c3bfef28a677e2ef9ce0ecd9de0c6b6f12dbdff083e893a901efe3ec552f2606

Sharing

Copy URL Twitter E-mail

General

Target

c3bfef28a677e2ef9ce0ecd9de0c6b6f12dbdff083e893a901efe3ec552f2606
Size

122KB
MD5

86cd1500d6518cc676cae46ef3f6d416
SHA1

a1c411955f5e67b58219b92b060fbc68c472a4ba
SHA256

c3bfef28a677e2ef9ce0ecd9de0c6b6f12dbdff083e893a901efe3ec552f2606
SHA512

4ef1fcb3f3d4599bd17b4c0fd911e72b329a56ac32f6c609b2ab04c2ef278d788560e8ed6fcb990393692cb9f06c9451563a62fdf958c16731d9a013309d2817
SSDEEP

1536:8hfNx064FEzMViME+/E+AQp4PcEqPTSZgpFeybOxgTYPRzXl8Icy29:83xNWT/E+AQOPM/kgMlXl8/y2

Score

1^/10

Malware Config

Signatures

Files

c3bfef28a677e2ef9ce0ecd9de0c6b6f12dbdff083e893a901efe3ec552f2606
.dll windows:4 windows x86 arch:x86

4f0bfbf6da8bcb1af56bdcd418e0dc0b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/12/2012, 00:00

Not After

05/12/2015, 23:59

Subject

CN=Beijing Watchsmart Technologies Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Security Authentication Business Unit,O=Beijing Watchsmart Technologies Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:f9:5d:4a:11:a6:ad:75:39:3f:b6:ac:38:1c:f1:6d:79:ab:f7:64
Signer

Actual PE Digest

73:f9:5d:4a:11:a6:ad:75:39:3f:b6:ac:38:1c:f1:6d:79:ab:f7:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertCloseStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertSetCertificateContextProperty
CertCreateCertificateContext
CertOpenStore
CertFindCertificateInStore
CertDeleteCertificateFromStore
CryptDecodeObject
CertGetIntendedKeyUsage

ole32

CoTaskMemFree
CoTaskMemAlloc

kernel32

CloseHandle
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
CompareStringA
CompareStringW

Exports

Exports

Compute_d
WDAlgPriKeyToCard
WDAlgPriKeyToCardPubKey
WDAlgPubKeyToCard
WDBlockDecrypt
WDBlockDecrypt_CBC
WDBlockEncrypt
WDBlockEncrypt_CBC
WDCardPriKeyToAlg
WDCardPubKeyToAlg
WDComputeDigest
WDDelCertOnMyStore
WDGetCertUsage
WDGetDatefromCert
WDGetIDFromCert
WDGetIssuerfromCert
WDGetSubjectfromCert
WDIsCertOnMyStore
WDPrivateKeyBlobToAlg
WDPublicKeyBlobToAlg
WDRSAGenerateKeys
WDRSAPrivateDecrypt
WDRSAPrivateEncrypt
WDRSAPublicDecrypt
WDRSAPublicEncrypt
WDRSAPublicEncryptPKCS1
WDRSASignData
WDRSASignPKCSBlock
WDRSAVerifySign
WDRSAVerifySign1
WDRSAVerifySignedPKCSBlock
WDRegCertToMyStore
WDRegRootCert
WDRegUserCert
WDRevMemCopy
WDSCardEncodeSignData
WDSCardEncodeSignData1
WDStreamDecrypt
WDStreamEncrypt

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f0bfbf6da8bcb1af56bdcd418e0dc0b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

73:f9:5d:4a:11:a6:ad:75:39:3f:b6:ac:38:1c:f1:6d:79:ab:f7:64Signer

Headers

File Characteristics

Imports

crypt32

ole32

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 20KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:27:62:20:e4:52:df:17:67:07:d5:54:be:10:ad:7f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

73:f9:5d:4a:11:a6:ad:75:39:3f:b6:ac:38:1c:f1:6d:79:ab:f7:64
Signer

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 20KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB