41bc9e8f0f8ce2d7061708233c9975d8

Sharing

Copy URL

Twitter E-mail

General

Target

41bc9e8f0f8ce2d7061708233c9975d8
Size

52KB
MD5

41bc9e8f0f8ce2d7061708233c9975d8
SHA1

1e11c0f3735a4f4e736c141a009f78cee3e502c5
SHA256

54bbc87baf4088253fdb55decdf6049032cd91ae6688ed8b25cde8d8a26ad659
SHA512

625196a3e7cb858f083b8fb8fa7a16bfa8e462ff266ac828385ec734d4b0b4e6d8c31bab79ad2d2410fc9169cef04723b942b3889d53688319a86ff8238ff10b
SSDEEP

768:RR4pNmwbQRQELYduAGUCFD/7CL+0nofCBvQG9LikySNAhjG59Z/wIILruN:RRult9uhUCV/7moKBvQGoBPh2NIn+

Score

1^/10

Malware Config

Signatures

Files

41bc9e8f0f8ce2d7061708233c9975d8
.exe windows:4 windows x86 arch:x86

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=Pike,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

Not Before

09-05-2012 14:01

Not After

09-05-2013 14:01

Subject

CN=PikeUE,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

6c:28:bb:0c:43:d5:59:02:a1:bc:e5:11:ec:63:d1:78:39:1c:44:ac
Signer

Actual PE Digest

6c:28:bb:0c:43:d5:59:02:a1:bc:e5:11:ec:63:d1:78:39:1c:44:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetFileAttributesW
GetModuleFileNameW
Sleep
DeleteFileW
WaitForDebugEvent
ContinueDebugEvent
CreateProcessA
GetCommandLineA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateThread
SetFileAttributesW
GetProcAddress
LoadLibraryA
FindClose
OutputDebugStringA
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetLastError
MultiByteToWideChar
HeapFree
WideCharToMultiByte
GetModuleHandleA
GetVersion
ExitProcess
HeapAlloc
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetStringTypeA
LCMapStringW

ole32

CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

01Certificate

6c:28:bb:0c:43:d5:59:02:a1:bc:e5:11:ec:63:d1:78:39:1c:44:acSigner

Headers

File Characteristics

Imports

kernel32

ole32

shell32

Sections

.text Size: 27KB - Virtual size: 27KB

.rsrc Size: 19KB - Virtual size: 18KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

01
Certificate

6c:28:bb:0c:43:d5:59:02:a1:bc:e5:11:ec:63:d1:78:39:1c:44:ac
Signer

.text
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 19KB - Virtual size: 18KB