97131265ff34980b1b79a442e324dc79

Sharing

Copy URL Twitter E-mail

General

Target

97131265ff34980b1b79a442e324dc79
Size

179KB
MD5

97131265ff34980b1b79a442e324dc79
SHA1

2e62e658af5affdaa8a0694a02b51230f0af3b97
SHA256

3c871ce74ae5b6dbf71b21e68f97f33f26b63d82875c954d344bb91fd3c55a07
SHA512

c96a2363c2a9c39ad63a96608e11e34592aa43c194f27d9dd1bd36456abc674c159e4e7ed7492638950fbe4cae6889df0610cfe847307b3dc1b1f3e36fcfe74d
SSDEEP

3072:zunpjUYLt5mZOl+MiZMotggQQBrd2KteftEb/DVeBzVurj7W37k:zq+DOl+MiTagQQ1j5DV+zVur237k

Score

1^/10

Malware Config

Signatures

Files

97131265ff34980b1b79a442e324dc79
.dll windows:4 windows x86 arch:x86

c0a2ec7045e5c08a632da35ca5116022

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:f9:b9:0c:4c:69:84:57:a3:23:b9:eb:96:5e:14:aa
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

15/10/2010, 00:00

Not After

14/12/2011, 23:59

Subject

CN=Durion Co.\, Ltd.,O=Durion Co.\, Ltd.,L=Gyeyang-gu,ST=Incheon,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA

netapi32

Netbios

version

VerQueryValueA

mfc42

ord3831

msvcrt

_initterm

user32

GetSystemMetrics

gdi32

TextOutA

advapi32

RegSetValueExA

shell32

ShellExecuteA

ole32

CoUninitialize

olepro32

ord251

oleaut32

VariantClear

wsock32

WSAGetLastError

Exports

Exports

Dll_CloseCB
Dll_Unload
GetENCCode_cdecl
GetLoginID_cdecl
GetOption_cdecl
PbLogin_cdecl
SetAutoLogin_cdecl
_CloseCB@4
_GetENCCode@8
_GetLoginID@4
_GetOption@4
_PbLogin@8
_PbLogin_AutoLogin@12
_SetAutoLogin@4
isAutoLogin
isFreeUser

Sections

.text
Size: 171KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c0a2ec7045e5c08a632da35ca5116022

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

03:f9:b9:0c:4c:69:84:57:a3:23:b9:eb:96:5e:14:aaCertificate

Extended Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

netapi32

version

mfc42

msvcrt

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

wsock32

Exports

Exports

Sections

.text Size: 171KB - Virtual size: 176KB

.idata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:f9:b9:0c:4c:69:84:57:a3:23:b9:eb:96:5e:14:aa
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

.text
Size: 171KB - Virtual size: 176KB

.idata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB