b7200cc90132f6b76011757e57c75424

Sharing

Copy URL Twitter E-mail

General

Target

b7200cc90132f6b76011757e57c75424
Size

65KB
MD5

b7200cc90132f6b76011757e57c75424
SHA1

7206c28bf52c68e10a6c4c4ea0aaec4be98671a5
SHA256

c82324528f6d84d063604907bbcff1e223d587f4ddf8fc7d06319862b24bdaa3
SHA512

31b10c3a9bf0857510d278988716a3c1ce8ea61a949cfeca31edec55cebc0053650eea61bd20315cdb26b5d2cf73c4689e6a84852fb9b556c7513342fe5f3c0e
SSDEEP

1536:zqFLZua4jm/KWahtZbQ+v+PaRkqlt70YdbbSgnGf8PpDX8b:Oma4jmFQt24Ww0CnnGcDXW

Score

1^/10

Malware Config

Signatures

Files

b7200cc90132f6b76011757e57c75424
.exe windows:4 windows x86 arch:x86

c04698a6f4f4745ee0778947351e31b8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EnumPropsExA
GetClassInfoA
SetClipboardData
CreateWindowExA
TileWindows
GetWindowWord
GetScrollBarInfo
InSendMessage
GetNextDlgTabItem
ChangeMenuA
DrawMenuBar
IsMenu
GetKBCodePage
FindWindowExA
GetLastActivePopup
GetIconInfo
GetClassWord
SetMessageExtraInfo
LoadMenuIndirectA
ChildWindowFromPointEx
DdeUnaccessData
BringWindowToTop
PostQuitMessage
VkKeyScanA
DlgDirSelectExA
GetAsyncKeyState
ToUnicodeEx
UnhookWinEvent
AlignRects
CharNextExA
CopyIcon
InsertMenuItemA
LookupIconIdFromDirectory
SetMenuDefaultItem
MessageBoxA
GetSystemMenu
DrawFrame
GetUserObjectSecurity
CharToOemBuffA
SendMessageTimeoutA
EndMenu
wvsprintfA
SetKeyboardState
GetKeyboardLayoutList
UnpackDDElParam
DispatchMessageA
EnumDisplayMonitors
DrawCaption
SetSysColors
GetShellWindow
GetWindowRect
GetMenuItemCount
EnableScrollBar
UpdateWindow
TranslateAccelerator
DdeGetLastError
PackDDElParam

advapi32

GetExplicitEntriesFromAclA
IsTextUnicode
GetNumberOfEventLogRecords
RegSaveKeyA
RegFlushKey
ObjectDeleteAuditAlarmA
BackupEventLogA
CryptContextAddRef
RevertToSelf
GetSidSubAuthority
SetServiceStatus
QueryServiceObjectSecurity
CryptSetKeyParam
CryptGetKeyParam
CryptHashSessionKey
ControlService
CryptGenKey
RegUnLoadKeyA
GetServiceDisplayNameA
GetAclInformation
GetTrusteeTypeA
ChangeServiceConfigA
GetSecurityDescriptorControl
BuildSecurityDescriptorA
RegQueryValueA
RegConnectRegistryA
GetSecurityDescriptorOwner
FindFirstFreeAce
AddAce
SetEntriesInAuditListA
CryptSignHashA
PrivilegeCheck
CryptDestroyHash

kernel32

GetCurrentDirectoryA

Sections

.kze
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yhsz
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sjajm
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qdy
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c04698a6f4f4745ee0778947351e31b8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

user32

advapi32

kernel32

Sections

.kze Size: 22KB - Virtual size: 45KB

.yhsz Size: 5KB - Virtual size: 10KB

.sjajm Size: 1KB - Virtual size: 2KB

.qdy Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.kze
Size: 22KB - Virtual size: 45KB

.yhsz
Size: 5KB - Virtual size: 10KB

.sjajm
Size: 1KB - Virtual size: 2KB

.qdy
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB