aca6115d9a690544cf9258194d718be5

Sharing

Copy URL Twitter E-mail

General

Target

aca6115d9a690544cf9258194d718be5
Size

93KB
MD5

aca6115d9a690544cf9258194d718be5
SHA1

41e6f94a3ba9cf1e92c04638d3e1287fbe01e3c3
SHA256

f2b0e50501d77d43b60ddba537145dc3da5470fb0126b809ccf712ae30ce2e66
SHA512

e4120627d1aa0266166a36e39c31fab2d819e278058d1780168a14e2d53e0bb0f54c2cc62dafd799b07ee93b82504b00cf9c2e49e6071f557170c6aa9bb9d5cb
SSDEEP

1536:VcVIWrJ4sG4hyIaUCNniuoAWLDgdvmODp7Kpfcelzno6h:VwIWysgIaUCNnilgdvmODpqfceVnXh

Score

1^/10

Malware Config

Signatures

Files

aca6115d9a690544cf9258194d718be5
.dll regsvr32 windows:4 windows x86 arch:x86

7df2bfacd57e4dafccebb7c5192e0239

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:76:08:fc:40:f3:f9:2d:aa:a2:f6:27:23:44:44:41
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

14/07/2006, 00:00

Not After

03/08/2007, 23:59

Subject

CN=WinSoftware Corporation\, Inc.,OU=ADMINISTRATIVE DEPARTMENT,O=WinSoftware Corporation\, Inc.,L=Roseau,ST=Roseau,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\_vss\Products\WinLine\WinAntiVirusPro2007\Wav6com\Wav6com\WAV6COM.pdb

Imports

kernel32

CloseHandle
OpenMutexA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
ResetEvent
WaitForSingleObject
SetEvent
lstrcpynW
WinExec
CreateEventA
GlobalUnlock
SetCurrentDirectoryA
GetCurrentDirectoryA
lstrcatA
lstrcpyA
GlobalLock
Sleep
CreateThread
LocalFree
OpenFileMappingA
OpenEventA
GetCurrentProcess
GetVersion
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateProcessA
SetFilePointer
CreateFileA
SetFileAttributesA
GetFileAttributesA
GetCurrentProcessId
GetCurrentThreadId
GetProcAddress
LoadLibraryA
FlushFileBuffers
WriteFile
GetSystemTime
SetErrorMode
SetUnhandledExceptionFilter
GetPrivateProfileStringA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
DebugBreak
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ExitProcess
LocalAlloc

user32

SetMenuItemBitmaps
LoadBitmapA
InsertMenuA
MessageBoxA
ExitWindowsEx
PeekMessageA
DispatchMessageA
CharNextA
LoadStringA
TranslateMessage

ole32

CoTaskMemRealloc
ReleaseStgMedium
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

shell32

DragQueryFileA

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocString
VariantInit
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysFreeString

shlwapi

PathFindExtensionA

msvcp71

?_Nomemory@std@@YAXXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

msvcr71

memmove
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_callnewh
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
_vsnprintf
strrchr
memset
_snprintf
wcsncpy
fopen
__security_error_handler
fgets
fclose
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_mbsrchr
realloc
??3@YAXPAX@Z
_purecall
__CxxFrameHandler
malloc
free
_resetstkoflw
_except_handler3
_mbsicmp
_CxxThrowException
??_V@YAXPAX@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7df2bfacd57e4dafccebb7c5192e0239

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

54:76:08:fc:40:f3:f9:2d:aa:a2:f6:27:23:44:44:41Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

shell32

oleaut32

shlwapi

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 8KB - Virtual size: 6KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

54:76:08:fc:40:f3:f9:2d:aa:a2:f6:27:23:44:44:41
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 8KB - Virtual size: 6KB