4ddcdf4e545dbc60941f4e1422077677

Sharing

Copy URL Twitter E-mail

General

Target

4ddcdf4e545dbc60941f4e1422077677
Size

65KB
MD5

4ddcdf4e545dbc60941f4e1422077677
SHA1

cf547ac620512b26502ccd6dd0318694253e3775
SHA256

359b21377adbf4984856cead72ba066b7fbb6d71b6b47ef515070f40abafa0e8
SHA512

5f6dd43b1e2f2c92450ecd58581c738015d1627d3a549eff6b438408a5368c38fbc901f55da7c9b325507175679a2844c1d23a3ef5728cdb47d69e7d54b88196
SSDEEP

1536:YU1UplYTpbHg1MTPy+6gJT9Ebr9LxbFNY/n+MJhsb1h/UQDPvb:L1oYtbB7f6gJT9sthNY/n1JhU1OQDPj

Score

1^/10

Malware Config

Signatures

Files

4ddcdf4e545dbc60941f4e1422077677
.exe windows:4 windows x86 arch:x86

600153c48a98935e69d11bd14fb683fc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHCreateStreamWrapper
StrToIntExA
StrIsIntlEqualA
PathIsUNCA
SHRegWriteUSValueA
PathFindOnPathA
PathGetDriveNumberA
PathSearchAndQualifyA
SHRegEnumUSKeyA
SHAutoComplete
UrlIsOpaqueA
HashData
PathStripToRootA
StrRChrIA
PathRemoveBlanksA
StrCSpnA
PathAppendA
SHDeleteValueA
AssocQueryStringA
PathIsRelativeA
StrFormatByteSize64A
UrlCombineA
SHRegOpenUSKeyA
PathMakePrettyA
UrlGetLocationA
SHIsLowMemoryMachine
PathFileExistsA
ColorHLSToRGB
PathIsFileSpecA
StrSpnA
StrChrIA

kernel32

GetProfileIntA
CreateMailslotA
FreeLibrary
lstrcpyn
ReadConsoleOutputA
SetProcessAffinityMask
GetBinaryTypeA
SearchPathA
CreateFiber
GetProfileStringA
_hread
HeapUnlock
CreateProcessA
GlobalReAlloc
GetCurrentThreadId
UnhandledExceptionFilter
SetTimeZoneInformation
GetNamedPipeHandleStateA
DuplicateHandle
WriteFile
GetSystemPowerStatus
HeapWalk
VirtualAlloc
GetCommModemStatus
CreateThread
CreateFileMappingA
LocalFileTimeToFileTime
GetNumberFormatA
CommConfigDialogA
ResumeThread
OpenEventA
AddAtomA
GetWindowsDirectoryA
SetConsoleOutputCP
LocalLock
LockFileEx
WriteConsoleInputA
InterlockedExchange
GetPrivateProfileIntA
AreFileApisANSI
InitializeCriticalSection
SetLocalTime
GetTapeStatus
SwitchToFiber
Module32First
WriteProfileStringA
Process32Next
CompareStringA
WriteConsoleOutputAttribute
ReadFileEx
SetStdHandle
SetCommBreak
SetNamedPipeHandleState
SetDefaultCommConfigA
GetAtomNameA
GetTickCount
GetNumberOfConsoleMouseButtons
GetUserDefaultLangID
LoadLibraryA

advapi32

CopySid

Sections

.roz
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pmlqf
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dcvsb
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ryzwl
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

600153c48a98935e69d11bd14fb683fc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

Sections

.roz Size: 22KB - Virtual size: 45KB

.pmlqf Size: 5KB - Virtual size: 10KB

.dcvsb Size: 1KB - Virtual size: 2KB

.ryzwl Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.roz
Size: 22KB - Virtual size: 45KB

.pmlqf
Size: 5KB - Virtual size: 10KB

.dcvsb
Size: 1KB - Virtual size: 2KB

.ryzwl
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB