9bcb1e6061c5b6dee8621962536a4036

Sharing

Copy URL Twitter E-mail

General

Target

9bcb1e6061c5b6dee8621962536a4036
Size

1.4MB
MD5

9bcb1e6061c5b6dee8621962536a4036
SHA1

b07d656ed035a3bd5ce8ce5c31f3103a1155677b
SHA256

a58081ceae708b184fbd9ccb2b941f0078b9eae5ba91a7c0f82c2f5985b5addf
SHA512

9e256d8c86e0a2a9a5f215236aff7c65e01c019647b832c50ca782a16a4385fb5c7cc95c116a110b19a3d56edc9d6ad5b2e771f86786ad376b2ef8449a476bd0
SSDEEP

24576:CZ5LzygEGoYkR4HYYAmax3ksunYLw2kXPIShK5TwL6fjjkPPLkDlxpQfjqtd5vYX:CPzygEGRD4YAmKkssePqK1AKjjXCq31m

Score

1^/10

Malware Config

Signatures

Files

9bcb1e6061c5b6dee8621962536a4036
.dll regsvr32 windows:4 windows x86 arch:x86

69c96e0e730cbff282281a184ef6917d

Code Sign

33:00:00:00:8e:a8:19:d7:3f:36:8b:7a:40:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/10/2014, 18:11

Not After

01/01/2016, 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:1d:d4:86:06:f0:a2:81:b5:7f:0f:0e:f7:bd:74:91:7e:11:6b:39:b5:50:dd:34:77:48:27:a2:79:d3:fb:10
Signer

Actual PE Digest

32:1d:d4:86:06:f0:a2:81:b5:7f:0f:0e:f7:bd:74:91:7e:11:6b:39:b5:50:dd:34:77:48:27:a2:79:d3:fb:10

Digest Algorithm

sha256

PE Digest Matches

false

9b:a3:58:42:76:bb:00:fe:fa:af:9e:f4:c9:c8:03:50:ff:1c:08:2e
Signer

Actual PE Digest

9b:a3:58:42:76:bb:00:fe:fa:af:9e:f4:c9:c8:03:50:ff:1c:08:2e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegDeleteKeyA
OpenProcessToken
OpenSCManagerA
RegEnumKeyA
RegEnumValueA
RegCloseKey
RegQueryInfoKeyA
GetTokenInformation
CloseServiceHandle
EqualSid
ImpersonateLoggedOnUser
AllocateAndInitializeSid
FreeSid
RegQueryValueExA
RegQueryValueA
RegEnumKeyExA
CryptAcquireContextA
RegOpenKeyExA
EnumServicesStatusA
RevertToSelf
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA
OpenThreadToken

gdi32

SetWindowOrgEx
GetTextMetricsA
BitBlt
SetBkColor
PatBlt
EnumFontFamiliesExA
TextOutA
MoveToEx
DeleteMetaFile
Polyline
CreateRectRgnIndirect
SetTextColor
GetDeviceCaps
StretchBlt
CreateMetaFileA
CreateFontA
Ellipse
CreateCompatibleDC
Rectangle
SetBkMode
CreateCompatibleBitmap
SelectPalette
SetWindowExtEx
DeleteDC
CloseMetaFile
Polygon
ExtTextOutA
SetTextAlign
DeleteObject
RealizePalette
GetTextExtentPointA
LPtoDP
LineTo
SetViewportOrgEx
GetPixel
GetObjectA
GetTextExtentPoint32A
SetMapMode
SaveDC
CreatePen
SelectObject
CreateFontIndirectA
CreateSolidBrush
RestoreDC
TextOutW

inetcomm

CreatePOP3Transport
MimeOleSetBodyPropA
MimeOleGetPropA
HrDoAttachmentVerb
HrGetAttachIcon
HrAttachDataFromBodyPart
CreateRangeList
MimeOleSetDefaultCharset
MimeOleUnEscapeStringInPlace
MimeOleAlgStrengthFromSMimeCap
MimeOleParseRfc822Address
MimeOleGetFileInfoW
CreateSMTPTransport
MimeOleSMimeCapAddCert
MimeOleGetBodyPropA
MimeOleCreateBody
MimeOleGetCertsFromThumbprints
HrFreeAttachData
MimeOleParseRfc822AddressW
MimeOleCreateSecurity
MimeOleSMimeCapGetEncAlg
MimeOleDecodeHeader
MimeOleSetBodyPropW
MimeOleCreatePropertySet
MimeOleCreateVirtualStream
MimeOleGetCodePageCharset
CreateNNTPTransport
MimeOleSetCompatMode
MimeOleGetCharsetInfo
MimeOleClearDirtyTree
MimeOleCreateMessageParts
MimeOleGetPropertySchema
MimeOleGetBodyPropW
HrGetAttachIconByFile
MimeOleInetDateToFileTime
MimeOleSMimeCapsFull
MimeOleGenerateMID
MimeOleCreateHashTable
MimeOleAlgNameFromSMimeCap
MimeOleGetCodePageInfo
MimeEditDocumentFromStream
HrAttachDataFromFile
HrAthGetFileNameW
MimeOleSMimeCapAddSMimeCap
MimeOleGetAllocator
MimeOleSMimeCapGetHashAlg
MimeEditViewSource
HrAthGetFileName
MimeOleStripHeaders
MimeOleFindCharset
MimeOleSMimeCapInit
CreateIMAPTransport2
MimeOleCreateMessage

kernel32

WideCharToMultiByte
VirtualAlloc
GetModuleHandleA
GetCurrentProcess
MoveFileA
VirtualQuery
LockResource
QueryPerformanceCounter
DeleteFileA
HeapFree
GetCPInfo
LCMapStringA
HeapSize
FindClose
MulDiv
FindResourceA
CloseHandle
lstrlenW
InitializeCriticalSectionAndSpinCount
GlobalUnlock
GetExitCodeProcess
LeaveCriticalSection
lstrlenA
FreeEnvironmentStringsA
SizeofResource
lstrcmpiA
IsBadWritePtr
GetStringTypeA
FlushInstructionCache
GetVersion
FlushFileBuffers
GetShortPathNameW
Sleep
GetCurrentThreadId
UnhandledExceptionFilter
GetProfileIntA
ReleaseMutex
SetThreadPriority
FreeEnvironmentStringsW
MultiByteToWideChar
TlsFree
InterlockedExchange
InitializeCriticalSection
GetDiskFreeSpaceA
WaitForSingleObject
TlsAlloc
CreateFileA
GetSystemInfo
HeapCreate
HeapAlloc
GetUserDefaultLCID
GetEnvironmentVariableA
GlobalFree
GlobalLock
OpenFile
GetFileType
LoadResource
SystemTimeToFileTime
RtlUnwind
SetEvent
FileTimeToSystemTime
ExpandEnvironmentStringsA
EnterCriticalSection
GetEnvironmentStrings
CreateMutexA
IsDBCSLeadByteEx
SetHandleCount
GetUserDefaultLangID
HeapDestroy
CreateDirectoryA
GetTempPathA
SetFilePointer
WriteFile
GetProcAddress
GlobalSize
GlobalAlloc
GetLastError
GetEnvironmentStringsW
FormatMessageA
GetOEMCP
IsBadStringPtrA
GetLocaleInfoW
GetSystemDefaultLangID
GetTickCount
IsDBCSLeadByte
GetTempFileNameA
InterlockedDecrement
FindNextFileA
FileTimeToLocalFileTime
ExitProcess
InterlockedIncrement
GetWindowsDirectoryA
LoadLibraryA
VirtualProtect
FormatMessageW
GetStringTypeW
CreateEventA
LocalAlloc
IsBadReadPtr
FindFirstFileA
GetACP
GetSystemDirectoryA
FreeLibrary
GetFileAttributesA
GetSystemTime
TlsSetValue
HeapReAlloc
GetCurrentProcessId
TlsGetValue
GlobalReAlloc
SetErrorMode
LCMapStringW
CompareFileTime
GetStdHandle
RtlMoveMemory
GetStartupInfoA
SetLastError
TerminateProcess
VirtualFree
GetLocaleInfoA
GetDriveTypeA
CreateProcessA
GetProcessHeap
GetModuleFileNameA
GetCurrentThread
GetCommandLineA
CreateThread
GetVersionExA
lstrcpynA
SetStdHandle
LoadLibraryExA
LocalFree
GetShortPathNameA
DeleteCriticalSection
SetUnhandledExceptionFilter
lstrcmpA

msoert2

HrIsStreamUnicode
PszSkipWhiteA
HrStreamToByte
HrSafeGetStreamSize
WriteStreamToFile
HrCheckTridentMenu
PszDupA
DeleteTempFileOnShutdownEx
FIsEmptyA
WriteStreamToFileW
CryptFreeFunc
ReplaceChars
HrGetBodyElement
MessageBoxInst
HrIStreamWToBSTR
HrRewindStream
FBuildTempPath
FIsHTMLFileW
CreateTempFile
CleanupFileNameInPlaceA
FIsEmptyW
IUnknownList_CreateInstance
PszEscapeMenuStringA
GetHtmlCharset
HrGetCertKeyUsage
CreateNotify
FIsSpaceA
fGetBrowserUrlEncoding
StrToUintA
CreateEnumFormatEtc
CreateStreamOnHFile
HrGetElementImpl
GetExePath
MessageBoxInstW
SzGetCertificateEmailAddress
_MSG
HrLPSZToBSTR
UlStripWhitespace
HrLPSZCPToBSTR
UlStripWhitespaceW
CreateDataObject
ReplaceCharsW
WriteStreamToFileHandle
strtrimW
CleanupFileNameInPlaceW
PszDupW
PszToUnicode
FIsValidFileNameCharW
PVGetCertificateParam
CreateLogFile
CchFileTimeToDateTimeSz
CopyRegistry
BrowseForFolder
PszAllocA
HrSetDirtyFlagImpl
HrGetStreamSize
CrackNotificationPackage
PszToANSI
CenterDialog
CchFileTimeToDateTimeW
FIsHTMLFile
HrCreateTridentMenu
GenerateUniqueFileName
HrStreamSeekSet
CryptAllocFunc
IsDigit
FBuildTempPathW
CreateStreamOnHFileW
IDrawText
HrCopyStream
PszFromANSIStreamA
OpenFileStream
FMissingCert
UpdateRebarBandColors

ole32

OleSetClipboard
WriteClassStm
OleRegEnumVerbs
CoGetMalloc
PropVariantCopy
CoTaskMemFree
PropVariantClear
OleRun
OleLoadFromStream
CoLockObjectExternal
CreateStreamOnHGlobal
CoUninitialize
CreateOleAdviseHolder
StringFromGUID2
CoDisconnectObject
CLSIDFromString
DoDragDrop
CoTaskMemAlloc
OleRegGetMiscStatus
ReleaseStgMedium
OleInitialize
RevokeDragDrop
OleRegGetUserType
CoInitialize
OleUninitialize
OleSaveToStream
RegisterDragDrop
CreateDataAdviseHolder
ReadClassStm
CoCreateInstance
CoTaskMemRealloc

shlwapi

SHSetValueA
SHRegGetBoolUSValueA
PathRemoveBackslashW
PathFileExistsW
SHAutoComplete
PathStripPathW
PathRemoveExtensionW
SHDeleteValueA
SHQueryValueExA
SHDeleteKeyA
wvnsprintfA
PathAppendA
StrFormatByteSizeA
wnsprintfA
StrNCatW
PathFileExistsA
PathFindExtensionW
StrDupA
StrStrIA
SHGetValueW
PathCanonicalizeA
PathFindFileNameW
StrCatBuffW
PathGetArgsA
PathUnquoteSpacesA
StrToIntA
SHCopyKeyA
StrToIntExA
PathCompactPathExW
StrStrA
SHCreateShellPalette
PathAddExtensionW
StrDupW
PathIsDirectoryA
UrlEscapeA
StrChrA
StrStrIW
PathAddBackslashA
SHQueryInfoKeyA
PathIsContentTypeW
PathCombineW
PathIsFileSpecW
PathIsDirectoryW
PathFindFileNameA
StrCSpnA
PathIsRootA
SHGetValueA
StrRChrIW
StrCmpW
StrStrW
PathRemoveFileSpecA
PathRemoveBackslashA
StrCmpNIA
wnsprintfW
PathIsURLW
StrCatBuffA
UrlApplySchemeW
StrCmpIW
PathRemoveFileSpecW
StrCpyNW
StrCSpnW
SHEnumKeyExA
UrlUnescapeA
PathFindExtensionA
SHSetValueW
StrCmpNIW
PathCombineA
PathRemoveArgsA

user32

DeleteMenu
GetDC
KillTimer
IsDialogMessageA
ActivateKeyboardLayout
TrackPopupMenu
SetWindowPos
SetMenuItemInfoA
ClientToScreen
EndDeferWindowPos
SetPropA
GetDesktopWindow
RegisterClassA
EndPaint
ShowWindow
SetActiveWindow
IsCharAlphaA
GetMenuItemInfoA
GetMessagePos
CheckMenuItem
GetDoubleClickTime
DestroyMenu
GetWindowPlacement
FindWindowExA
SetWindowLongA
PostQuitMessage
MessageBeep
TranslateAcceleratorA
GetLastActivePopup
GetKeyState
OpenClipboard
ModifyMenuA
GetMenuItemCount
MessageBoxA
SetRect
SetMenuDefaultItem
GetFocus
SetWindowRgn
GetClassNameA
RegisterClipboardFormatA
GetSubMenu
SetForegroundWindow
SetCapture
InvalidateRect
DrawStateA
GetMenuState
GetWindowTextLengthA
DrawIconEx
DrawFocusRect
WindowFromPoint
TrackPopupMenuEx
EnumThreadWindows
AdjustWindowRect
RegisterWindowMessageA
LoadCursorA
CreateWindowExA
GetCapture
LoadAcceleratorsA
GetDlgItemTextW
CheckDlgButton
EmptyClipboard
IsCharAlphaNumericA
IsChild
GetKeyboardLayoutList
PostMessageA
SetDlgItemTextA
CreateDialogParamA
DestroyWindow
PtInRect
DrawTextA
DispatchMessageA
RedrawWindow
GetActiveWindow
FillRect
GetWindow
BeginPaint
GetWindowDC
UnionRect
GetMenuItemID
InflateRect
GetClientRect
SetMenu
SetTimer
AdjustWindowRectEx
RemoveMenu
SetDlgItemInt
IsWindow
RemovePropA
GetWindowTextA
EnumChildWindows
IsZoomed
ReleaseDC
CloseClipboard
OffsetRect
GetSystemMetrics
UpdateWindow
IsIconic
GetForegroundWindow
GetWindowLongA
CharLowerA
GetParent
DefWindowProcA
TranslateMessage
DrawEdge
GetAsyncKeyState
IntersectRect
EnableMenuItem
DestroyIcon
LoadIconA
SetWindowTextA
GetDlgItemTextA
SetParent
WaitForInputIdle
CheckRadioButton
PostThreadMessageA
LoadStringW
IsWindowEnabled
EndDialog
CreatePopupMenu
GetCursorPos
ReleaseCapture
SetCursor
ValidateRect
DeferWindowPos
EqualRect
SetClipboardData
LoadBitmapA
LoadImageA
BeginDeferWindowPos
ScreenToClient
CharNextA
DrawTextExA
IsWindowVisible
GetMenuStringA
GetSysColor
AppendMenuA
GetClassInfoExA
SetWindowPlacement
SystemParametersInfoA
GetWindowRect
IsMenu
CheckMenuRadioItem
DialogBoxParamA
GetMessageA
SetFocus
CharUpperA
RegisterClassExA
CopyRect
EnableWindow
GetPropA
IsWindowUnicode
GetUpdateRect
EnumWindows
GetNextDlgTabItem
GetDlgCtrlID
SetDlgItemTextW
MoveWindow
WinHelpA
LoadMenuA
SendDlgItemMessageA
GetDlgItemInt
CharPrevA
SendMessageA
MapWindowPoints
DrawFrameControl
SendDlgItemMessageW
LoadStringA
GetWindowThreadProcessId
UnregisterClassA
SendMessageW
IsDlgButtonChecked

Exports

Exports

Uncuriously
Foreadvice
Mickle
Cardiological
Mudding
Orally
Galiongee
Penknife
Interdictor
Trachybasalt
Isonomous
Unstubborn
Ustulina
Inhumationist
Adai
Chrysalides
DllRegisterServer
Bijou
Endocannibalism
Homoeomorphous
Desmotrope
Gateado
Amli
Quaker
Landlooker
Interimistic
Chitra
Verticillated
Heterointoxication
Pondo
Corradiate
Galoisian
Infallibilism
Singlestick
Unproduceably
Biquadrantal
Tritylodon
Elfic
Discernibleness
Criteriology
Paraform
Lightfulness
Mellowness
Floppiness
Cryptocrystalline
DllUnregisterServer
Trichiurus

Sections

Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69c96e0e730cbff282281a184ef6917d

Code Sign

33:00:00:00:8e:a8:19:d7:3f:36:8b:7a:40:00:00:00:00:00:8eCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

32:1d:d4:86:06:f0:a2:81:b5:7f:0f:0e:f7:bd:74:91:7e:11:6b:39:b5:50:dd:34:77:48:27:a2:79:d3:fb:10Signer

9b:a3:58:42:76:bb:00:fe:fa:af:9e:f4:c9:c8:03:50:ff:1c:08:2eSigner

Headers

File Characteristics

Imports

advapi32

gdi32

inetcomm

kernel32

msoert2

ole32

shlwapi

user32

Exports

Exports

Sections

Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 6KB - Virtual size: 6KB

33:00:00:00:8e:a8:19:d7:3f:36:8b:7a:40:00:00:00:00:00:8e
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

32:1d:d4:86:06:f0:a2:81:b5:7f:0f:0e:f7:bd:74:91:7e:11:6b:39:b5:50:dd:34:77:48:27:a2:79:d3:fb:10
Signer

9b:a3:58:42:76:bb:00:fe:fa:af:9e:f4:c9:c8:03:50:ff:1c:08:2e
Signer

.reloc
Size: 6KB - Virtual size: 6KB