0bfa8ef43ffa27d7a5a3e15216795a25

Sharing

Copy URL

Twitter E-mail

General

Target

0bfa8ef43ffa27d7a5a3e15216795a25
Size

2.8MB
MD5

0bfa8ef43ffa27d7a5a3e15216795a25
SHA1

6b2544cf0d54e1e29d3b620dedd6dfececab6296
SHA256

163637b73a55ea9fd571d1b23158f9ddc7f91f602052e02cfeaaf399c855b8c2
SHA512

bb5f15588fe6c4e3412a9b96ffd0b7077b04beceed6a2f7f232ba2ca4133366d08025798085cce5fa2e7caec9d703f9c46af4ee2728101bfad2f1806c7369187
SSDEEP

49152:nRnbpZbKD4eS03aMrxkBM2u/EFbNgwFWclebK0tq6M8eIHtx8qjJ8:nRnbP03rlGru/ERB4yeto87txvji

Score

1^/10

Malware Config

Signatures

Files

0bfa8ef43ffa27d7a5a3e15216795a25
.exe windows:5 windows x86 arch:x86

049b012ef0ce8b2f1d8490cb559df93f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:43:7b:55:e4:45:5f:aa:6c:e9:25:0d:58:4f:c5:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/11/2009, 00:00

Not After

13/11/2010, 23:59

Subject

CN=Screaming Bee LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Screaming Bee LLC,L=Middleton,ST=Wisconsin,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:ea:6c:8a:0b:73:52:be:ce:57:30:c5:22:8d:7c:f7:5f:ac:89:97
Signer

Actual PE Digest

2c:ea:6c:8a:0b:73:52:be:ce:57:30:c5:22:8d:7c:f7:5f:ac:89:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
FindFirstFileA
SetFileAttributesA
GetTempFileNameA
FindClose
Process32Next
LockResource
GetModuleFileNameA
FindNextFileA
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
GetTempPathA
DeleteFileA
lstrcpyA
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetCurrentProcess
SetFileTime
WriteFile
GetFileType
GetCurrentDirectoryA
ReadFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
LoadLibraryA
GetFileAttributesA
SizeofResource
GetWindowsDirectoryA
LoadResource
Process32First
MoveFileExA
lstrlenA
FindResourceA
GetFileSize
CreateFileA
HeapSize
FlushFileBuffers
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetConsoleCP
GetConsoleMode

user32

EndPaint
DestroyWindow
RegisterClassExA
PostQuitMessage
GetClassInfoExA
WaitForInputIdle
wsprintfA
GetClientRect
BeginPaint
SetWindowLongA
MessageBoxA
InvalidateRect
GetWindowLongA
CreateWindowExA
PeekMessageA
DefWindowProcA
ShowWindow
DispatchMessageA
GetSystemMetrics
LoadCursorA
MoveWindow
TranslateMessage

gdi32

SelectObject
Rectangle
GetStockObject
Polygon

advapi32

RegFlushKey
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteExA
SHFileOperationA

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

049b012ef0ce8b2f1d8490cb559df93f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

37:43:7b:55:e4:45:5f:aa:6c:e9:25:0d:58:4f:c5:98Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

2c:ea:6c:8a:0b:73:52:be:ce:57:30:c5:22:8d:7c:f7:5f:ac:89:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

37:43:7b:55:e4:45:5f:aa:6c:e9:25:0d:58:4f:c5:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

2c:ea:6c:8a:0b:73:52:be:ce:57:30:c5:22:8d:7c:f7:5f:ac:89:97
Signer

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB