a38676a506f418d7046a8c4fcca8e75e

Sharing

Copy URL Twitter E-mail

General

Target

a38676a506f418d7046a8c4fcca8e75e
Size

145KB
MD5

a38676a506f418d7046a8c4fcca8e75e
SHA1

2187e4625a3bfe12adcabeec1a0725c699d30bec
SHA256

221e4fda313b2696d3c14325b581fa777c76be95567975999f6b554764b061af
SHA512

3068bbc63d5630d19f3cb8b24de1afbacf0642c9a43f46f145d627217077ce62fbc60dddbd925f0df7c86c97d14b5a93afb5c6d3f72c506905f4681d7920a8a8
SSDEEP

3072:qyiIL2aUStYI4kOojhmlDUaKhVV4dD+mO3teRl2qx:W2bukOkhK4aKhVV/Dq

Score

1^/10

Malware Config

Signatures

Files

a38676a506f418d7046a8c4fcca8e75e
.exe windows:4 windows x86 arch:x86

1665839200a65d025db1cbab5f8050be

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:4d:17:73:c9:51:7e:e2:00:e8:40:3f:6a:06:c5:c2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/09/2010, 00:00

Not After

28/10/2013, 23:59

Subject

CN=VMware\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Marketing,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:fc:f5:83:92:2f:45:9a:bd:bb:04:5c:92:96:13:36:81:a5:95:46
Signer

Actual PE Digest

0e:fc:f5:83:92:2f:45:9a:bd:bb:04:5c:92:96:13:36:81:a5:95:46

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetSecurityDescriptorLength
GetKernelObjectSecurity

kernel32

GetVolumeInformationA
GetFileAttributesA
GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
FindFirstFileA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
GetVersion
GetFileType
GetFileTime
ReadFile
SetConsoleMode
GetConsoleMode
FindNextFileA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
InterlockedExchange
CreateMutexA
lstrcpynA
GetDriveTypeA
lstrcmpiA
LeaveCriticalSection
EnterCriticalSection
lstrlenA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
MultiByteToWideChar
MoveFileA
SetStdHandle
HeapReAlloc
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
WriteFile
FlushFileBuffers
WideCharToMultiByte
UnhandledExceptionFilter
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetTimeZoneInformation
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
VirtualProtect
GetSystemInfo
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
LoadLibraryA
RtlUnwind
LCMapStringA
LCMapStringW
GetLocaleInfoW
DeleteFileA
SetFileAttributesA
GetFileInformationByHandle
PeekNamedPipe
RemoveDirectoryA
SetEnvironmentVariableW
GetCurrentDirectoryA
GetExitCodeProcess
CreateProcessA

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1665839200a65d025db1cbab5f8050be

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0c:4d:17:73:c9:51:7e:e2:00:e8:40:3f:6a:06:c5:c2Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

0e:fc:f5:83:92:2f:45:9a:bd:bb:04:5c:92:96:13:36:81:a5:95:46Signer

Headers

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 17KB - Virtual size: 312KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0c:4d:17:73:c9:51:7e:e2:00:e8:40:3f:6a:06:c5:c2
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

0e:fc:f5:83:92:2f:45:9a:bd:bb:04:5c:92:96:13:36:81:a5:95:46
Signer

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 17KB - Virtual size: 312KB