acb648c6665f6f08c43d0fb4878f03d3

Sharing

Copy URL Twitter E-mail

General

Target

acb648c6665f6f08c43d0fb4878f03d3
Size

65KB
MD5

acb648c6665f6f08c43d0fb4878f03d3
SHA1

771e666966423a7b28359d04a25417715205af03
SHA256

dabf1427a891e3c9097385c714ff31e5e6b0251d941a276600f32771fdb7bfc0
SHA512

1ad792e8feb5f3183231d2ee582a63c683d4f54272014d95e492d7691342d1690ef231accf3f734272975ee0ca5ff2707849477f5c1f870536fd6efffc03629e
SSDEEP

1536:OSR/4MzoQl74zoQioT2I1GjQpE+ktNPGGaRmIzh4a0UfxJDmTGb:Ok4Mzoy4UQioypjQEv+GumIN4a0UpJDN

Score

1^/10

Malware Config

Signatures

Files

acb648c6665f6f08c43d0fb4878f03d3
.exe windows:4 windows x86 arch:x86

fcabc844cc34363978c5547a8458d6fc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptHashSessionKey
RegQueryValueA
GetTrusteeTypeA
RegUnLoadKeyA
RegOpenKeyA
ControlService
BackupEventLogA
PrivilegeCheck
RevertToSelf
GetSidSubAuthority
CopySid
IsTextUnicode
RegConnectRegistryA
CryptGenKey
GetSecurityDescriptorOwner
ChangeServiceConfigA
ObjectDeleteAuditAlarmA
AccessCheck
CryptGetKeyParam
CryptSignHashA
SetEntriesInAuditListA
RegDeleteValueA
AllocateAndInitializeSid
OpenEventLogA
InitializeAcl
CryptEncrypt
RegSaveKeyA
BuildSecurityDescriptorA
GetMultipleTrusteeA
GetExplicitEntriesFromAclA
QueryServiceObjectSecurity
DeregisterEventSource
SetServiceStatus
GetServiceDisplayNameA

user32

DdeUnaccessData
SetWindowContextHelpId
CascadeWindows
DdeQueryStringA
RedrawWindow
SwitchToThisWindow
MonitorFromPoint
UpdateWindow
GetKeyboardLayoutList
CreateWindowExA
GetIconInfo
RemovePropA
DdeEnableCallback
FreeDDElParam
EnableScrollBar
EndMenu
VkKeyScanA
SendIMEMessageExA
IsMenu
GetScrollBarInfo
GetMessagePos
CreateDialogParamA
FindWindowExA
IsDialogMessage
SetDoubleClickTime
ChildWindowFromPointEx
DdeGetLastError
DdeClientTransaction
SetCaretBlinkTime
RegisterWindowMessageA
GetComboBoxInfo
SetKeyboardState
GetUserObjectSecurity
MessageBoxA
GetDC
SetClipboardData
SetDebugErrorLevel
PackDDElParam
LoadAcceleratorsA
GetMenuCheckMarkDimensions
SetMenuDefaultItem
PostQuitMessage
ShowWindowAsync
CharToOemBuffA
GetWindowWord
CloseDesktop
LoadMenuIndirectA
GetNextDlgTabItem
GetProcessDefaultLayout
GetMenuState
RegisterDeviceNotificationA
InsertMenuItemA
CharNextExA
DrawCaption
GetDoubleClickTime
SetScrollInfo

kernel32

SetConsoleTextAttribute

Sections

.zit
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lyfcz
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.whs
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.chuns
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcabc844cc34363978c5547a8458d6fc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.zit Size: 22KB - Virtual size: 45KB

.lyfcz Size: 5KB - Virtual size: 10KB

.whs Size: 1KB - Virtual size: 2KB

.chuns Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.zit
Size: 22KB - Virtual size: 45KB

.lyfcz
Size: 5KB - Virtual size: 10KB

.whs
Size: 1KB - Virtual size: 2KB

.chuns
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB