7d90f2bd8fe561c9500ce54522398969

Sharing

Copy URL Twitter E-mail

General

Target

7d90f2bd8fe561c9500ce54522398969
Size

53KB
MD5

7d90f2bd8fe561c9500ce54522398969
SHA1

74c0c18b291e74192fa51ccf3057d783465c4126
SHA256

34af41a27e55985458e30c2c4cbc05b21b69175aa7dc52f6b48807669cdd1f60
SHA512

038f3093927d31b4921eb952137b69a9c318bdd0f3b199640e50bdc0c31a2137c8c65ec1578f7e4ea747d6b525bd52548107396f5fb1fce0570e77610e948d90
SSDEEP

768:Lhb+PCQMRuUXoTYRfST7JPzdfdLi1qddnCayt7L3Pzz:LhbsClRuUXoTYRo7J7pNCB5Tzz

Score

1^/10

Malware Config

Signatures

Files

7d90f2bd8fe561c9500ce54522398969
.exe windows:4 windows x86 arch:x86

2cb2bbfa81aa1debd3e6d362848a37c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/10/2004, 00:00

Not After

08/10/2005, 23:59

Subject

CN=America Online\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=WAOL Firewall Trust v1,O=America Online\, Inc.,L=Dulles,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\strauss2_lp\1180a\cprd32\AOL\misc\coreclient\shellmon\shellmon.pdb

Imports

shlwapi

PathFindFileNameA

msimg32

GradientFill

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

msvcr71

_except_handler3
__set_app_type
__dllonexit
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_onexit
atol
atoi
_itoa
strrchr
_splitpath
strstr
localtime
asctime
_mkdir
_ultoa
time
strlen
strcat
memcpy
memset
strcmp
strcpy
malloc
free
strncpy
_controlfp

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

user32

LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadCursorA
PostQuitMessage
DefWindowProcA
SetTimer
GetWindowThreadProcessId
GetDesktopWindow
CreateWindowExA
RegisterWindowMessageA
FindWindowA
KillTimer
PostMessageA
SendMessageTimeoutA
DialogBoxParamA
SendDlgItemMessageA
wsprintfA
IsDlgButtonChecked
GetDlgItemTextA
EndDialog
SetWindowTextA
SetDlgItemTextA
CheckDlgButton
GetWindowTextA
GetSysColor
DrawTextA
DrawFocusRect
FillRect
RegisterClassExA

gdi32

GetNearestColor
GetDeviceCaps
DeleteObject
SelectObject
CreateSolidBrush
SelectClipRgn
CreateRoundRectRgn
LPtoDP
DeleteDC
BitBlt
SetTextColor
SetBkMode
CreateCompatibleBitmap
CreateCompatibleDC
SetBkColor

kernel32

GetVersionExA
lstrcpyA
lstrcpynA
lstrlenA
WritePrivateProfileStringA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemPowerStatus
WaitForDebugEvent
DebugActiveProcess
CreateThread
GetStartupInfoA
CloseHandle
SetEvent
OpenEventA
GetLastError
OpenMutexA
FindClose
FindFirstFileA
CreateProcessA
Sleep
CreateMutexA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
ReadProcessMemory
ContinueDebugEvent
GetModuleHandleA
_lclose
_lopen
_llseek
_lcreat
_lwrite
lstrcatA
GetModuleFileNameA
SetCurrentDirectoryA
SetProcessShutdownParameters
CopyFileA
FindNextFileA
GetExitCodeProcess
OpenProcess
Module32First
Module32Next
WritePrivateProfileSectionA
GetLocalTime

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cb2bbfa81aa1debd3e6d362848a37c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

shlwapi

msimg32

version

msvcr71

advapi32

user32

gdi32

kernel32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 12KB - Virtual size: 8KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9
Certificate

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 12KB - Virtual size: 8KB