7b08bae072a80e4b2c91ebf87e40bbe3

Sharing

Copy URL Twitter E-mail

General

Target

7b08bae072a80e4b2c91ebf87e40bbe3
Size

134KB
MD5

7b08bae072a80e4b2c91ebf87e40bbe3
SHA1

679b840ed7c66783dad01cca34038d2951233c23
SHA256

2fd9b90fbee95a5e8593b4a69011965a5cc9054153353b9c6d27d681df2344ea
SHA512

b22fc49f89b325444ee3c034d91cdb9f6e94cdc9831abf665bc43bb1915e25abc571973b6d35f051b9c15aaff9ce7eb9c093ab17d0b128db2d22b06ccebe9e8c
SSDEEP

3072:D2/IKuz9FM++YDZ0ibHyEvwm2zhH37eUCiU24rgaBKoElh:D2/IKub+YD/7yMuzprmideUoMh

Score

1^/10

Malware Config

Signatures

Files

7b08bae072a80e4b2c91ebf87e40bbe3
.exe windows:4 windows x86 arch:x86

a8270d7662503330f410df6130de7aaa

Code Sign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

53:05:f1:e5:e9:04:eb:02:78:68:bb:b4:d8:d9:7a:de
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

04/08/2009, 00:00

Not After

04/08/2010, 23:59

Subject

CN=Paul Franklin,O=Paul Franklin,POSTALCODE=SP110JH,STREET=5 Hillside Cottages\, Upton,L=Andover,ST=Hampshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_read
gmtime
wcsncat
_tzset
fclose
wcscpy
_errno
_local_unwind2
??1type_info@@UAE@XZ
_snwprintf
_wgetenv
__CxxFrameHandler
_stricmp
_dup
_beginthread
strncat
exit
free
isspace
_splitpath
fputs
_write
time
wcsstr
__unDName
_snprintf
_wmkdir
fseek
strchr
_mbscmp
localtime
_XcptFilter
_lock
?terminate@@YAXXZ
_wfsopen
ftell
div
__p__fmode
printf
wcstok
_exit
_initterm
_unlock
_fullpath
atol
_controlfp
qsort
__dllonexit
strerror
fflush
_ltoa
sprintf
__setusermatherr
_wtol
strcspn
malloc
wcschr

advapi32

GetSecurityDescriptorControl
ControlService
RegOpenKeyW
OpenSCManagerA
RegSetValueExW
RegEnumKeyExW
EnumServicesStatusExA
SetServiceStatus
RegCreateKeyExA
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
LookupAccountSidW
RegEnumValueA
UnlockServiceDatabase
RegQueryValueW
FreeSid
AllocateAndInitializeSid
RegQueryValueExA
GetTokenInformation
StartServiceCtrlDispatcherA
RegCreateKeyW
ChangeServiceConfig2A
SetSecurityDescriptorDacl
LockServiceDatabase
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
EqualSid
RegQueryInfoKeyA
RegCreateKeyExW
RegDeleteValueW
InitializeSecurityDescriptor
RegQueryValueExW
QueryServiceConfigA
RegFlushKey
DeleteService
RegSetValueExA
RegQueryInfoKeyW
CreateServiceA
OpenSCManagerW
OpenServiceA
ChangeServiceConfigA

ole32

WriteClassStm
CoTaskMemRealloc
OleRegGetMiscStatus
CoMarshalInterThreadInterfaceInStream

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueW

kernel32

DeleteCriticalSection
GetProcessHeap
CreateEventA
GetFullPathNameA
MoveFileExW
HeapSize
LoadLibraryExW
GetTimeFormatA
VirtualAlloc
SetEnvironmentVariableA
SetFileAttributesA
TlsFree
WriteConsoleA
GetStartupInfoW
ExitProcess
LockResource
GetSystemTime

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 56KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 50KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8270d7662503330f410df6130de7aaa

Code Sign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

53:05:f1:e5:e9:04:eb:02:78:68:bb:b4:d8:d9:7a:deCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

ole32

version

kernel32

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 9KB - Virtual size: 20KB

.rdata Size: 56KB - Virtual size: 280KB

.edata Size: 50KB - Virtual size: 86KB

.rsrc Size: 2KB - Virtual size: 2KB

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

53:05:f1:e5:e9:04:eb:02:78:68:bb:b4:d8:d9:7a:de
Certificate

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 9KB - Virtual size: 20KB

.rdata
Size: 56KB - Virtual size: 280KB

.edata
Size: 50KB - Virtual size: 86KB

.rsrc
Size: 2KB - Virtual size: 2KB