298277474da7c5883f640682ed050f70

Sharing

Copy URL Twitter E-mail

General

Target

298277474da7c5883f640682ed050f70
Size

174KB
MD5

298277474da7c5883f640682ed050f70
SHA1

0bcba1910ae9890494bb8830014d041f068e6608
SHA256

846328b8c1fa105ef8be197ab427954d2e477507a1d21b05b90ffcfcc3bdfe52
SHA512

a2b8ceb36a5c7827a7ef166cbce8f707dff6a86432f1b48bc9bd013ecaf3c6ced251ce7a6e4d67c0b2abef9324394d3ad5fb8b66d74c7e8d6e321fb6405c9628
SSDEEP

3072:wlOEaa7GSXp8oLYXO9pZOsFT+vZCr/nF0WoTnwRNzco/Vjdo+Ln/g:w8sX2VXeNOCrPFSw3xLoeg

Score

1^/10

Malware Config

Signatures

Files

298277474da7c5883f640682ed050f70
.dll windows:4 windows x86 arch:x86

d0db17c3f37d55f26d6153dd739d0b01

Code Sign

40:4a:38:28:0b:f7:2c:7a:2c:be:66:6a:e1:46:61:1f
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

03/11/2009, 00:00

Not After

03/11/2010, 23:59

Subject

CN=Durion Co.\, Ltd.,O=Durion Co.\, Ltd.,L=Gyeyang-gu,ST=Incheon,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA

netapi32

Netbios

version

VerQueryValueA

mfc42

ord3825

msvcrt

_initterm

user32

GetSystemMetrics

gdi32

TextOutA

advapi32

RegSetValueExA

shell32

ShellExecuteA

ole32

CoUninitialize

olepro32

ord251

oleaut32

VariantClear

wsock32

WSAGetLastError

Exports

Exports

Dll_CloseCB
Dll_Unload
GetENCCode_cdecl
GetLoginID_cdecl
GetOption_cdecl
PbLogin_cdecl
SetAutoLogin_cdecl
_CloseCB@4
_GetENCCode@8
_GetLoginID@4
_GetOption@4
_PbLogin@8
_PbLogin_AutoLogin@12
_SetAutoLogin@4
isAutoLogin
isFreeUser

Sections

.text
Size: 167KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d0db17c3f37d55f26d6153dd739d0b01

Code Sign

40:4a:38:28:0b:f7:2c:7a:2c:be:66:6a:e1:46:61:1fCertificate

Extended Key Usages

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

netapi32

version

mfc42

msvcrt

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

wsock32

Exports

Exports

Sections

.text Size: 167KB - Virtual size: 172KB

.idata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

40:4a:38:28:0b:f7:2c:7a:2c:be:66:6a:e1:46:61:1f
Certificate

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

.text
Size: 167KB - Virtual size: 172KB

.idata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB