3a1982f1a4b8dc97c18bdcb653d02ce6

Sharing

Copy URL Twitter E-mail

General

Target

3a1982f1a4b8dc97c18bdcb653d02ce6
Size

206KB
MD5

3a1982f1a4b8dc97c18bdcb653d02ce6
SHA1

67e54c71552c5a03d116cc3c43d9a19076592898
SHA256

2a62a66e3d5aca6b82d5661ab7d714bfdf234f3d7e45d305843f5c64b02fba0a
SHA512

81ee6f5aea191d21c934fc382252f1afdbd1b8e962341efbdc9001499dc3fdcd2c33b28aecf81f6fa80f1b3781c21274c94b151ec0601eda690a795349014e8b
SSDEEP

3072:UXVbtamQ9HZVM92JpY7XSy2VyhLAx7RZjPiAMqIzmo9eG4psAax+ZRGw+:IVhIOEpsZ2yLAx7nl+D4mA9Z3+

Score

1^/10

Malware Config

Signatures

Files

3a1982f1a4b8dc97c18bdcb653d02ce6
.exe windows:4 windows x86 arch:x86

68bb3aa2cd71452881615741cef596de

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:b4:d9:2c:db:bc:4d:35:f7:96:eb:93:94:cb:f8:3d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

11/09/2009, 00:00

Not After

01/10/2012, 23:59

Subject

CN=ArcaBit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ArcaBit,O=ArcaBit Ltd.,L=Warsaw,ST=Warsaw,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:84:81:99:08:a1:6d:e4:46:cb:49:77:35:de:1c:b0:cc:8b:79:2d
Signer

Actual PE Digest

07:84:81:99:08:a1:6d:e4:46:cb:49:77:35:de:1c:b0:cc:8b:79:2d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCalendarInfoA
FindResourceA
GetLastError
EnumTimeFormatsW
lstrcpynA
GetModuleHandleA
LocalAlloc
SearchPathA
GetNumberFormatW
GetDiskFreeSpaceW
GetFullPathNameA
GetNamedPipeInfo
GetLogicalDriveStringsW
GetThreadPriority
GetWindowsDirectoryW
GetCPInfo
GetShortPathNameA
EnumCalendarInfoA
CreateFileA
FileTimeToSystemTime
ExitProcess
GetHandleInformation
GetFileTime
CreateFileMappingA
ReplaceFileW
CreateEventA
GetProcAddress
GetExitCodeProcess
lstrlen
GetTimeFormatA

user32

LoadMenuA
GetParent
RegisterWindowMessageW
SetFocus
MessageBoxW
DrawIcon
IsIconic
CreateWindowExW
GetMenuItemID
LoadBitmapA
CreateAcceleratorTableW
CopyRect
IsMenu
CopyImage
GetClassLongW
DrawTextA
FlashWindow
CloseWindow
SendDlgItemMessageW
LoadCursorW
BringWindowToTop
keybd_event
FindWindowA
SetTimer
GetClassInfoA
mouse_event
LoadIconA
InvalidateRgn
EnableMenuItem
GetWindowTextA
GetClassInfoExA
CheckDlgButton
RegisterClassA
GetDC
ClientToScreen
GetMenuItemRect
DeleteMenu
GetMessageW
UpdateLayeredWindow
OffsetRect
SetWindowRgn

gdi32

SetViewportOrgEx
OffsetWindowOrgEx
FlattenPath
SetBitmapBits
GetCharacterPlacementA
GetGlyphIndicesW
CreateRoundRectRgn
RectInRegion
CreateDIBPatternBrushPt
GetEnhMetaFilePaletteEntries
SetTextJustification
CloseMetaFile

advapi32

RegRestoreKeyW
RegOpenKeyW
RegCreateKeyW
RegDeleteKeyW
RegQueryValueW
RegCloseKey
RegOpenKeyA

comctl32

ImageList_Read
ImageList_AddMasked
ShowHideMenuCtl

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.J
Size: 1KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.PdmplU
Size: 1024B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nD
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.JCVprf
Size: 3KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tex
Size: 1KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wN
Size: 1KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FqcEsT
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GiYY
Size: 512B - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68bb3aa2cd71452881615741cef596de

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

11:b4:d9:2c:db:bc:4d:35:f7:96:eb:93:94:cb:f8:3dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

07:84:81:99:08:a1:6d:e4:46:cb:49:77:35:de:1c:b0:cc:8b:79:2dSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

Sections

.text Size: 10KB - Virtual size: 10KB

.J Size: 1KB - Virtual size: 30KB

.PdmplU Size: 1024B - Virtual size: 12KB

.nD Size: 2KB - Virtual size: 9KB

.JCVprf Size: 3KB - Virtual size: 50KB

.tex Size: 1KB - Virtual size: 26KB

.wN Size: 1KB - Virtual size: 29KB

.data Size: 9KB - Virtual size: 8KB

.FqcEsT Size: 2KB - Virtual size: 6KB

.GiYY Size: 512B - Virtual size: 160KB

.rsrc Size: 164KB - Virtual size: 164KB

.reloc Size: 1KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

11:b4:d9:2c:db:bc:4d:35:f7:96:eb:93:94:cb:f8:3d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

07:84:81:99:08:a1:6d:e4:46:cb:49:77:35:de:1c:b0:cc:8b:79:2d
Signer

.text
Size: 10KB - Virtual size: 10KB

.J
Size: 1KB - Virtual size: 30KB

.PdmplU
Size: 1024B - Virtual size: 12KB

.nD
Size: 2KB - Virtual size: 9KB

.JCVprf
Size: 3KB - Virtual size: 50KB

.tex
Size: 1KB - Virtual size: 26KB

.wN
Size: 1KB - Virtual size: 29KB

.data
Size: 9KB - Virtual size: 8KB

.FqcEsT
Size: 2KB - Virtual size: 6KB

.GiYY
Size: 512B - Virtual size: 160KB

.rsrc
Size: 164KB - Virtual size: 164KB

.reloc
Size: 1KB - Virtual size: 1KB