73bc292c05267e6cc0c33b653451d9b7

General

Target
73bc292c05267e6cc0c33b653451d9b7
Size 23KB
Sample240125-e4da9agba9
SHA256 ad7af8039d832bf7756a411280e511f9a5bf99a6a72588d85bde784fa2c96f03
MD5 73bc292c05267e6cc0c33b653451d9b7
SHA1 11951543ca20cd94376f2eafd9c8a49adfe21eac
SHA512 2a09d2170d65031ca64dff23f92c875aad32dff4bdb7014e15f15a211a23dbf25fdd6a089d636b8369005c77e22273bcaa5932daa2a8727b8c52571835a32a03
SSDEEP 384:V4kb8KsULpf6CQJ4tGjCehcB0CUG7mIQniCoHerzhNXqX2XfPl9pYUvWWnzcfTVP:GkgM6CQJ4tGNCmhF2q48gPK65LN7V
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

73bc292c05267e6cc0c33b653451d9b7

.dll 23KB

73bc292c05267e6cc0c33b653451d9b7

IMPHASH 07130db3404e576d5b9aac2cf2ae1203
SHA256 ad7af8039d832bf7756a411280e511f9a5bf99a6a72588d85bde784fa2c96f03
MD5 73bc292c05267e6cc0c33b653451d9b7
SHA1 11951543ca20cd94376f2eafd9c8a49adfe21eac
SHA512 2a09d2170d65031ca64dff23f92c875aad32dff4bdb7014e15f15a211a23dbf25fdd6a089d636b8369005c77e22273bcaa5932daa2a8727b8c52571835a32a03
SSDEEP 384:V4kb8KsULpf6CQJ4tGjCehcB0CUG7mIQniCoHerzhNXqX2XfPl9pYUvWWnzcfTVP:GkgM6CQJ4tGNCmhF2q48gPK65LN7V
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

54:0d:00:d7:17:62:b8:2e:67:91:71:23:93:87:48:0b:a4:94:5b:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OPSWAT\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

Chains

Mar 19, 2012

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=OPSWAT\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OPSWAT\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

3a:cc:f8:74:27:15:aa:40:6b:c3:48:50:48:f9:61:02

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2012 - Mar 22, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

13153

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

??0CErrorInfoCollection@OESIS@@QAE@ABV01@@Z ??0CFileVersionInfo@OESIS@@QAE@ABV01@@Z ??0CRegKey@OESIS@@QAE@ABV01@@Z ??0typeObject@OESIS@@QAE@ABV01@@Z ??0typeObject@OESIS@@QAE@XZ ??1CSoftwareVersion@OESIS@@QAE@XZ ??1CSoftwareVersionRange@OESIS@@QAE@XZ ??1typeInvocationArgs@OESIS@@QAE@XZ ??4CErrorInfoCollection@OESIS@@QAEAAV01@ABV01@@Z ??4CFileUtils@OESIS@@QAEAAV01@ABV01@@Z ??4CFileVersionInfo@OESIS@@QAEAAV01@ABV01@@Z ??4CRegKey@OESIS@@QAEAAV01@ABV01@@Z ??4CServiceUtils@OESIS@@QAEAAV01@ABV01@@Z ??4CStringUtils@OESIS@@QAEAAV01@ABV01@@Z ??4CWindowsOSUtils@OESIS@@QAEAAV01@ABV01@@Z ??4typeInvocationArgs@OESIS@@QAEAAV01@ABV01@@Z ??4typeObject@OESIS@@QAEAAV01@ABV01@@Z ??_7CFileVersionInfo@OESIS@@6B@ ??_7typeObject@OESIS@@6B@ ?GetCPByIndex@CFileVersionInfo@OESIS@@QBEGI@Z ?GetCurCP@CFileVersionInfo@OESIS@@QBEGXZ ?GetCurLID@CFileVersionInfo@OESIS@@QBEGXZ ?GetCurTrans@CFileVersionInfo@OESIS@@QBEKXZ ?GetCurTransIndex@CFileVersionInfo@OESIS@@QBEIXZ ?GetFileVersionBuild@CFileVersionInfo@OESIS@@QBEGXZ ?GetFileVersionMajor@CFileVersionInfo@OESIS@@QBEGXZ ?GetFileVersionMinor@CFileVersionInfo@OESIS@@QBEGXZ ?GetFileVersionQFE@CFileVersionInfo@OESIS@@QBEGXZ ?GetLIDByIndex@CFileVersionInfo@OESIS@@QBEGI@Z ?GetProductVersionBuild@CFileVersionInfo@OESIS@@QBEGXZ ?GetProductVersionMajor@CFileVersionInfo@OESIS@@QBEGXZ ?GetProductVersionMinor@CFileVersionInfo@OESIS@@QBEGXZ ?GetProductVersionQFE@CFileVersionInfo@OESIS@@QBEGXZ ?GetTransCount@CFileVersionInfo@OESIS@@QBEIXZ ?GetVSFFI@CFileVersionInfo@OESIS@@QBEABUtagVS_FIXEDFILEINFO@@XZ ?IsValid@CFileVersionInfo@OESIS@@QBEHXZ ?RegUtil_FindSubKeysByFilter_64_Lua@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABVtypeProperty@2@1AAV52@@Z ?RegUtil_FindSubKeysByFilter_Lua@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABVtypeProperty@2@1AAV52@@Z ?RegUtil_ReadMultiStringFromRegistry@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAVtypeProperty@2@@Z ?RegUtil_ReadStringFromRegistry@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV34@@Z ?RegUtil_ReadStringFromRegistry_64Bit@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0AAV34@@Z ?SetValueInt_Lua@CRegKey@OESIS@@SAHJABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0ABH@Z ?WindowLIDToOpswatLanguageType_Lua@CFileVersionInfo@OESIS@@SAHJAAJAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?getType@typeTime@OESIS@@UAE?AW4enumObjectType@typeObject@2@XZ BlueCoatProxyClient_ISoftwareProduct_GetProductVersion BlueCoatProxyClient_IURLFiltering_IsEnabled BlueCoatProxyClient_IURLFiltering_IsExpired BlueCoatProxyClient_IURLFiltering_LastUpdateTime PureSightPC_6_X_ISoftwareProdut_GetProductVersion URLFiltering_GetModuleVersion

73bc292c05267e6cc0c33b653451d9b7

PE Signature issue

kernel32

coreutils

oesiscore

msvcp80

msvcr80

generic

Sharing

General

Malware Config

Signatures

File Explorer

73bc292c05267e6cc0c33b653451d9b7

PE Signature issue

kernel32

coreutils

oesiscore

msvcp80

msvcr80

generic