeProcess
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
GetVersion
GetFileAttributesW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
InitializeCriticalSection
GetCurrentProcessId
CreateNamedPipeW
LocalFree
ResetEvent
CreateThread
CreateEventW
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
WriteFile
ConnectNamedPipe
ReadFile
DisconnectNamedPipe
SetEvent
WaitForSingleObject
CloseHandle
CreateMutexW
CallNamedPipeW
GetLastError
WaitNamedPipeW
CreateFileW
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetDriveTypeA
GetCurrentDirectoryA
CreateFileA
GetLocaleInfoW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
FreeEnvironmentStringsW
IsValidCodePage
LocalAlloc
InterlockedCompareExchange
InterlockedExchange
SignalObjectAndWait
TerminateProcess
GetTickCount
SetInformationJobObject
TerminateJobObject
GetQueuedCompletionStatus
DuplicateHandle
GetCurrentThreadId
CreateIoCompletionPort
PostQueuedCompletionStatus
ResumeThread
WriteProcessMemory
MapViewOfFile
CreateFileMappingW
GetThreadContext
AssignProcessToJobObject
GetStartupInfoW
UnregisterWaitEx
RegisterWaitForSingleObject
CreateJobObjectW
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
SearchPathW
ExpandEnvironmentStringsW
QueryInformationJobObject
HeapAlloc
GetProcessHeap
VirtualProtect
CreateProcessW
OpenEventW
DebugBreak
VirtualQuery
SuspendThread
WaitForMultipleObjects
VirtualQueryEx
GetLongPathNameW
QueryDosDeviceW
InterlockedExchangeAdd
SetUnhandledExceptionFilter
DeleteFileW
SetFilePointer
ReleaseMutex
Sleep
IsDebuggerPresent
GetStdHandle
CreateToolhelp32Snapshot
GetSystemInfo
Process32NextW
Process32FirstW
GetProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GlobalUnlock
GlobalLock
GlobalSize
GlobalAddAtomW
GetFileType
GetExitCodeThread
GetWindowsDirectoryW
MoveFileExW
QueueUserWorkItem
GlobalAlloc
GlobalFree
VerifyVersionInfoW
VerSetConditionMask
lstrcmpiA
GetEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateDirectoryExW
RtlUnwind
HeapFree
UnhandledExceptionFilter
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFullPathNameW
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
GetModuleFileNameA
HeapSize
GetACP
GetOEMCP

user32

SetActiveWindow
CloseWindow
GetClipboardFormatNameA
GetClipboardData
ReleaseDC
GetDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
EnumClipboardFormats
CountClipboardFormats
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetClipboardOwner
GetPriorityClipboardFormat
GetOpenClipboardWindow
ChangeClipboardChain
GetClipboardViewer
SetClipboardViewer
RegisterClipboardFormatW
RegisterClipboardFormatA
LoadCursorW
LoadIconW
SendDlgItemMessageW
FindWindowExW
EnumThreadWindows
SetWindowPos
GetParent
DdeClientTransaction
EnumChildWindows
GetWindowInfo
SetWindowTextW
IsWindowEnabled
EnableWindow
RegisterClassW
GetAsyncKeyState
UnregisterClassW
MsgWaitForMultipleObjectsEx
WaitMessage
GetQueueStatus
PostQuitMessage
CallMsgFilterW
KillTimer
GetClassNameW
SetWindowLongW
GetUserObjectInformationW
GetWindowThreadProcessId
GetGUIThreadInfo
SendMessageW
DialogBoxParamW
CharNextW
GetDlgItem
EndDialog
IsWindow
EnumWindows
DestroyWindow
PostMessageW
SetParent
GetFocus
GetActiveWindow
RegisterWindowMessageW
RegisterClassExW
CreateWindowExW
SetTimer
GetDesktopWindow
CloseWindowStation
CloseDesktop
CreateWindowStationW
AllowSetForegroundWindow
BringWindowToTop
GetWindowLongW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
PeekMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
DdeDisconnect
DdeConnect
DdeCreateDataHandle
DdeAddData
DdeGetData
DdeInitializeW
DdeUninitialize
DdeFreeStringHandle
DdeCreateStringHandleW
DdeNameService
FindWindowA
RegisterWindowMessageA
ShowWindow
FindWindowW
DefWindowProcW
MessageBoxW
UserHandleGrantAccess

advapi32

CryptHashData
RegCloseKey
CreateProcessAsUserW
CreateRestrictedToken
DuplicateTokenEx
DuplicateToken
LookupPrivilegeValueW
CopySid
CreateWellKnownSid
GetSecurityInfo
SetEntriesInAclW
ConvertSidToStringSidW
CheckTokenMembership
CryptGetProvParam
CryptSetProvParam
CryptGenRandom
CryptDecrypt
CryptSignHashA
CryptSignHashW
CryptGetHashParam
CryptAcquireContextA
CryptAcquireContextW
CryptImportKey
CryptGetUserKey
CryptCreateHash
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
RegOpenKeyExW
CryptGenKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegDisablePredefinedCache
RevertToSelf
SetSecurityInfo
GetSecurityDescriptorSacl
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetThreadToken
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
EqualSid
RegQueryValueExA
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

ord43
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHGetPathFromIDListW
SHBrowseForFolderW
FindExecutableW
SHGetFileInfoW
CommandLineToArgvW

ole32

CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoMarshalInterface
GetHGlobalFromStream
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoResumeClassObjects
CoInitializeEx
CLSIDFromProgID
CoUnmarshalInterface
ReleaseStgMedium

oleaut32

SysAllocStringByteLen
SafeArrayRedim
VariantCopyInd
VariantClear
LoadTypeLi
LoadRegTypeLi
SysAllocString
SafeArrayPutElement
VariantCopy
SafeArrayCopy
VariantInit
VarBstrCmp
SafeArrayGetVartype
SafeArrayDestroy
SafeArrayCreate
SysStringByteLen
SysAllocStringLen
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
SysStringLen
VarUI4FromStr
SysFreeString
SafeArrayGetLBound

mapi32

ord19

shlwapi

AssocQueryStringW
PathFileExistsW
PathIsDirectoryW
PathAppendW
PathIsRelativeW
PathFindExtensionW
PathAddBackslashW
UrlCanonicalizeW
PathCreateFromUrlW
UrlIsW
PathIsURLW
PathFindFileNameW
PathRemoveFileSpecW

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

secur32

FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
DeleteSecurityContext
AcquireCredentialsHandleA

gdi32

GetStockObject
GetEnhMetaFileHeader
GetCurrentObject
GetRgnBox
CreateRectRgn
CombineRgn
CreateEnhMetaFileW
SetPolyFillMode
GetObjectType
CloseEnhMetaFile
CreateCompatibleBitmap
SetDIBits
GetObjectW
GetDIBits
GetEnhMetaFileBits
PlayEnhMetaFile
DeleteEnhMetaFile
SelectObject
GetFontData
CreateScalableFontResourceW
RemoveFontResourceW
DeleteObject
CreateFontIndirectW
GetClipBox
CreateDCW
GetTextColor
GetTextAlign
GetBkMode
GetStretchBltMode
GetPolyFillMode
GetMiterLimit
AddFontResourceW
DeleteDC
ExtEscape
Escape
ResetDCW
EndDoc
EndPage
StartPage
AbortDoc
StartDocW
GetDeviceCaps
SetEnhMetaFileBits
CreateDCA
CreateICW

winspool.drv

ClosePrinter
DeviceCapabilitiesW
DeviceCapabilitiesA
DeletePrinterDataW
DeletePrinterDataA
SetPrinterW
GetPrinterDriverA
GetPrinterDriverW
DocumentPropertiesW
GetPrinterW
EnumPrintersA
OpenPrinterW
EnumPrintersW
OpenPrinterA

Sections

.text
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ef1c7a48d9044aa991779608a9efd584

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

02:90:96:5e:91:33:40:cd:a6:63:4c:ef:31:f7:fd:07Certificate

Extended Key Usages

Key Usages

c7:bc:ca:2c:97:fb:4c:b1:81:69:43:85:26:74:82:15:af:0f:da:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

mapi32

shlwapi

winmm

secur32

gdi32

winspool.drv

Sections

.text Size: 706KB - Virtual size: 706KB

.rdata Size: 203KB - Virtual size: 203KB

.data Size: 13KB - Virtual size: 26KB

.rsrc Size: 300KB - Virtual size: 299KB

.reloc Size: 90KB - Virtual size: 90KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

02:90:96:5e:91:33:40:cd:a6:63:4c:ef:31:f7:fd:07
Certificate

c7:bc:ca:2c:97:fb:4c:b1:81:69:43:85:26:74:82:15:af:0f:da:f9
Signer

.text
Size: 706KB - Virtual size: 706KB

.rdata
Size: 203KB - Virtual size: 203KB

.data
Size: 13KB - Virtual size: 26KB

.rsrc
Size: 300KB - Virtual size: 299KB

.reloc
Size: 90KB - Virtual size: 90KB