793f837252ece87192d0d4b4ef1f423d

Sharing

Copy URL Twitter E-mail

General

Target

793f837252ece87192d0d4b4ef1f423d
Size

65KB
MD5

793f837252ece87192d0d4b4ef1f423d
SHA1

bcdd77b7fe414a37de589d76d024d36027e61594
SHA256

68134e6845611e9eb5abce15d04297c5515b0c9e9613f44a101d8d4bdfd5ffa7
SHA512

a748b4bf195da427600b61c4ebe8138181613c01c0caafce447ee473b0dbaefec4d96b33f1d34f588bfa1854750531cca2ebc3d576a895b1126577d158febfaa
SSDEEP

1536:o3g6thlSvT10KuNpGqUloqP4B/vXHRmLFBU3wVMDz7b:ug6th4b10Fr1UqvXxmLnU3wGDzf

Score

1^/10

Malware Config

Signatures

Files

793f837252ece87192d0d4b4ef1f423d
.exe windows:4 windows x86 arch:x86

cde9ef4df06ee287e8b674030de6bfc1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
RegUnLoadKeyA
RegOpenKeyA
ControlService
CryptSignHashA
CryptContextAddRef
ChangeServiceConfigA
AllocateAndInitializeSid
OpenEventLogA
BuildSecurityDescriptorA
GetMultipleTrusteeA
RegDeleteValueA
RevertToSelf
ObjectDeleteAuditAlarmA
GetTrusteeTypeA
AccessCheck
AddAce
SetEntriesInAuditListA
BackupEventLogA
DeregisterEventSource
GetServiceDisplayNameA
GetSidSubAuthority
CopySid
PrivilegeCheck
CryptSetKeyParam
CryptGenKey
GetSecurityDescriptorOwner
RegSaveKeyA
FindFirstFreeAce
GetSecurityDescriptorControl
InitializeAcl
GetNumberOfEventLogRecords
CryptGetKeyParam
RegFlushKey
IsTextUnicode
GetAclInformation
RegQueryValueA
GetExplicitEntriesFromAclA
CryptDestroyHash

user32

RegisterWindowMessageA
SetCaretBlinkTime
GetClassWord
SetWindowContextHelpId
EnumPropsExA
AlignRects
SetSysColors
DrawTextExA
GetIconInfo
ToUnicodeEx
EnumClipboardFormats
wvsprintfA
ExcludeUpdateRgn
GetMenuState
GetDoubleClickTime
DrawCaption
LookupIconIdFromDirectory
GetScrollBarInfo
SetDebugErrorLevel
GetWindowRect
DdeUnaccessData
CreateWindowExA
GetMenuCheckMarkDimensions
MsgWaitForMultipleObjects
OpenDesktopA
PackDDElParam
DdeQueryStringA
ShowWindowAsync
MessageBoxA
SetWindowRgn
DdeCreateDataHandle
GetLastActivePopup
SendMessageTimeoutA
GetMenuItemCount
BringWindowToTop
SetDoubleClickTime
GetKBCodePage
GetKeyboardLayoutList
IsDialogMessage
IsMenu
UnhookWinEvent
DestroyAcceleratorTable
RedrawWindow
GetTopWindow
CloseDesktop
CharToOemBuffA
GetComboBoxInfo
IMPGetIMEA
RemovePropA
CharNextExA
RegisterDeviceNotificationA

kernel32

DeleteAtom

Sections

.wbuf
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rwbq
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taty
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ilmny
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cde9ef4df06ee287e8b674030de6bfc1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.wbuf Size: 22KB - Virtual size: 45KB

.rwbq Size: 5KB - Virtual size: 10KB

.taty Size: 1KB - Virtual size: 2KB

.ilmny Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.wbuf
Size: 22KB - Virtual size: 45KB

.rwbq
Size: 5KB - Virtual size: 10KB

.taty
Size: 1KB - Virtual size: 2KB

.ilmny
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB