b3f4f54c96e72f73e293e5fecec759ab

Sharing

Copy URL

Twitter E-mail

General

Target

b3f4f54c96e72f73e293e5fecec759ab
Size

13.8MB
MD5

b3f4f54c96e72f73e293e5fecec759ab
SHA1

29bfa79b5943c1cb035b55d89a64a4ae6ae9bf5f
SHA256

52fd4f4deb7665937d197b661821cf067b97eaefb16d57f292e9de1783bf9d8d
SHA512

8d58bae5d41b820aa0d5de4ef97326cb36e75643737b2f06d6c932821a23f16ab0c2ec3e8d2d5af7126534f384d985a1a2ac1702223f3e8ef83a376dd67fe91a
SSDEEP

393216:9lfsq5MfkSVNOwxK385sHRqKQ7DXHNprTR0S:vsKqvE38uHRqKcLHhN

Score

1^/10

Malware Config

Signatures

Files

b3f4f54c96e72f73e293e5fecec759ab
.exe windows:4 windows x86 arch:x86

a08d0a3c1d1f4673feb6899c1b3492ce

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

21-05-2010 00:00

Not After

07-08-2012 23:59

Subject

CN=Acunetix Ltd.,OU=Acunetix Development Department,O=Acunetix Ltd.,L=Ta' Xbiex,ST=Malta,C=MT

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:c3:04:f5:a3:ff:71:b4:a2:e7:b0:e8:14:7d:7b:58:7b:82:8b:eb
Signer

Actual PE Digest

b2:c3:04:f5:a3:ff:71:b4:a2:e7:b0:e8:14:7d:7b:58:7b:82:8b:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

kernel32

InitializeCriticalSection
CloseHandle
WaitForMultipleObjects
SetEvent
CreateThread
WaitForSingleObject
ResetEvent
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CompareStringA
CompareStringW
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
GetModuleFileNameW
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
SetFileAttributesA
SetFileAttributesW
RemoveDirectoryA
RemoveDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
GetShortPathNameA
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTempPathA
GetTempFileNameA
FindClose
FindFirstFileA
FindFirstFileW
SetLastError
FindNextFileA
CreateFileA
CreateFileW
GetFileSize
SetFilePointer
ReadFile
SetFileTime
WriteFile
SetEndOfFile
CreateEventA
LeaveCriticalSection
EnterCriticalSection
Sleep
CreateProcessA
GetCommandLineW
GetCurrentThreadId
HeapAlloc
DeleteCriticalSection
TlsSetValue
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize

user32

DestroyWindow
PostMessageA
ShowWindow
MessageBoxA
KillTimer
EndDialog
SendMessageA
GetDlgItem
SetTimer
MessageBoxW
SetWindowTextW
SetWindowTextA
LoadStringW
LoadStringA
CharPrevA
DialogBoxParamA
GetWindowLongA
SetWindowLongA

oleaut32

VariantClear
SysAllocString

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a08d0a3c1d1f4673feb6899c1b3492ce

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

b2:c3:04:f5:a3:ff:71:b4:a2:e7:b0:e8:14:7d:7b:58:7b:82:8b:ebSigner

Headers

File Characteristics

Imports

comctl32

kernel32

user32

oleaut32

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 12KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 3KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

6a:43:bc:c9:22:92:c6:06:2d:36:aa:3f:5e:30:23:90
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

b2:c3:04:f5:a3:ff:71:b4:a2:e7:b0:e8:14:7d:7b:58:7b:82:8b:eb
Signer

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 12KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 3KB