7044e8e0ad6ebc8d42167ef8ec2b0fcd

Sharing

Copy URL Twitter E-mail

General

Target

7044e8e0ad6ebc8d42167ef8ec2b0fcd
Size

332KB
MD5

7044e8e0ad6ebc8d42167ef8ec2b0fcd
SHA1

9ab81e3cc8ec58025d1b0b7c895df6fb5834c617
SHA256

5075dbff4ede05506190945c80676802b34990ff388b3d92d2bcf95a4564098d
SHA512

bcde97084f28ac83ec7123513338176c1422cc5c45072489dc32e8aa4c2552581cc0f9f8be2b9b76244455fe82e0b2dd2f8a724c7bec5360684b2f5b023fe735
SSDEEP

6144:3iQuXDAmxt1CXkYTU9nmt7JR1RU/nq7DbKCaam1c70rBKwPsUy:3iQS8XkYunmxD1inqmCaaDwrBLsUy

Score

1^/10

Malware Config

Signatures

Files

7044e8e0ad6ebc8d42167ef8ec2b0fcd
.exe windows:4 windows x86 arch:x86

5ae0de9fa8f70cf746f2141db4f56f95

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:c7:53:90:e5:69:db:5c:88:16:f5:04:00:2e:ec:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/04/2009, 00:00

Not After

13/04/2010, 23:59

Subject

CN=CAPCOM Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D Management Division,O=CAPCOM Co.\,Ltd.,L=Chuo-ku,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:63:a1:8d:52:8d:7a:c7:a8:06:b4:00:f1:4e:c2:c6:08:17:e1:59
Signer

Actual PE Digest

5f:63:a1:8d:52:8d:7a:c7:a8:06:b4:00:f1:4e:c2:c6:08:17:e1:59

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

LoadTypeLib
SysFreeString
VariantClear
VariantCopyInd
SysAllocStringLen

advapi32

RegCloseKey
RegLoadKeyA
RegOpenKeyExA
RegQueryValueA
RegEnumKeyA

ole32

CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CreateFileMoniker
CoLockObjectExternal
GetConvertStg
GetRunningObjectTable
OleDuplicateData
OleInitialize
CoGetClassObject
OleLockRunning
OleSaveToStream
OleSetClipboard
ProgIDFromCLSID
RevokeDragDrop
StgCreateDocfileOnILockBytes
StringFromGUID2
WriteClassStg
WriteClassStm
WriteFmtUserTypeStg
CoFileTimeNow
CoCreateInstance
CoCreateGuid
OleIsCurrentClipboard
CLSIDFromString
DoDragDrop

user32

EnableMenuItem
EndDeferWindowPos
CreateAcceleratorTableA
CharUpperBuffA
EndMenu
SetMenuInfo
LoadAcceleratorsW
CreateDialogParamA
FillRect

kernel32

lstrcmpiA
WriteFile
RtlUnwind
LocalAlloc
GetSystemTime
ExitThread
FlushFileBuffers
GetACP
GetCommandLineA
GetStartupInfoA
CloseHandle

Sections

.text
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ae0de9fa8f70cf746f2141db4f56f95

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

58:c7:53:90:e5:69:db:5c:88:16:f5:04:00:2e:ec:1cCertificate

Extended Key Usages

Key Usages

5f:63:a1:8d:52:8d:7a:c7:a8:06:b4:00:f1:4e:c2:c6:08:17:e1:59Signer

Headers

File Characteristics

Imports

oleaut32

advapi32

ole32

user32

kernel32

Sections

.text Size: 73KB - Virtual size: 76KB

.rdata Size: 37KB - Virtual size: 40KB

.data Size: 74KB - Virtual size: 76KB

.idata Size: 10KB - Virtual size: 12KB

.rsrc Size: 131KB - Virtual size: 132KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

58:c7:53:90:e5:69:db:5c:88:16:f5:04:00:2e:ec:1c
Certificate

5f:63:a1:8d:52:8d:7a:c7:a8:06:b4:00:f1:4e:c2:c6:08:17:e1:59
Signer

.text
Size: 73KB - Virtual size: 76KB

.rdata
Size: 37KB - Virtual size: 40KB

.data
Size: 74KB - Virtual size: 76KB

.idata
Size: 10KB - Virtual size: 12KB

.rsrc
Size: 131KB - Virtual size: 132KB