18a5003cc934de83152bb84b6f210ea6

Sharing

Copy URL Twitter E-mail

General

Target

18a5003cc934de83152bb84b6f210ea6
Size

144KB
MD5

18a5003cc934de83152bb84b6f210ea6
SHA1

b5f03357cc08486cc049212347186f1b78f44e39
SHA256

e6c802cf95f5f60cc6a904eb3121f31a7700ba64f2bbca560d905dc4b04de9fb
SHA512

6daff55ab31aa4da5db9e0d4aff16c77ad1f801d52cc97afac161c2c64d37bc0c3c66053275532e6507ac50f476963ce42809cadccad9dbef61df045b77d60df
SSDEEP

3072:2w9+zAw+cG69avcxhv7a1I+LDwzT+/0RhoX7GvFl52v03l+pFH2:26+Mw/9aI7cz/0RhoXwEcQG

Score

1^/10

Malware Config

Signatures

Files

18a5003cc934de83152bb84b6f210ea6
.dll regsvr32 windows:4 windows x86 arch:x86

c91d20ee94052d1ccecf9b233baa7ca6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:eb:dd:a6:15:88:5d:a6:20:e2:1c:47:4c:52:b3:76
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

26/04/2005, 00:00

Not After

11/06/2006, 23:59

Subject

CN=Miniclip Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=UK,O=Miniclip Limited,L=London,ST=united kingdom,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e9:35:50:a9:f8:86:fc:c5:0e:5f:09:e4:26:d1:67:59:60:b5:27:03
Signer

Actual PE Digest

e9:35:50:a9:f8:86:fc:c5:0e:5f:09:e4:26:d1:67:59:60:b5:27:03

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GlobalHandle
HeapAlloc
FlushInstructionCache
GetCurrentProcess
lstrcmpA
lstrcatA
FlushFileBuffers
SetStdHandle
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
GetCurrentThreadId
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapSize
TerminateProcess
GetProcAddress
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetCPInfo
GetOEMCP
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
RtlUnwind
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
SetLastError
IsDBCSLeadByte
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
LockResource
LoadLibraryA
FindResourceA
LoadResource
FreeLibrary
CreateThread
MulDiv
lstrcpynA
GetModuleFileNameA
GetModuleHandleA
lstrcpyA
lstrlenW
lstrcmpiA
lstrlenA
GetProcessHeap
HeapFree
WinExec
GetLastError
InterlockedExchange
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FreeEnvironmentStringsW
CloseHandle

user32

GetWindowLongA
EnumChildWindows
DestroyAcceleratorTable
MessageBoxA
SendMessageA
GetDlgItem
GetDialogBaseUnits
ReleaseDC
GetDC
UnregisterClassA
DestroyWindow
CharNextA
DrawTextA
GetSysColor
SetWindowLongA
SystemParametersInfoA
SendDlgItemMessageA
IsChild
GetParent
GetFocus
ReleaseCapture
GetWindow
IsWindow
GetKeyState
FillRect
GetClientRect
InvalidateRgn
GetDesktopWindow
CallWindowProcA
EndPaint
BeginPaint
RedrawWindow
GetClassNameA
CreateAcceleratorTableA
CreateWindowExA
wsprintfA
SetWindowContextHelpId
MapDialogRect
SetCapture
SetFocus
PtInRect
UnionRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateDialogIndirectParamA
ShowWindow
GetNextDlgTabItem
CopyAcceleratorTableA
IsDialogMessageA
InvalidateRect
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos

gdi32

GetDeviceCaps
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPointA
DeleteObject
SetMapMode
SaveDC
LPtoDP
CreateDCA
SetBkColor
SetBkMode
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileA
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
SetTextColor
Rectangle
GetStockObject
RestoreDC
DeleteDC
SetViewportOrgEx
GetObjectA
SelectObject
SetWindowOrgEx

advapi32

RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA

shell32

SHGetFileInfoA

ole32

CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateOleAdviseHolder
CreateDataAdviseHolder
CoTaskMemAlloc
OleRegGetMiscStatus
OleRegGetUserType
OleRegEnumVerbs
StringFromCLSID

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
OleCreateFontIndirect
OleTranslateColor
LoadRegTypeLi
OleCreatePropertyFrame
SysAllocStringByteLen
SysStringByteLen
LoadTypeLi
VariantChangeType
VariantInit
VariantClear
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocString

shlwapi

PathFindExtensionA

urlmon

URLDownloadToFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c91d20ee94052d1ccecf9b233baa7ca6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

5d:eb:dd:a6:15:88:5d:a6:20:e2:1c:47:4c:52:b3:76Certificate

Extended Key Usages

Key Usages

e9:35:50:a9:f8:86:fc:c5:0e:5f:09:e4:26:d1:67:59:60:b5:27:03Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

5d:eb:dd:a6:15:88:5d:a6:20:e2:1c:47:4c:52:b3:76
Certificate

e9:35:50:a9:f8:86:fc:c5:0e:5f:09:e4:26:d1:67:59:60:b5:27:03
Signer

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB