b76ce2b716690535efc4b02536ab9b2e

Sharing

Copy URL Twitter E-mail

General

Target

b76ce2b716690535efc4b02536ab9b2e
Size

341KB
MD5

b76ce2b716690535efc4b02536ab9b2e
SHA1

7c922589c68923e67d6b552b3f176ae6975bfcb9
SHA256

12288a024f5d8dfcf13841090f556492f7640cfe79f04b5ea8565ca85925c4f9
SHA512

d40d10fd7934573cb908d0bebc5c1f00f85ff1a0690e33f517c1a3c5b751bc6d2c3cb28390a6732d34363341ae20f38f23a027b34d31d3b08a66dc00d80499c1
SSDEEP

6144:XBieDxTIKIgDLr4Kdyj7XKUTa8m23d7KJqKWMJcjo+eCyGAtOy:x3lEKdI7XHgZQKhJgeCmP

Score

1^/10

Malware Config

Signatures

Files

b76ce2b716690535efc4b02536ab9b2e
.exe windows:4 windows x86 arch:x86

b09b8d880dd8a13a585fee3e6e193ef5

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ea:ac:1b:6d:64:54:0e:f9:32:b3:76:20:7c:3c:79:da:e3:39:8d:0d
Signer

Actual PE Digest

ea:ac:1b:6d:64:54:0e:f9:32:b3:76:20:7c:3c:79:da:e3:39:8d:0d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

selfcert.pdb

Imports

kernel32

GetSystemDefaultLCID
GetACP
GetUserDefaultLangID
GetSystemDefaultUILanguage
GetSystemDefaultLangID
LoadLibraryW
GetModuleFileNameW
GetLocalTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetLastError
lstrlenW
RaiseException
InterlockedExchange
FreeLibrary
LocalAlloc
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetUserDefaultLCID
CompareStringW
IsValidLocale
MulDiv
OutputDebugStringA
LoadLibraryA
MultiByteToWideChar
GetVersion
GetFileAttributesW
GetModuleHandleW
VirtualAlloc
SetLastError
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
VirtualFree
TlsSetValue
DeleteCriticalSection
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
WideCharToMultiByte

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGenKey
CryptDestroyKey

gdi32

SetBkColor
SetTextColor
SetTextAlign
CreatePen
MoveToEx
LineTo
GetTextExtentPoint32W
SelectObject
GetTextMetricsA
GetDeviceCaps
GetObjectA
CreateFontIndirectA
TextOutW
DeleteObject

user32

GetSystemMetrics
LoadBitmapA
SystemParametersInfoA
DialogBoxParamW
EndDialog
GetDlgCtrlID
SetWindowTextW
LoadStringW
MessageBoxW
LoadIconW
SendDlgItemMessageW
GetDlgItem
LoadCursorW
RegisterClassExW
GetDC
GetWindowTextW
SetWindowPos
ReleaseDC
SetFocus
BeginPaint
GetClientRect
GetSysColor
GetFocus
DrawFocusRect
EndPaint
InvalidateRect
DefWindowProcW
GetParent
SendMessageW
GetClassNameA
SendMessageA
IsWindowUnicode
GetWindowLongA
GetWindowLongW
DrawTextA
DrawTextW
SetRectEmpty
MapWindowPoints
GetWindowRect
MoveWindow
IsWindowVisible
GetWindow
IsWindow
CreateWindowExA
CreateDialogIndirectParamA
DestroyWindow
MapDialogRect

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid

msvcrt

_controlfp
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
memmove
_except_handler3
iswspace
_vsnwprintf
_onexit

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 195KB - Virtual size: 296KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mjg
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b09b8d880dd8a13a585fee3e6e193ef5

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

ea:ac:1b:6d:64:54:0e:f9:32:b3:76:20:7c:3c:79:da:e3:39:8d:0dSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

gdi32

user32

ole32

msvcrt

Sections

.text Size: 135KB - Virtual size: 135KB

.data Size: 195KB - Virtual size: 296KB

.rsrc Size: 3KB - Virtual size: 2KB

.mjg Size: - Virtual size: 1B

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

ea:ac:1b:6d:64:54:0e:f9:32:b3:76:20:7c:3c:79:da:e3:39:8d:0d
Signer

.text
Size: 135KB - Virtual size: 135KB

.data
Size: 195KB - Virtual size: 296KB

.rsrc
Size: 3KB - Virtual size: 2KB

.mjg
Size: - Virtual size: 1B