183d7b417dfed1928f3b031c620adff6

Sharing

Copy URL Twitter E-mail

General

Target

183d7b417dfed1928f3b031c620adff6
Size

513KB
MD5

183d7b417dfed1928f3b031c620adff6
SHA1

bb071ee917444bea7ae6d5ee1d541ce61309accc
SHA256

138861b8758fe7d392ce92a6eab8f655486dd87332b6ef76f71378d11be75eab
SHA512

71535d5d2900ed2e3e4380a169331d84133217ed7f5fa07e0284e33bcb7867a6ebba5b8975c6e743ee687f442cb3d4629f579dc479f88463ecd3c975472f9578
SSDEEP

12288:jMwXwNSO5X3IA1iBihI7XHgZQKhJgeCmvz0:Yew0O1IA1UiuLHgZpJEGg

Score

1^/10

Malware Config

Signatures

Files

183d7b417dfed1928f3b031c620adff6
.exe windows:5 windows x86 arch:x86

fc9b6c7d9cc2ba69110ad83024eeffb4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5b:90:bd:89:5d:c0:c3:1d:47:f2:4a:c6:ab:73:ba:ca:4c:72:1c:20
Signer

Actual PE Digest

5b:90:bd:89:5d:c0:c3:1d:47:f2:4a:c6:ab:73:ba:ca:4c:72:1c:20

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

secur32

GetUserNameExW

advapi32

GetTokenInformation
OpenThreadToken
UnregisterTraceGuids
ConvertSidToStringSidA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsA
TraceEvent
RegQueryInfoKeyW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
IsValidSid

gdi32

GetDeviceCaps
DeleteDC
DeleteObject
CreateDCA
CreateSolidBrush

kernel32

GetSystemWindowsDirectoryW
lstrcmpiW
WriteConsoleW
SetEvent
lstrlenW
CreateEventW
GetModuleFileNameW
WaitForSingleObject
RaiseException
HeapFree
HeapAlloc
GetProcessHeap
GetModuleHandleA
VirtualAlloc
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapUnlock
HeapLock
TlsSetValue
SetLastError
GetLastError
VirtualFree
TlsGetValue
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetSystemDefaultLCID
TlsFree
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
IsValidLocale
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetVersionExA
GetModuleHandleExW
RtlCaptureStackBackTrace
ReleaseMutex
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
GetLocalTime
WriteFile
SetFileAttributesW
DeleteFileW
CreateFileW
ExpandEnvironmentStringsW
GetProcessTimes
GetCurrentProcess
GlobalFree
LoadLibraryW
OutputDebugStringA
CreateMutexA
OpenMutexA
CreateSemaphoreA
GetShortPathNameA
GetModuleFileNameA
GlobalAlloc
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
IsWow64Process
GetUserDefaultLCID
FreeLibrary
GetSystemInfo
GetVersionExW
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
CreateProcessW
LoadLibraryA
GetConsoleOutputCP
LocalFree
LocalAlloc
Sleep
GetTempPathW
GetShortPathNameW
GetLongPathNameW
CreateDirectoryW
GetFileType
CreateFileA
InitializeCriticalSection
LoadLibraryExW
IsDBCSLeadByte
GetStringTypeExW
GetACP
WideCharToMultiByte
IsValidCodePage
CompareStringW
MultiByteToWideChar
GetCurrentThread
FlushFileBuffers
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
RtlUnwind
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
InterlockedExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
SetStdHandle
GetStringTypeA
GetStringTypeW
WriteConsoleA

ole32

CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
StringFromIID

oleaut32

LoadRegTypeLi
SysFreeString
SysAllocString
LoadTypeLi

rpcrt4

UuidCreate

shell32

SHGetSpecialFolderPathW

user32

GetSysColor
EnumDisplayMonitors
GetMonitorInfoA
GetKeyboardLayoutList
GetKeyboardLayout
GetMenuCheckMarkDimensions
ReleaseDC
GetDC
SystemParametersInfoA
GetSystemMetrics

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc9b6c7d9cc2ba69110ad83024eeffb4

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

5b:90:bd:89:5d:c0:c3:1d:47:f2:4a:c6:ab:73:ba:ca:4c:72:1c:20Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

secur32

advapi32

gdi32

kernel32

ole32

oleaut32

rpcrt4

shell32

user32

Exports

Exports

Sections

.text Size: 288KB - Virtual size: 287KB

.data Size: 200KB - Virtual size: 229KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 21KB - Virtual size: 21KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

5b:90:bd:89:5d:c0:c3:1d:47:f2:4a:c6:ab:73:ba:ca:4c:72:1c:20
Signer

.text
Size: 288KB - Virtual size: 287KB

.data
Size: 200KB - Virtual size: 229KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 21KB - Virtual size: 21KB