9b20985a5b37ab3cd4dcc07a8eb1bf14

Sharing

Copy URL Twitter E-mail

General

Target

9b20985a5b37ab3cd4dcc07a8eb1bf14
Size

318KB
MD5

9b20985a5b37ab3cd4dcc07a8eb1bf14
SHA1

da13e193659a5da4f67ed9e8d9f37ac9e8c1f573
SHA256

cf431841791dbf19b6d32fc8f6c2ab67df0357442371460a5183fa5873605c92
SHA512

f5ff9c17b819f9804cc00c2ca26c735fe0ee0483310b741e5834bbddf4564ae355e465404ed545405525166920818bc6de80d5905354bde171bd16d84190faf4
SSDEEP

6144:85IqtNLeCbjKqrnz8loTnEF8kBt/WC0/Kz9q64dexboohnKT3TdQqb5HIgsTogVk:85IqtNLeCbjKqrnz8lo//Kz9q64sxbop

Score

1^/10

Malware Config

Signatures

Files

9b20985a5b37ab3cd4dcc07a8eb1bf14
.exe windows:5 windows x86 arch:x86

fbbad09feb8c7d41c4378409405adca4

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

17/05/2005, 00:00

Not After

16/05/2010, 23:59

Subject

CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

93:da:41:47:84:49:b2:9b:e6:e4:ae:dc:5e:9b:86:03
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

14/02/2008, 00:00

Not After

13/02/2009, 23:59

Subject

CN=Softland,O=Softland,POSTALCODE=400305,STREET=Traian Grozavescu no. 2/1,L=Cluj-Napoca,ST=Cluj,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:15:85:d5:af:c9:f1:68:44:7b:4c:eb:79:84:84:ac:95:b7:ff:01
Signer

Actual PE Digest

cb:15:85:d5:af:c9:f1:68:44:7b:4c:eb:79:84:84:ac:95:b7:ff:01

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Develop\PDFS\novaPDFClient\Release Free\novaPDFClient.pdb

Imports

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

psapi

EnumProcessModules
GetModuleBaseNameW

kernel32

WriteFile
ReadFile
WaitNamedPipeW
GetLastError
CreateFileW
Sleep
LocalFree
GetComputerNameExW
GetComputerNameW
FreeLibrary
GetProcAddress
LoadLibraryW
OpenProcess
ExpandEnvironmentStringsW
GetFileSize
DisconnectNamedPipe
FlushFileBuffers
GetTickCount
CreateProcessW
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
OpenEventW
GetVersionExW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
LoadLibraryA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
SetStdHandle
HeapSize
GetLocaleInfoA
SetEvent
CloseHandle
LocalAlloc
CreateThread
WaitForSingleObject
SetEndOfFile
GetProcessHeap
GetUserDefaultLangID
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringA
GetSystemTimeAsFileTime
RaiseException
HeapAlloc
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
ExitProcess
GetModuleFileNameA
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId

user32

PostMessageW
RegisterWindowMessageW
MessageBoxW
wsprintfW
SendMessageW
LoadStringW
GetWindowLongW
SetWindowTextW
GetSystemMetrics

winspool.drv

GetPrinterW
OpenPrinterW
ClosePrinter
GetJobW
SetJobW
GetPrinterDriverDirectoryW

advapi32

RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueA
RegCreateKeyExW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbbad09feb8c7d41c4378409405adca4

Code Sign

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89Certificate

Extended Key Usages

Key Usages

93:da:41:47:84:49:b2:9b:e6:e4:ae:dc:5e:9b:86:03Certificate

Extended Key Usages

Key Usages

cb:15:85:d5:af:c9:f1:68:44:7b:4c:eb:79:84:84:ac:95:b7:ff:01Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wtsapi32

psapi

kernel32

user32

winspool.drv

advapi32

shell32

Sections

.text Size: 217KB - Virtual size: 216KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 44KB - Virtual size: 76KB

.rsrc Size: 30KB - Virtual size: 29KB

4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Certificate

93:da:41:47:84:49:b2:9b:e6:e4:ae:dc:5e:9b:86:03
Certificate

cb:15:85:d5:af:c9:f1:68:44:7b:4c:eb:79:84:84:ac:95:b7:ff:01
Signer

.text
Size: 217KB - Virtual size: 216KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 44KB - Virtual size: 76KB

.rsrc
Size: 30KB - Virtual size: 29KB