2cf3a0c4ae275718001b8d15c6fd197c

Sharing

Copy URL Twitter E-mail

General

Target

2cf3a0c4ae275718001b8d15c6fd197c
Size

1.4MB
MD5

2cf3a0c4ae275718001b8d15c6fd197c
SHA1

e0cf80d0a10d4aaa76072f071f90aaed9d5b6619
SHA256

057b84d5a9a7601ad9f274fc9023182df52240f641e09e905e86f65002856008
SHA512

6db2c7dcad63b22adc5866990d10b2563dd93f18c0ef76ca5673f2e874077ab65ff9bfda7605f756a6c83a8ce55a9f04d08b0020c77cc1bf4e1a561cf18c3f65
SSDEEP

24576:vIQHPda39Dkw4t1FwEXNxDTaGvkeif9s2aLvZsLyrl7zmxCB0cOQWqiCbRS8:VPdwDkPtEG3m0ktYLBsLClqnQJZ

Score

1^/10

Malware Config

Signatures

Files

2cf3a0c4ae275718001b8d15c6fd197c
.dll windows:5 windows x86 arch:x86

b6a88fb31012019611eb316fe8d06b62

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:fa:31:33:6c:ec:64:91:21:e9:a9:08:28:99:50:d2
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/08/2013, 00:00

Not After

01/08/2015, 23:59

Subject

CN=ReSoft LTD.,O=ReSoft LTD.,POSTALCODE=64356,STREET=4th Hanevi'im,L=Tel Aviv,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c7:06:2f:71:f1:35:aa:f5:ed:34:6f:ed:84:16:1a:79:95:6c:fd:11
Signer

Actual PE Digest

c7:06:2f:71:f1:35:aa:f5:ed:34:6f:ed:84:16:1a:79:95:6c:fd:11

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetProcAddress
GetLastError
LoadLibraryW
GetModuleFileNameW
CreateDirectoryW
MultiByteToWideChar
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
DisconnectNamedPipe
CancelIo
GetOverlappedResult
WaitForMultipleObjects
ReadFile
ResetEvent
WriteFile
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
CreateFileW
CreateThread
GetExitCodeProcess
CreateProcessW
GetSystemDirectoryW
GetTickCount
GetFileAttributesW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetTempPathW
FlushFileBuffers
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
CreateFileA
LoadLibraryA
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RaiseException
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetModuleFileNameA
HeapDestroy
HeapCreate
HeapReAlloc
VirtualAlloc
VirtualFree
ExitProcess
Sleep
GetModuleHandleW
GetProcessHeap
SetFilePointer
GetFileType
HeapAlloc
HeapFree
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
SetEndOfFile

oleaut32

SysAllocString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector
VariantInit
SysFreeString

msi

ord121
ord118
ord125
ord167
ord119
ord171
ord49
ord32
ord159
ord160
ord163
ord162
ord166
ord26
ord165
ord34
ord221
ord47
ord51
ord116
ord58
ord62
ord63
ord48
ord64
ord76
ord78
ord80
ord114
ord120
ord123
ord133
ord135
ord207
ord139
ord140
ord143
ord147
ord150
ord142
ord115
ord17
ord74
ord103
ord8
ord54
ord145

shlwapi

PathFileExistsW

Exports

Exports

BeforeInstallationRemoveFiles
InstallationCanceled
InstallationComplete
InstallationFailed
InstallationRemoveFiles
InstallationStart
InstallationStartUninstall
Reinstall
Uninstall
zzzEmbeddedUIHandler
zzzInitializeEmbeddedUI
zzzShutdownEmbeddedUI
zzzzInvokeManagedCustomActionOutOfProcW

Sections

.text
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6a88fb31012019611eb316fe8d06b62

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

51:fa:31:33:6c:ec:64:91:21:e9:a9:08:28:99:50:d2Certificate

Extended Key Usages

Key Usages

c7:06:2f:71:f1:35:aa:f5:ed:34:6f:ed:84:16:1a:79:95:6c:fd:11Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

msi

shlwapi

Exports

Exports

Sections

.text Size: 149KB - Virtual size: 148KB

.data Size: 4KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

51:fa:31:33:6c:ec:64:91:21:e9:a9:08:28:99:50:d2
Certificate

c7:06:2f:71:f1:35:aa:f5:ed:34:6f:ed:84:16:1a:79:95:6c:fd:11
Signer

.text
Size: 149KB - Virtual size: 148KB

.data
Size: 4KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 6KB