596d0f1ac665292a9f2d94f0240f6118

Sharing

Copy URL

Twitter E-mail

General

Target

596d0f1ac665292a9f2d94f0240f6118
Size

432KB
MD5

596d0f1ac665292a9f2d94f0240f6118
SHA1

05b812d07ceab881b8fc1a150d240c6cb213d5c2
SHA256

32636029ccee0587dd9b9cbbd8b898f7f35ee707021d0ad2c368ced83e6f8420
SHA512

54278ea6c6e5137524db90ad4230bf60afe094cfea1a852ffd726b6d8437df6d4a35948ce2d1579b98e3b9ad96ed4e606a68281f69db105cd048ac052528a63d
SSDEEP

12288:KZaeD6Osplp1F9qc5J3QxM0BscSmYty3eOcm:KzDaplH5Jg6uscS1t0eo

Score

1^/10

Malware Config

Signatures

Files

596d0f1ac665292a9f2d94f0240f6118
.exe windows:4 windows x86 arch:x86

5d0a8099785f0df40118ac573edb69d3

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:44:d7:31:bb:b6:07:2c:54:ab:3d:53:c9:52:93:0d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

30/10/2006, 00:00

Not After

30/10/2007, 23:59

Subject

CN=CANON INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Office Imaging Products,O=CANON INC.,L=Kawasaki,ST=Kanagawa,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f3:70:af:7e:ff:b5:7e:a9:c1:5c:ea:ee:92:2d:a7:13:3f:0d:13:71
Signer

Actual PE Digest

f3:70:af:7e:ff:b5:7e:a9:c1:5c:ea:ee:92:2d:a7:13:3f:0d:13:71

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalHandle
TlsFree
LeaveCriticalSection
GlobalReAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessVersion
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
RtlUnwind
TerminateProcess
GetACP
GetStartupInfoA
GetCommandLineA
RaiseException
CreateThread
ExitThread
HeapReAlloc
HeapSize
GetTimeZoneInformation
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
TlsAlloc
InitializeCriticalSection
LocalAlloc
SizeofResource
GetProfileStringA
InterlockedExchange
GetFileTime
GetFileSize
GetFullPathNameA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
WriteFile
DuplicateHandle
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GlobalDeleteAtom
GetCurrentThreadId
SuspendThread
MulDiv
GetTickCount
SetFilePointer
ReadFile
GetDiskFreeSpaceA
FindNextFileA
CopyFileA
FindFirstFileA
FindClose
lstrcmpA
GetVersionExA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
FindResourceA
LoadResource
ExitProcess
SetErrorMode
GetVolumeInformationA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
MoveFileExA
GetSystemDirectoryA
GetPrivateProfileSectionA
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetTempFileNameA
CreateEventA
GetCurrentProcessId
GetExitCodeProcess
ResumeThread
CreateMutexA
OpenEventA
SetEvent
OpenProcess
WaitForSingleObject
Sleep
DeleteFileA
RemoveDirectoryA
ReleaseMutex
GetModuleFileNameA
OutputDebugStringA
GetSystemDefaultLangID
GetUserDefaultLangID
GetPrivateProfileStringA
GetModuleHandleA
CreateFileA
GetLastError
SetFileAttributesA
lstrcmpiA
GetFileAttributesA
CreateDirectoryA
GetCurrentDirectoryA
GetTempPathA
SetCurrentDirectoryA
lstrcatA
CreateProcessA
CloseHandle
SetLastError
lstrlenA
lstrcpynA
LoadLibraryA
GetProcAddress
FreeLibrary
ExpandEnvironmentStringsA
lstrcpyA
GetWindowsDirectoryA
GetShortPathNameA
VirtualAlloc

user32

IsWindowVisible
AdjustWindowRectEx
GetSysColor
MapWindowPoints
GetCursorPos
ValidateRect
GetMessageA
GetNextDlgTabItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
DestroyMenu
InflateRect
GetClassNameA
GetSysColorBrush
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
MoveWindow
GetDlgCtrlID
SetWindowTextA
GetDlgItem
LoadStringA
UnhookWindowsHookEx
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
PostQuitMessage
GetWindowTextLengthA
EnumWindows
DrawIcon
InvalidateRgn
PtInRect
FillRect
GetCapture
SetCapture
ReleaseCapture
GetClientRect
GetClassInfoA
GetKeyState
GetWindow
GetFocus
RedrawWindow
GetActiveWindow
GetParent
GetClassLongA
SetClassLongA
SetCursor
LoadImageA
ExitWindowsEx
PeekMessageA
DispatchMessageA
TranslateMessage
GetDC
ReleaseDC
SendMessageA
UnionRect
SetRectEmpty
CopyRect
IntersectRect
IsRectEmpty
EnableMenuItem
SetWindowLongA
GetWindowLongA
IsChild
GetSystemMenu
RemoveMenu
KillTimer
PostMessageA
CharNextA
CharPrevA
EnableWindow
UnregisterClassA
HideCaret
ShowCaret
SetTimer
GetWindowRect
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassA
SetRect
OffsetRect
CharUpperA
wsprintfA
PostThreadMessageA
InvalidateRect
GetSystemMetrics
GetTopWindow
WinHelpA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
FindWindowA
SetForegroundWindow
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
IsWindowUnicode
MessageBoxA
RegisterWindowMessageA
IsWindowEnabled
GetWindowTextA

gdi32

CreateSolidBrush
CreateFontIndirectA
SelectObject
DeleteObject
OffsetRgn
SetRectRgn
GetRgnBox
PtInRegion
GetTextExtentPoint32A
CreateRectRgn
CombineRgn
SaveDC
RestoreDC
SetBkColor
SetBkMode
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
IntersectClipRect
MoveToEx
LineTo
CreatePen
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
PatBlt
CreateFontA
GetObjectA
SetDIBitsToDevice
SetStretchBltMode
SelectPalette
StretchDIBits
CreateICA
GetDeviceCaps
DeleteDC
CreatePalette
GetStockObject
RealizePalette
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
CreateRoundRectRgn

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
PrivilegeCheck
RegOpenKeyExA
RegQueryValueExA

shell32

ExtractIconA
ExtractAssociatedIconA
SHAppBarMessage
SHChangeNotify
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHFileOperationA
ShellExecuteExA

comctl32

ord17

ole32

CoInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5d0a8099785f0df40118ac573edb69d3

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

51:44:d7:31:bb:b6:07:2c:54:ab:3d:53:c9:52:93:0dCertificate

Extended Key Usages

Key Usages

f3:70:af:7e:ff:b5:7e:a9:c1:5c:ea:ee:92:2d:a7:13:3f:0d:13:71Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

Sections

.text Size: 284KB - Virtual size: 282KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 20KB - Virtual size: 35KB

.rsrc Size: 36KB - Virtual size: 33KB

.rsrc Size: 40KB - Virtual size: 40KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

51:44:d7:31:bb:b6:07:2c:54:ab:3d:53:c9:52:93:0d
Certificate

f3:70:af:7e:ff:b5:7e:a9:c1:5c:ea:ee:92:2d:a7:13:3f:0d:13:71
Signer

.text
Size: 284KB - Virtual size: 282KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 20KB - Virtual size: 35KB

.rsrc
Size: 36KB - Virtual size: 33KB

.rsrc
Size: 40KB - Virtual size: 40KB