1c5b9a87f7c88e62b027584f19b4ab57

Sharing

Copy URL Twitter E-mail

General

Target

1c5b9a87f7c88e62b027584f19b4ab57
Size

876KB
MD5

1c5b9a87f7c88e62b027584f19b4ab57
SHA1

c80e9a799e87da30ae36a9438aa46a8eb5766ebf
SHA256

f637c2c4b56404fdfba77cc91816c9265d130a17f38759391c1d588f20b9bc8b
SHA512

239852e3d7744bf81f9c941e3d111acb9562b574d27763e089d0443710a10fe5170554eef16371144beff6451ae8b460055b6c52eb37188f7755bd64f6afa684
SSDEEP

24576:Yc9XDtsr6l5947sHXL0cJ1xT06CPWqW1:YcZDy2L9+wYcJzYeqW1

Score

1^/10

Malware Config

Signatures

Files

1c5b9a87f7c88e62b027584f19b4ab57
.exe windows:4 windows x86 arch:x86

1d58c4f16f07d6b9da1ec513a16e7493

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

BuildSecurityDescriptorA
QueryServiceObjectSecurity
RegQueryValueA
OpenEventLogA
InitializeAcl
RevertToSelf
GetTrusteeTypeA
CryptContextAddRef
ChangeServiceConfigA
AllocateAndInitializeSid
RegSaveKeyA
CryptGetKeyParam
GetNumberOfEventLogRecords
RegDeleteValueA
AccessCheck
ObjectDeleteAuditAlarmA
GetAclInformation
CryptDestroyHash
RegConnectRegistryA
ControlService
GetSecurityDescriptorControl
PrivilegeCheck
RegOpenKeyA
CryptGenKey
RegUnLoadKeyA
CopySid
CryptHashSessionKey
GetSecurityDescriptorOwner
AddAce
GetSidSubAuthority
SetServiceStatus
DeregisterEventSource
EnumDependentServicesA
CryptSignHashA
IsTextUnicode
SetEntriesInAuditListA

user32

SetScrollInfo
TranslateAccelerator
WinHelpA
wvsprintfA
ScrollDC
CopyIcon
GetMenuCheckMarkDimensions
GetKBCodePage
CharNextExA
MessageBoxA
DestroyAcceleratorTable
MsgWaitForMultipleObjects
LoadAcceleratorsA
SendIMEMessageExA
CheckMenuItem
SetKeyboardState
ArrangeIconicWindows
DlgDirSelectExA
GetComboBoxInfo
GetClassInfoA
GetDlgCtrlID
SetMessageExtraInfo
LoadMenuIndirectA
GetTopWindow
CharToOemBuffA
TileWindows
ChildWindowFromPointEx
GetClassWord
EnumDisplayMonitors
EnableScrollBar
DrawFrame
SetMenuDefaultItem
GetDoubleClickTime
GetProcessDefaultLayout
ToUnicodeEx
DdeNameService
GetWindowWord
IMPGetIMEA
ShowCursor
GetKeyboardLayoutList
GetShellWindow
GetWindowRect
GetDC
SwitchToThisWindow
MonitorFromPoint
RemovePropA
LoadIconA
SetDoubleClickTime
RedrawWindow
OpenDesktopA
InsertMenuItemA
DdeGetLastError
EnumPropsExA
DrawTextExA

kernel32

SetVolumeLabelA

Sections

.gjip
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ohshy
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pwz
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.efo
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xmfk
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pwjcv
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfmt
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mvy
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ypmj
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d58c4f16f07d6b9da1ec513a16e7493

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.gjip Size: 638KB - Virtual size: 1.3MB

.ohshy Size: 6KB - Virtual size: 8KB

.pwz Size: 19KB - Virtual size: 27KB

.efo Size: 512B - Virtual size: 21KB

.xmfk Size: 6KB - Virtual size: 15KB

.pwjcv Size: 512B - Virtual size: 56B

.gfmt Size: 512B - Virtual size: 24B

.mvy Size: 48KB - Virtual size: 77KB

.ypmj Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.gjip
Size: 638KB - Virtual size: 1.3MB

.ohshy
Size: 6KB - Virtual size: 8KB

.pwz
Size: 19KB - Virtual size: 27KB

.efo
Size: 512B - Virtual size: 21KB

.xmfk
Size: 6KB - Virtual size: 15KB

.pwjcv
Size: 512B - Virtual size: 56B

.gfmt
Size: 512B - Virtual size: 24B

.mvy
Size: 48KB - Virtual size: 77KB

.ypmj
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB