7f2d047f1d604523fb029e4091187a72

Sharing

Copy URL Twitter E-mail

General

Target

7f2d047f1d604523fb029e4091187a72
Size

126KB
MD5

7f2d047f1d604523fb029e4091187a72
SHA1

5eae71699501a109ad399c106d94c27df958038e
SHA256

b377818ea9473b59a17035f2eec54b92c2029ed090272d30ef063f0c6de47a56
SHA512

da965ff635a2b78cb40d84079bcc04bc04a089fed36d559f88333e092b5df31151ebea1d187208e6556ea5e650b4205ad5fe8a264765ab8ec25d75c791bd0aaa
SSDEEP

3072:qBNPzwZDFCaRTVFbnxN+Sv6lTq3QPqqo9gJkm0IXI:qbzw/V+SvOT9q9gJkYI

Score

1^/10

Malware Config

Signatures

Files

7f2d047f1d604523fb029e4091187a72
.exe windows:1 windows x86 arch:x86

8fa1d7850356cf1312c261835965f50d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/03/2010, 00:00

Not After

08/03/2011, 23:59

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:67:df:2f:5d:e2:de:d2:29:c3:85:3c:7d:76:1c:c4:a6:df:4a:e6
Signer

Actual PE Digest

9d:67:df:2f:5d:e2:de:d2:29:c3:85:3c:7d:76:1c:c4:a6:df:4a:e6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
CreateFiber
GetLogicalDriveStringsA
SearchPathA
GetSystemDefaultLCID
GetCurrentProcessId
VirtualAlloc
lstrcatA
IsBadStringPtrW
SleepEx

user32

MoveWindow
LoadBitmapW
GetActiveWindow
DeleteMenu
CreateDialogIndirectParamA
wsprintfW
SetWindowTextW
SetWindowRgn
SendMessageW
ActivateKeyboardLayout
EnumWindowStationsA
CloseWindow
EndDialog
DefFrameProcA
GetDC
UnregisterClassW
GetMenu
CharUpperW
GetDlgItemInt
GetMenuItemInfoW
EnumWindows
EnumDesktopsW

gdi32

SetDCBrushColor
CloseEnhMetaFile
SetBoundsRect
CreateMetaFileA
CreateICW
InvertRgn
SetTextColor
GdiGetBatchLimit
SetTextCharacterExtra
AngleArc
CreateFontIndirectW
GetViewportOrgEx
FixBrushOrgEx

advapi32

OpenBackupEventLogW
RegOpenKeyW
RegOpenKeyExA
RegSaveKeyW
RegEnumValueW
ReadEventLogW
RegSetValueA

shlwapi

DllGetVersion
UrlIsNoHistoryW
PathParseIconLocationA
SHStrDupW
PathRenameExtensionA
StrRetToBufA
PathMakeSystemFolderW
PathSetDlgItemPathA
StrRStrIA
StrCmpNW
SHOpenRegStream2W
PathFindSuffixArrayW
ColorAdjustLuma
PathIsURLW
PathRemoveBackslashA

comctl32

ImageList_SetImageCount
FlatSB_SetScrollInfo

version

VerQueryValueW
GetFileVersionInfoA

winmm

mmioFlush
PlaySound
waveInMessage
mciSendCommandW

inetcomm

MimeOleGetBodyPropW
EssReceiptDecodeEx
MimeOleGetFileExtension
MimeOleSMimeCapGetHashAlg
HrGetAttachIconByFile
MimeOleGetRelatedSection
CreateSMTPTransport
EssReceiptEncodeEx
EssContentHintEncodeEx
MimeOleCreateBody
MimeOleGetDefaultCharset

wsock32

rexec
GetServiceA
WSASetLastError

Sections

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.46GOJ
Size: 1KB - Virtual size: 12KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.p
Size: 1KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.4Nt70y
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3
Size: 1KB - Virtual size: 23KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.2D7A
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.21
Size: 1KB - Virtual size: 28KB

IMAGE_SCN_MEM_READ

.z
Size: 1KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fa1d7850356cf1312c261835965f50d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4aCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

9d:67:df:2f:5d:e2:de:d2:29:c3:85:3c:7d:76:1c:c4:a6:df:4a:e6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

comctl32

version

winmm

inetcomm

wsock32

Sections

.rdata Size: 3KB - Virtual size: 2KB

.46GOJ Size: 1KB - Virtual size: 12KB

.text Size: 16KB - Virtual size: 16KB

.p Size: 1KB - Virtual size: 43KB

.4Nt70y Size: 1KB - Virtual size: 2KB

.3 Size: 1KB - Virtual size: 23KB

.2D7A Size: 1024B - Virtual size: 28KB

.21 Size: 1KB - Virtual size: 28KB

.z Size: 1KB - Virtual size: 41KB

.data Size: 12KB - Virtual size: 14KB

.rsrc Size: 73KB - Virtual size: 72KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

07:be:8f:83:f4:45:50:21:f4:e2:4f:b0:21:fc:a2:4a
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

9d:67:df:2f:5d:e2:de:d2:29:c3:85:3c:7d:76:1c:c4:a6:df:4a:e6
Signer

.rdata
Size: 3KB - Virtual size: 2KB

.46GOJ
Size: 1KB - Virtual size: 12KB

.text
Size: 16KB - Virtual size: 16KB

.p
Size: 1KB - Virtual size: 43KB

.4Nt70y
Size: 1KB - Virtual size: 2KB

.3
Size: 1KB - Virtual size: 23KB

.2D7A
Size: 1024B - Virtual size: 28KB

.21
Size: 1KB - Virtual size: 28KB

.z
Size: 1KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 14KB

.rsrc
Size: 73KB - Virtual size: 72KB