4bc982530f34c770c163bb7939d18fba

Sharing

Copy URL

Twitter E-mail

General

Target

4bc982530f34c770c163bb7939d18fba
Size

9.0MB
MD5

4bc982530f34c770c163bb7939d18fba
SHA1

d5e031d2521b9c817af4f5675fe8c96675c30c26
SHA256

8c26e1e85adec598e616562d89d2b997f32c1e04526b1170a15bc59f0a07bf48
SHA512

c4771d6b31dd539d831e5d7c631e75be8fbf9dcba3ab9adaf66b463260a8e5eb21b52b6ea1f08efc6bdb3122342cd32f8cb7be95ac8203e7b1917b98be3a4243
SSDEEP

98304:em6L763G1n7px9SjV6OIErR3BgBsp8A36KnILEbV84bctFXbCICIP6BcOi:emWyR6OIwosp8dK4sa4abCSP6BcOi

Score

1^/10

Malware Config

Signatures

Files

4bc982530f34c770c163bb7939d18fba
.exe windows:4 windows x86 arch:x86

96072f74221292209a969470f560d4ca

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

df:73:0a:35:7e:58:7f:9c:5f:5f:ed:90:a6:00:29:1d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

20-11-2009 00:00

Not After

19-10-2012 23:59

Subject

CN=Homag Group AG,O=Homag Group AG,POSTALCODE=72296,STREET=Homagstr. 3-5,L=Schopfloch,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a5:d9:4f:c5:4d:bb:39:25:1b:4e:fe:3f:0c:66:59:3a:ed:71:eb:20
Signer

Actual PE Digest

a5:d9:4f:c5:4d:bb:39:25:1b:4e:fe:3f:0c:66:59:3a:ed:71:eb:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualAlloc
VirtualQuery
GetDriveTypeW
ExitThread
CreateThread
SetStdHandle
GetFileType
GetDriveTypeA
FindFirstFileA
SetConsoleCtrlHandler
GetTimeFormatA
GetDateFormatA
HeapSize
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
LocalFileTimeToFileTime
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetACP
GetOEMCP
IsValidCodePage
GetCurrentDirectoryA
GetFullPathNameA
GetTimeZoneInformation
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FindResourceExW
GlobalFlags
LocalReAlloc
GlobalHandle
GetDiskFreeSpaceW
GetTempFileNameW
GetFileTime
SetFileTime
GetFileAttributesW
GlobalReAlloc
GetTickCount
ConvertDefaultLocale
GetLocaleInfoW
CompareStringA
LocalAlloc
GlobalGetAtomNameW
FileTimeToLocalFileTime
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DeleteFileW
MoveFileW
VirtualProtect
FileTimeToSystemTime
GetThreadLocale
CreateMutexW
lstrcmpA
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetVersionExA
GetModuleHandleA
CopyFileW
SystemTimeToFileTime
InterlockedCompareExchange
OpenSemaphoreA
LCMapStringW
LCMapStringA
GetStringTypeExW
GetUserDefaultLCID
EnumResourceTypesW
EnumResourceNamesW
EnumResourceLanguagesW
FindFirstFileW
FindNextFileW
FindClose
FreeConsole
GetConsoleCP
AllocConsole
lstrcpynW
WaitForMultipleObjects
WaitForMultipleObjectsEx
ExpandEnvironmentStringsA
SearchPathA
LoadLibraryA
SetUnhandledExceptionFilter
GetModuleFileNameA
DuplicateHandle
SuspendThread
GetExitCodeThread
SignalObjectAndWait
ReleaseSemaphore
CreateSemaphoreW
ReleaseMutex
SleepEx
GetFileAttributesA
CreateFileA
SetFilePointer
TlsAlloc
TlsFree
GetCurrentProcess
ReadFile
GetComputerNameA
SetThreadPriority
ResumeThread
GetCurrentThread
GetEnvironmentStrings
ExitProcess
TlsSetValue
TerminateProcess
GetSystemInfo
OpenProcess
FormatMessageA
GetCurrentProcessId
TlsGetValue
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventA
CreateSemaphoreA
CreateMutexA
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
InterlockedIncrement
GetStdHandle
GlobalSize
ExpandEnvironmentStringsW
GetTempPathW
FormatMessageW
LocalFree
InterlockedExchange
Sleep
GetSystemTime
WaitForSingleObject
lstrcatW
WinExec
GetWindowsDirectoryW
lstrcpyW
LoadLibraryExW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
FreeLibrary
GetPrivateProfileStringW
WritePrivateProfileStringW
GetLocalTime
MulDiv
InterlockedDecrement
WideCharToMultiByte
GetModuleFileNameW
OutputDebugStringW
RaiseException
CreateFileW
WriteFile
CloseHandle
GlobalAlloc
GlobalFree
GetLastError
SetLastError
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetCPInfo
lstrlenA
lstrlenW
lstrcmpiW
GetVersion
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
GlobalLock
GlobalUnlock
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
GetCommandLineW
SizeofResource

user32

SetWindowContextHelpId
ShowOwnedPopups
PostQuitMessage
UnionRect
GetSystemMenu
SetCursorPos
IsZoomed
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
TranslateAcceleratorW
CharUpperW
CreateDialogIndirectParamW
EndDialog
GetWindowThreadProcessId
ValidateRect
IsDialogMessageW
SetDlgItemTextW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetClassLongW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
SetActiveWindow
GetMessageTime
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
GetScrollPos
ShowScrollBar
MessageBoxW
GetClassInfoExW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
CallWindowProcW
SystemParametersInfoA
GetWindowPlacement
GetWindowDC
GetMenuStringW
InsertMenuItemW
RegisterClassW
TranslateMessage
DestroyMenu
TrackPopupMenuEx
GetMessageW
DispatchMessageW
GetDlgCtrlID
GetDCEx
EnumChildWindows
SetWindowTextW
GetDlgItem
RegisterWindowMessageW
SetScrollPos
CreateWindowExW
DestroyWindow
GetWindowRgn
GetKeyNameTextW
MapVirtualKeyW
GetForegroundWindow
MapDialogRect
SetForegroundWindow
GetLastActivePopup
SetWindowPos
UnregisterClassW
LoadMenuW
BringWindowToTop
GetKeyboardType
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
GetTopWindow
BeginDeferWindowPos
EndDeferWindowPos
GetMessagePos
ClipCursor
GetUpdateRect
EndPaint
BeginPaint
SetParent
LockWindowUpdate
ReleaseCapture
SetCapture
GetCapture
GetClassInfoW
DefWindowProcW
GetWindowTextW
ChildWindowFromPoint
IsWindowEnabled
SetWindowRgn
EqualRect
GetClassNameW
GetCursorPos
ScreenToClient
LoadStringW
CopyIcon
MoveWindow
PtInRect
ShowWindow
IsWindow
LoadCursorW
MessageBoxA
UnregisterClassA
UpdateWindow
HiliteMenuItem
DrawMenuBar
SetMenu
GetMenu
RedrawWindow
IsWindowVisible
SetWindowLongW
RegisterClipboardFormatW
GetKeyboardState
SetKeyboardState
SetRectEmpty
IsRectEmpty
LoadIconW
IsIconic
DrawIcon
GetAsyncKeyState
KillTimer
SetTimer
DestroyCursor
LoadImageW
IsClipboardFormatAvailable
CopyAcceleratorTableW
InvalidateRgn
CharNextW
GetNextDlgGroupItem
PostMessageW
SetCursor
GetWindowLongW
WindowFromPoint
GetParent
GetNextDlgTabItem
GetActiveWindow
ClientToScreen
DrawFocusRect
FrameRect
GetTabbedTextExtentA
PostThreadMessageW
RegisterClassExW
MessageBeep
OffsetRect
InflateRect
GetIconInfo
CreateIconIndirect
DrawStateW
IsMenu
GetMenuItemInfoW
GetSystemMetrics
SystemParametersInfoW
DrawIconEx
DestroyIcon
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetSysColorBrush
GetSysColor
GetDesktopWindow
ReleaseDC
GetDC
RemoveMenu
ModifyMenuW
InsertMenuW
GetSubMenu
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuW
DeleteMenu
CreatePopupMenu
CreateMenu
DrawEdge
FillRect
LoadBitmapW
CopyRect
SetRect
GetKeyState
GetClipboardData
CloseClipboard
GetWindowRect
EnableWindow
OpenClipboard
GetFocus
InvalidateRect
GetClientRect
SendMessageW
IntersectRect

gdi32

OffsetClipRgn
SetTextAlign
GetViewportExtEx
GetWindowExtEx
StartDocW
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
SetBkMode
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
SelectPalette
IntersectClipRect
CreateEllipticRgn
GetCharWidthW
StretchDIBits
SetRectRgn
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetRgnBox
EnumFontFamiliesExW
GetNearestColor
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetTextExtentPoint32A
MoveToEx
LineTo
StretchBlt
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
GetClipBox
Polyline
PtInRegion
CreateRectRgnIndirect
SetDIBColorTable
GdiFlush
RoundRect
GetWindowOrgEx
GetViewportOrgEx
OffsetRgn
CreateRectRgn
CreatePolygonRgn
CombineRgn
FillRgn
SelectClipRgn
FrameRgn
CreateRoundRectRgn
CreatePenIndirect
FloodFill
EnumFontFamiliesW
RealizePalette
CreatePalette
CreatePatternBrush
GetTextColor
SetDIBitsToDevice
GetTextMetricsW
CreateFontW
LPtoDP
DPtoLP
GetMapMode
GetBkColor
GetDIBits
SetDIBits
CreateBitmap
SetBkColor
SetTextColor
GetStockObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
SetPixel
GetPixel
BitBlt
PatBlt
Rectangle
Ellipse
GetBkMode
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
CreatePen
GetTextExtentPoint32W
GetCurrentObject
CreateSolidBrush
GetObjectW
SetTextJustification

comdlg32

GetFileTitleW

winspool.drv

GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegSetValueW
RegQueryValueExW
RegOpenKeyExW
IsTextUnicode
RegQueryValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
RegCreateKeyW
GetFileSecurityW
SetFileSecurityW
RegEnumKeyW
RegOpenKeyW
RegCloseKey
RegDeleteValueW
RegCreateKeyA
RegSetValueExA
RegisterEventSourceA
ReportEventA

shell32

ShellExecuteW
SHGetFileInfoW
DragFinish
DragQueryFileW
ExtractIconW
ShellExecuteExW

comctl32

_TrackMouseEvent
ImageList_Create
ord8
ImageList_AddMasked
ord17
ImageList_GetIcon
ImageList_GetImageCount
InitCommonControlsEx

shlwapi

PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
StringFromCLSID
OleDuplicateData
CreateStreamOnHGlobal
CoRegisterClassObject
CoRevokeClassObject
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleGetClipboard
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoDisconnectObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor

oleaut32

CreateErrorInfo
GetErrorInfo
LoadTypeLi
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetDim
SafeArrayGetElemsize
LoadRegTypeLi
DispCallFunc
OleCreatePictureIndirect
SysStringLen
SafeArrayCreate
SafeArrayPutElement
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString

gdiplus

GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePixelFormat
GdipCloneImage
GdipDrawImageRectI
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipCreateBitmapFromFile
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImagePalette
GdipCreateFromHDC
GdipGetImagePaletteSize

ws2_32

getservbyname
WSASocketA
gethostbyaddr
htonl
WSASetLastError
WSAEnumNetworkEvents
WSAEventSelect
listen
accept
connect
shutdown
setsockopt
getsockname
getpeername
ioctlsocket
socket
closesocket
bind
ntohl
htons
inet_addr
WSAIoctl
WSACleanup
WSAStartup
WSASendTo
recvfrom
__WSAFDIsSet
WSASend
getsockopt
sendto
send
recv
select
gethostbyname
inet_ntoa
WSAGetLastError
gethostname
ntohs

winmm

PlaySoundW

wininet

InternetConnectW
FtpFindFirstFileW
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
InternetFindNextFileW
FtpGetCurrentDirectoryW
FtpSetCurrentDirectoryW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

?threadSleep@@YAFK@Z

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96072f74221292209a969470f560d4ca

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

df:73:0a:35:7e:58:7f:9c:5f:5f:ed:90:a6:00:29:1dCertificate

Extended Key Usages

Key Usages

a5:d9:4f:c5:4d:bb:39:25:1b:4e:fe:3f:0c:66:59:3a:ed:71:eb:20Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

winmm

wininet

version

Exports

Exports

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 148KB - Virtual size: 226KB

.rsrc Size: 3.1MB - Virtual size: 3.1MB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

df:73:0a:35:7e:58:7f:9c:5f:5f:ed:90:a6:00:29:1d
Certificate

a5:d9:4f:c5:4d:bb:39:25:1b:4e:fe:3f:0c:66:59:3a:ed:71:eb:20
Signer

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 148KB - Virtual size: 226KB

.rsrc
Size: 3.1MB - Virtual size: 3.1MB