76c787a48824c0fe2210c97eae10135f

Sharing

Copy URL Twitter E-mail

General

Target

76c787a48824c0fe2210c97eae10135f
Size

876KB
MD5

76c787a48824c0fe2210c97eae10135f
SHA1

473d2c4b293caf8d204c80339f780b826eb3cf5f
SHA256

15684109595e3a9c9407d18b3f7e4bb9f5c7d9678f1d6e70937c96793fe3b12f
SHA512

ffc393c7c381a547874b77e356b48c99ae0b5a00167a0d823e54197ed0e7df1ec1252eb93879a29f0c9a2d959e18ea784d87a386f463fdd91b7399add6a67fcd
SSDEEP

24576:ySqtuTjSa1KhOabekGGLw1YDx0hnjx2ckm2Yn:+uTjIogeBGk1IQVn3/n

Score

1^/10

Malware Config

Signatures

Files

76c787a48824c0fe2210c97eae10135f
.exe windows:4 windows x86 arch:x86

e865f66ca93ccb95d0fac5062cb2edb3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

IsCharLowerA
SetMessageExtraInfo
TileWindows
GetKBCodePage
EnumClipboardFormats
UnhookWinEvent
GetMenuCheckMarkDimensions
LookupIconIdFromDirectory
ShowWindowAsync
GetClipboardFormatNameA
GetWindowRect
PostQuitMessage
GetMenuState
GetDoubleClickTime
IsMenu
ShowCursor
GetKeyboardLayoutList
CharToOemBuffA
LoadMenuIndirectA
ChangeMenuA
DrawMenuBar
GetShellWindow
SetProcessWindowStation
SetKeyboardState
SetClipboardData
InSendMessage
CheckMenuItem
DrawFrame
OemToCharA
CopyIcon
CreateAcceleratorTableA
DdeCreateDataHandle
SetMenuDefaultItem
GetLastActivePopup
EnumPropsExA
GetProcessDefaultLayout
SetDebugErrorLevel
ToUnicodeEx
GetClassWord
GetAsyncKeyState
DdeQueryStringA
RedrawWindow
DefMDIChildProcA
DdeClientTransaction
DispatchMessageA
DlgDirSelectExA
SendMessageTimeoutA
ChildWindowFromPointEx
GetUserObjectSecurity
GetSystemMenu
GetTopWindow
CreateWindowExA
MonitorFromPoint
DestroyMenu
GetDlgCtrlID
GetMessagePos
SetScrollInfo
IMPGetIMEA
PackDDElParam

advapi32

AllocateAndInitializeSid
GetAclInformation
GetExplicitEntriesFromAclA
RevertToSelf
SetEntriesInAuditListA
RegSaveKeyA
CryptGetKeyParam
IsTextUnicode
CryptGenKey
BuildSecurityDescriptorA
EnumDependentServicesA
CryptSetKeyParam
GetTrusteeTypeA
CryptContextAddRef
ChangeServiceConfigA
RegQueryValueA
DeregisterEventSource
RegConnectRegistryA
GetMultipleTrusteeA
RegUnLoadKeyA
GetSecurityDescriptorOwner
CryptHashSessionKey
GetServiceDisplayNameA
InitializeAcl
RegOpenKeyA
BackupEventLogA
ControlService
CryptDestroyHash
CopySid
GetNumberOfEventLogRecords
GetSecurityDescriptorControl

kernel32

IsBadHugeReadPtr

Sections

.nsb
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mlu
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lqtw
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rmvs
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hwtit
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yvwlm
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bypq
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ipsp
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.chcj
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e865f66ca93ccb95d0fac5062cb2edb3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

user32

advapi32

kernel32

Sections

.nsb Size: 638KB - Virtual size: 1.3MB

.mlu Size: 6KB - Virtual size: 8KB

.lqtw Size: 19KB - Virtual size: 27KB

.rmvs Size: 512B - Virtual size: 21KB

.hwtit Size: 6KB - Virtual size: 15KB

.yvwlm Size: 512B - Virtual size: 56B

.bypq Size: 512B - Virtual size: 24B

.ipsp Size: 48KB - Virtual size: 77KB

.chcj Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.nsb
Size: 638KB - Virtual size: 1.3MB

.mlu
Size: 6KB - Virtual size: 8KB

.lqtw
Size: 19KB - Virtual size: 27KB

.rmvs
Size: 512B - Virtual size: 21KB

.hwtit
Size: 6KB - Virtual size: 15KB

.yvwlm
Size: 512B - Virtual size: 56B

.bypq
Size: 512B - Virtual size: 24B

.ipsp
Size: 48KB - Virtual size: 77KB

.chcj
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB