388a0a3a53994a2abbf9a732b9e2cdefdaaecb4b5a2059a769f7a51ab3a104b5

Sharing

Copy URL

Twitter E-mail

General

Target

388a0a3a53994a2abbf9a732b9e2cdefdaaecb4b5a2059a769f7a51ab3a104b5
Size

6.5MB
MD5

edc17f3e8864ce90eab82d146ee107d1
SHA1

9dc3f312e77f7d3c1da20decbc02df1286e8bb03
SHA256

388a0a3a53994a2abbf9a732b9e2cdefdaaecb4b5a2059a769f7a51ab3a104b5
SHA512

db0423f2153adee64456c805568710ccc2709a044f43c0bce25d4729388a8352abe84e8c98099b0c3a5b6fe37f67efbcc24c01daf32c6bcd86dec98b2c4575c4
SSDEEP

98304:zIbYNFqAK0LrfS7qfb81N+NxRjRPGGgFidOBznbumTfLJE:Zg0vfS7qfbqNgRjkA2znbueLJE

Score

1^/10

Malware Config

Signatures

Files

388a0a3a53994a2abbf9a732b9e2cdefdaaecb4b5a2059a769f7a51ab3a104b5
.dll windows:6 windows x86 arch:x86

c3774977cc8f28d205186ac0790c07d6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:8e:0b:96:3a:4d:b0:82:31:f4:9f:66:4a:f8:3e:5b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/10/2016, 00:00

Not After

06/10/2018, 23:59

Subject

CN=Hewlett Packard,OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01/11/2017, 19:18

Not After

01/11/2018, 19:18

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:94:9a:e5:2e:89:b5:94:43:96:2f:c5:32:d9:39:03:b7:e9:b8:be:56:37:56:50:9b:11:45:62:08:63:11:68
Signer

Actual PE Digest

6a:94:9a:e5:2e:89:b5:94:43:96:2f:c5:32:d9:39:03:b7:e9:b8:be:56:37:56:50:9b:11:45:62:08:63:11:68

Digest Algorithm

sha256

PE Digest Matches

false

ad:b8:c9:af:00:2a:1c:e5:c9:a9:0e:1d:35:e4:a7:cc:8c:14:c9:8d
Signer

Actual PE Digest

ad:b8:c9:af:00:2a:1c:e5:c9:a9:0e:1d:35:e4:a7:cc:8c:14:c9:8d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Depot\Orphans\drv1329\Trunk\Build\v110\Win32\Release\v4.RAST Print Pipeline Filter\mt4r.pdb

Imports

usp10

ScriptItemize
ScriptLayout
ScriptShape
ScriptPlace
ScriptIsComplex
ScriptFreeCache

t2embed

TTEmbedFont

kernel32

Sleep
InterlockedIncrement
CreateEventW
GetCurrentProcessId
GlobalMemoryStatusEx
WaitForSingleObject
ResetEvent
SetEvent
GetLastError
SetLastError
CloseHandle
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
WriteConsoleW
SetFilePointerEx
ReadConsoleW
SetEnvironmentVariableA
SetEndOfFile
LoadResource
GetConsoleMode
GetConsoleCP
InterlockedExchangeAdd
CreateFileA
SetFilePointer
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
InterlockedCompareExchange
FreeLibrary
GetProcAddress
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTimeZoneInformation
CreateFileW
FindClose
FindNextFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
FindFirstFileExW
GetSystemInfo
GetSystemDirectoryW
GetNativeSystemInfo
GetModuleFileNameW
GetFileAttributesW
LoadLibraryExW
LockResource
FindResourceW
DeleteFileW
ReadFile
GetTempPathW
SizeofResource
GetLocalTime
FileTimeToDosDateTime
SystemTimeToFileTime
FreeResource
FindResourceA
SetThreadPriority
GetThreadPriority
GetExitCodeThread
WaitForMultipleObjects
InterlockedExchange
RaiseException
RtlUnwind
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
ExitThread
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
OutputDebugStringW
CompareStringW
LCMapStringW

gdi32

DeleteObject
SelectObject
GetGlyphOutlineW
EnumFontFamiliesExW
DeleteDC
CreateFontIndirectW
CreateCompatibleDC

winspool.drv

SetPrinterDataW
GetPrinterDriverW
ClosePrinter
OpenPrinterW
GetPrinterDataW

advapi32

RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey
RevertToSelf
SetThreadToken
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW

oleaut32

VariantClear
VariantInit

ole32

CoCreateGuid

Exports

Exports

DllCanUnloadNow
DllGetClassObject
ImxAlloc
ImxCacheFlush
ImxCmmDeinit
ImxCmmInit
ImxCmmProfileDestroy
ImxCmmProfileLoad
ImxCmmProfileQuery
ImxCmmWorldApplyColor
ImxCmmWorldApplyColorEx
ImxCmmWorldApplyImage
ImxCmmWorldApplyImageEx
ImxCmmWorldCreate
ImxCmmWorldCreateEx
ImxCmmWorldDestroy
ImxCmmWorldLoad
ImxCpuCapsGet
ImxErrDiffConfigure
ImxErrDiffCreate
ImxErrDiffDestroy
ImxErrDiffImage
ImxErrDiffLoadConfig
ImxFree
ImxHalftoneCreate
ImxHalftoneDestroy
ImxHalftoneLoad
ImxHalftoneTextureColor
ImxHalftoneTextureImage
ImxJBIGEncoderDeinit
ImxJBIGEncoderInit
ImxJBIGImageBandAdd
ImxJBIGImageBegin
ImxJBIGImageEnd
ImxJBIGImageFlush
ImxJobDataWrite
ImxLogEvent
ImxTextureAlloc
ImxTextureFree
PpfTestProcess

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 844KB - Virtual size: 843KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3774977cc8f28d205186ac0790c07d6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

73:8e:0b:96:3a:4d:b0:82:31:f4:9f:66:4a:f8:3e:5bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

6a:94:9a:e5:2e:89:b5:94:43:96:2f:c5:32:d9:39:03:b7:e9:b8:be:56:37:56:50:9b:11:45:62:08:63:11:68Signer

ad:b8:c9:af:00:2a:1c:e5:c9:a9:0e:1d:35:e4:a7:cc:8c:14:c9:8dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

usp10

t2embed

kernel32

gdi32

winspool.drv

advapi32

oleaut32

ole32

Exports

Exports

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 844KB - Virtual size: 843KB

.data Size: 96KB - Virtual size: 106KB

.rsrc Size: 673KB - Virtual size: 673KB

.reloc Size: 235KB - Virtual size: 235KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

73:8e:0b:96:3a:4d:b0:82:31:f4:9f:66:4a:f8:3e:5b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

33:00:00:00:58:4c:08:4c:80:a1:c8:d5:61:00:00:00:00:00:58
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

6a:94:9a:e5:2e:89:b5:94:43:96:2f:c5:32:d9:39:03:b7:e9:b8:be:56:37:56:50:9b:11:45:62:08:63:11:68
Signer

ad:b8:c9:af:00:2a:1c:e5:c9:a9:0e:1d:35:e4:a7:cc:8c:14:c9:8d
Signer

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 844KB - Virtual size: 843KB

.data
Size: 96KB - Virtual size: 106KB

.rsrc
Size: 673KB - Virtual size: 673KB

.reloc
Size: 235KB - Virtual size: 235KB