58c8b66892fe1b6470bc761af9055006

Sharing

Copy URL Twitter E-mail

General

Target

58c8b66892fe1b6470bc761af9055006
Size

279KB
MD5

58c8b66892fe1b6470bc761af9055006
SHA1

1f5d3d8133d076e17110e4f6bf6302783494780d
SHA256

3c37f4435119db11ec88689e7305ef0b4b322c8cbc9c4c238452b3983461842b
SHA512

1a3bc233c4c32a798708d7f2aed609db5cd723a84f086cb0aec0b12aec6d5864a81183a42de43bfff5cefc9093bd2ee066b76f62f65c81eeb0993a25383a129b
SSDEEP

3072:SKBT+z896tUNB1PxlcZE4sW81M/M+ZNK3er8D+BNLiiplEmj7o6+pSQeqe8vROqO:SKBsy1GYMnZ/r8aBtjPoOnDV37P

Score

1^/10

Malware Config

Signatures

Files

58c8b66892fe1b6470bc761af9055006
.exe windows:4 windows x86 arch:x86

f36686b6a975091639dc901ce5bd7805

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0d:a7:19:6d:cf:4e:64:e5:53:ed:63:10:82:f5:1d:7b
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

31/05/2011, 00:00

Not After

29/07/2013, 23:59

Subject

CN=888 Holdings PLC,O=888 Holdings PLC,L=Gibraltar,ST=Gibraltar,C=GI

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:87:1f:18:84:22:b7:e1:d4:3d:8b:f8:c5:7b:2d:39:db:e9:e7:2a
Signer

Actual PE Digest

c9:87:1f:18:84:22:b7:e1:d4:3d:8b:f8:c5:7b:2d:39:db:e9:e7:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

HttpQueryInfoA
InternetConnectA
InternetCloseHandle
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetReadFile
HttpOpenRequestA
InternetSetOptionA
HttpSendRequestA
InternetCrackUrlA
InternetCheckConnectionA
InternetOpenA

kernel32

GlobalMemoryStatus
GetVersionExA
GetVersion
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateSemaphoreA
CreateProcessA
DeleteFileA
DeleteCriticalSection
TerminateThread
GetModuleFileNameA
GetPrivateProfileIntA
CreateThread
GetTickCount
Sleep
ReleaseMutex
ReleaseSemaphore
GetLastError
GetSystemTime
GetModuleHandleA
GetTempPathA
GetCurrentDirectoryA
MultiByteToWideChar
CreateFileA
GetFileSize
ReadFile
WriteFile
CopyFileA
GetUserDefaultLangID
SetFilePointer
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
LocalAlloc
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
CloseHandle
LCMapStringA
HeapReAlloc
VirtualAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FatalAppExitA
SetCurrentDirectoryA
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
ExitProcess
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetProcAddress
RemoveDirectoryA
GetTimeZoneInformation
GetLocalTime
GetFullPathNameA
GetDriveTypeA
CreateEventA
SetEnvironmentVariableA
CreateMutexA
GetPrivateProfileStringA
SetEvent
MulDiv
WaitForSingleObject
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
LCMapStringW
CreateDirectoryA
GetStartupInfoA
GetProcessHeap
HeapAlloc
HeapFree
GetCommandLineA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess

user32

RegisterClassExA
TranslateMessage
TranslateAcceleratorA
LoadAcceleratorsA
DispatchMessageA
LoadCursorA
GetDC
IsWindow
IsRectEmpty
IntersectRect
UnionRect
PtInRect
SendDlgItemMessageA
DrawTextA
InvalidateRect
UpdateWindow
SetDlgItemTextA
KillTimer
SetTimer
GetSystemMetrics
SendMessageA
PostMessageA
EndDialog
DestroyWindow
MessageBoxIndirectA
GetDlgItem
EnableWindow
DefWindowProcA
ShowWindow
SetWindowTextA
GetWindowRect
ScreenToClient
CreateWindowExA
LoadIconA
ReleaseDC
GetClientRect
FillRect
EndPaint
PostQuitMessage
SetFocus
FindWindowA
MessageBoxA
SetForegroundWindow
GetClassInfoExA
DialogBoxParamA
GetMessageA

gdi32

CreateBitmap
CreateDIBitmap
DeleteDC
GetBkColor
SetBkMode
SetTextColor
SetMapMode
SetBkColor
GetObjectA
GetDeviceCaps
CreateFontIndirectA
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA
ShellExecuteExA

ole32

CoCreateGuid

wsock32

WSAStartup
inet_addr
gethostbyname
gethostname

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f36686b6a975091639dc901ce5bd7805

Code Sign

01Certificate

0d:a7:19:6d:cf:4e:64:e5:53:ed:63:10:82:f5:1d:7bCertificate

Extended Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

c9:87:1f:18:84:22:b7:e1:d4:3d:8b:f8:c5:7b:2d:39:db:e9:e7:2aSigner

Headers

File Characteristics

Imports

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

Sections

.text Size: 224KB - Virtual size: 223KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 12KB - Virtual size: 181KB

.rsrc Size: 4KB - Virtual size: 3KB

01
Certificate

0d:a7:19:6d:cf:4e:64:e5:53:ed:63:10:82:f5:1d:7b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

c9:87:1f:18:84:22:b7:e1:d4:3d:8b:f8:c5:7b:2d:39:db:e9:e7:2a
Signer

.text
Size: 224KB - Virtual size: 223KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 12KB - Virtual size: 181KB

.rsrc
Size: 4KB - Virtual size: 3KB