9a7ef5b483bdd81def9b6fe6157c0ee2

Sharing

Copy URL Twitter E-mail

General

Target

9a7ef5b483bdd81def9b6fe6157c0ee2
Size

361KB
MD5

9a7ef5b483bdd81def9b6fe6157c0ee2
SHA1

918a661cda11e6a56ad5143e597c2306febb198e
SHA256

103de534d43587a83b469e756b750101908f70c30d7effee6f04cb324b6c3335
SHA512

38f4ddcc334335589eccc3c3765245daa586fe9aabf046112b0f76dd4098ac31acaceeecabecaa37a0d5ded9c87134c38f6a0f7e9979dc120411fc4e0a2baee9
SSDEEP

6144:tAb9n+ra7spim3LZXUPFG0vessNnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnng:tAbSa7s8m3FXyG0zBHb8

Score

1^/10

Malware Config

Signatures

Files

9a7ef5b483bdd81def9b6fe6157c0ee2
.exe windows:4 windows x86 arch:x86

3abd5e67e19004baca65e9b354353a02

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:22:25:2b:47:8a:1a:91:a8:bc:2b:8b:7f:2d:96:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

09/05/2007, 00:00

Not After

08/06/2010, 23:59

Subject

CN=ESET\, spol. s r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESET\, spol. s r.o.,L=Bratislava,ST=Slovakia,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ad:85:5d:53:c8:00:8d:50:82:8e:04:86:6d:8f:f8:f7:d3:42:66:ca
Signer

Actual PE Digest

ad:85:5d:53:c8:00:8d:50:82:8e:04:86:6d:8f:f8:f7:d3:42:66:ca

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetModuleFileNameA
CreateMutexA
GetCurrentThreadId
CopyFileA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LocalSize
GlobalMemoryStatusEx
Process32Next
lstrcmpiA
Process32First
Module32Next
Module32First
OpenProcess
FreeLibrary
CreateThread
TerminateThread
GetStartupInfoA
GetLocalTime
ExitProcess
CreateRemoteThread
OpenEventA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetProcAddress
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetTickCount
ReleaseMutex
GetVersionExA
GetModuleHandleA
GlobalUnlock
GlobalFree
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
VirtualFree
DeleteCriticalSection
Sleep
LoadLibraryA
GetSystemDirectoryA

user32

ReleaseDC
SetRect
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
LoadCursorA
PostThreadMessageA
GetInputState
RegisterClassA
LoadIconA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindow
CharNextA
GetSystemMetrics
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
wsprintfA
GetMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
CloseDesktop
EnumWindows

gdi32

DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateCompatibleBitmap
GetDIBits
DeleteObject
GetStockObject

advapi32

OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
AbortSystemShutdownA
GetUserNameA
RegSetValueExA

shell32

ShellExecuteA
SHGetFileInfoA

msvcrt

_snprintf
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
strncpy
mbstowcs
realloc
_errno
strncmp
sprintf
rand
atoi
printf
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
memcpy
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
memcmp
free
malloc
_except_handler3
strrchr
strcmp
strcpy
strcat
strchr
strncat

ws2_32

__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
WSACleanup
recv
select
WSAIoctl
setsockopt
connect
htons
WSAStartup
ioctlsocket
ntohs
inet_ntoa
gethostname
getsockname
send
closesocket
socket
gethostbyname
inet_addr

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA
WTSDisconnectSession

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

netapi32

NetLocalGroupAddMembers
NetUserAdd
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum

iphlpapi

GetIfTable
GetAdaptersInfo

psapi

EnumProcessModules

Exports

Exports

QQ841374296
aaaaaaaaaaaaaaaaaaaaa
ggggggggg
hk3600
wwwwwwwww
xxxxxxxxx
zxsahduo

Sections

?K"SV81H
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

*R5GJ(CK
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Q:qB$#=8
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

p6sPum]l
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

e*:+TOEr
Size: 217KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3abd5e67e19004baca65e9b354353a02

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2b:22:25:2b:47:8a:1a:91:a8:bc:2b:8b:7f:2d:96:eaCertificate

Extended Key Usages

Key Usages

ad:85:5d:53:c8:00:8d:50:82:8e:04:86:6d:8f:f8:f7:d3:42:66:caSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

ws2_32

msvcp60

wtsapi32

msvfw32

netapi32

iphlpapi

psapi

Exports

Exports

Sections

?K"SV81H Size: 87KB - Virtual size: 87KB

*R5GJ(CK Size: 7KB - Virtual size: 7KB

Q:qB$#=8 Size: 14KB - Virtual size: 13KB

p6sPum]l Size: 11KB - Virtual size: 23KB

e*:+TOEr Size: 217KB - Virtual size: 220KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2b:22:25:2b:47:8a:1a:91:a8:bc:2b:8b:7f:2d:96:ea
Certificate

ad:85:5d:53:c8:00:8d:50:82:8e:04:86:6d:8f:f8:f7:d3:42:66:ca
Signer

?K"SV81H
Size: 87KB - Virtual size: 87KB

*R5GJ(CK
Size: 7KB - Virtual size: 7KB

Q:qB$#=8
Size: 14KB - Virtual size: 13KB

p6sPum]l
Size: 11KB - Virtual size: 23KB

e*:+TOEr
Size: 217KB - Virtual size: 220KB