3ed0d1fcbb49a04d2140de3921435784

Sharing

Copy URL

Twitter E-mail

General

Target

3ed0d1fcbb49a04d2140de3921435784
Size

408KB
MD5

3ed0d1fcbb49a04d2140de3921435784
SHA1

83a37daf449bc16f5b746605790ca1ce0d0e7fd9
SHA256

0590fac7d3c368385981a7839b08bc3abd7f281193bcc3d9d16c0d4520e5d212
SHA512

fe1103baa4342165d2015fa32e1fe8c933ddcdd784a5fecd543ffd1e93d260668dde0d5c3cc9a3970d44dbea437e890c52137084644bdd6161bb5f263b095bc2
SSDEEP

6144:hp5uA0QKC3bbFsdMWF4A5aJsdomgwsOi/Cg87W/Wm/0JsMDcPT+5WGFJaZOFpEZK:hjrCK5yS7NH/MW/Wm7MDgTuaZxZMma

Score

1^/10

Malware Config

Signatures

Files

3ed0d1fcbb49a04d2140de3921435784
.exe windows:4 windows x86 arch:x86

4dca2ca35919d2791f7c0dcaca080ea3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:5c:7f:0c:b9:44:17:34:7c:b8:06:58:39:97:7a:ac:56:88:8d:81
Signer

Actual PE Digest

16:5c:7f:0c:b9:44:17:34:7c:b8:06:58:39:97:7a:ac:56:88:8d:81

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
SetFilePointer
FindResourceW
SizeofResource
LockResource
LoadResource
DeleteFileW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
SetLastError
RaiseException
GetCommandLineW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
MultiByteToWideChar
GetCurrentProcess
FindResourceExW
WideCharToMultiByte
FindClose
FindFirstFileW
GetProcAddress
LoadLibraryW
FreeLibrary
WriteFile
CreateFileW
ReadFile
GetLastError
GetFileSize
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameA
LCMapStringA
LCMapStringW
Sleep

user32

SetWindowLongW
GetDlgItem
CreateDialogParamW
GetWindowRect
GetParent
ScreenToClient
PostQuitMessage
LoadImageW
DestroyWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
UnregisterClassA
GetMessageW
EnableWindow
SetFocus
SetWindowTextW
IsWindow
SendMessageW
PostMessageW
MessageBoxW
SetForegroundWindow
ShowWindow
MoveWindow

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoCreateInstance
CreateBindCtx

oleaut32

SysAllocString
SysFreeString

shlwapi

PathFileExistsW

comctl32

ord17

urlmon

RegisterBindStatusCallback
CreateURLMoniker

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

&!
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4dca2ca35919d2791f7c0dcaca080ea3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

16:5c:7f:0c:b9:44:17:34:7c:b8:06:58:39:97:7a:ac:56:88:8d:81Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

urlmon

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 24KB - Virtual size: 21KB

&! Size: 236KB - Virtual size: 236KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

16:5c:7f:0c:b9:44:17:34:7c:b8:06:58:39:97:7a:ac:56:88:8d:81
Signer

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 24KB - Virtual size: 21KB

&!
Size: 236KB - Virtual size: 236KB