02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

Sharing

Copy URL Twitter E-mail

General

Target
02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0
Size 1.1MB
Sample240309-wkpcvaeb57
SHA256 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0
MD5 3f94f4455055fe839d283c610a76dc13
SHA1 dfceeec8fe6a1c9e6ef01c005fd2f426deb3bf30
SHA512 8dec34239b6f25228ddba27c561bea2152a82aeccb6d95d1c030bb304a081eae1f4b2cc44641aa8fc83e0d26eb3ff22747a4602927ec6c5c5ae2c1ac6c42814f
SSDEEP 24576:9BLQFiYTOndhEnaHNOUUyuNSyN5DajySBkaHRx1:PEF3qn6aHuyCSyTDvSSWRx1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/FirefoxHandler.dll
unpack002/out.upx

File Explorer

02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

.exe 1.1MB
$PLUGINSDIR/$_286_/ProxyInstaller.exe

.exe 79KB
$PLUGINSDIR/$_287_/BI.exe

.exe 75KB
$PLUGINSDIR/$_288_/DownloadAcc.exe

.exe 168KB
$PLUGINSDIR/BunndleOfferManager.dll

.dll 339KB
$PLUGINSDIR/DM_loader.gif

.gif 3KB
$PLUGINSDIR/Failed.htm

.js 6KB
$PLUGINSDIR/FirefoxHandler.dll

.dll 36KB
$PLUGINSDIR/OCSetupHlp.dll

.dll 842KB
$PLUGINSDIR/System.dll

.dll 17KB
$PLUGINSDIR/execDos.dll

.dll 11KB
$PLUGINSDIR/icon.png

.png 3KB
$PLUGINSDIR/inetc.dll

.dll 29KB
$PLUGINSDIR/nsArray.dll

.dll 12KB
out.upx

.dll 10KB
$PLUGINSDIR/webapphost.dll

.dll 760KB
$PLUGINSDIR/xml.dll

.dll 124KB

02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0
MD5 3f94f4455055fe839d283c610a76dc13
SHA1 dfceeec8fe6a1c9e6ef01c005fd2f426deb3bf30
SHA512 8dec34239b6f25228ddba27c561bea2152a82aeccb6d95d1c030bb304a081eae1f4b2cc44641aa8fc83e0d26eb3ff22747a4602927ec6c5c5ae2c1ac6c42814f
SSDEEP 24576:9BLQFiYTOndhEnaHNOUUyuNSyN5DajySBkaHRx1:PEF3qn6aHuyCSyTDvSSWRx1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d4:ee:f7:47:78:7c:5d:cd:7b:35:7d:a2:75:01:25:10:75:e3:5d:b6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Oct 26, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/$_286_/ProxyInstaller.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 85ddc4c07c608e1870680c5da98562ddde119b5acf08a2cb8b38e21a31475199
MD5 daa3ae34ea16a223ff55951400871e1b
SHA1 05a84be13481fcb8b5294941bd1fef6b77dca676
SHA512 ba623a0b64b85f6f844642dd8d2ce65d22459a4ee5e012b091b4ade0e39e4e60ab8f6fed162dd37916a6e277f518a694ccf46256ead75534c6efc685c8648da9
SSDEEP 1536:nVdePelp2Xy+tuQOzOYE5aXPngF8Vd5/ZAaiz67lEpd4:wweqOYEUXPnn5/Zfie7Gd4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ba:8e:d8:02:c7:73:d5:0c:f4:c5:f1:f0:03:e8:a8:e0:70:a9:4d:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Aug 25, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/$_287_/BI.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 fe0af5e14e37fd0b642aa08495ae63a4ed441c92909dfd7a8a25a050b5ed097e
MD5 74cb7b0a801435c552d3bfd1517491a1
SHA1 a46e6e1b524a608eed9e81fd7e102e280b2e95c1
SHA512 fce908fce3e9f84740280af53813bcbed29abf3f976a2b6ba1c88a722877ce020241b36bd0cbbb4f793df9d262b413ad30198bb1e8345128b0ac5857209b3260
SSDEEP 1536:wVdePelp2Xy+tuQOzOYE5aXPni9F8yggK0acQ2XzDv6:rweqOYEUXPni/v6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

46:7c:8e:22:35:d8:a0:03:97:54:60:de:b8:2e:85:27:db:fc:b5:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Aug 25, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/$_288_/DownloadAcc.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 b67158b12cf9616d9b22d0d557994ba2d56280352043fa17544e4f8e2cccc1b2
MD5 6a09cf3008e183e4c64f710416e4d9bd
SHA1 cd633b3b48484e3cb390f650e32ff1d3055854af
SHA512 93201474c6888acc0e0f796f06f02626064abbb7b9770715e17ef9a87a7fb8d951b019d7d9b9bb14ccf5da2368f5fe11b29a11e530baae1a89115e874684e77a
SSDEEP 3072:QweqOYEUXPn30DPFxFA/YcIaY0rFIMcCxOP+IxjkE8v1XRc:BEUXcbF7A/pHzrFIMd8+8jkEgRc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

2a:bd:90:a6:c5:3d:4d:ca:23:87:67:66:b3:59:96:ae:da:76:90:b0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Aug 25, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/BunndleOfferManager.dll

IMPHASH f5aee842c9c87c94e859ca5f4892d62d
SHA256 f65e438aa098d9e5742821763d355939724e923ea418ca7443439e7a409ba808
MD5 f09bb97b9b8e2048fe562e78f761a0b7
SHA1 a7243e5768aea8717b22a6c7f0b144c5876dfe0f
SHA512 430f4aa2945e366df3240ef96be3a1d0868383cb3a950cfe0b6fbf5fcd9cf239430900ae79bed3f55e15a50f365c8b021aa82c069826e96a355c8a7cfde66974
SSDEEP 6144:7yv0RMsT8lzZZOC4+OeO+OeN7VBBhhBBrXLsbg+vwzlTMw/8ZL8ITe:cYrAZOC4+OeO+OeNhBBhhBBzLsbg+vwd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

93:16:44:5e:47:91:7a:84:3f:5f:f5:77:24:12:df:a6:cd:8a:d2:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bunndle\, Inc.,O=Bunndle\, Inc.,L=Palo Alto,ST=CA,C=US

Chains

Mar 6, 2024

Minor OS version

Major OS version

Entry point

141477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Bunndle\client\Release\BunndleOfferManager.pdb

secur32

GetUserNameExW

netapi32

NetUserGetLocalGroups NetApiBufferFree

rpcrt4

NdrCStdStubBuffer_Release CStdStubBuffer_Connect NdrCStdStubBuffer2_Release NdrDllGetClassObject CStdStubBuffer_AddRef IUnknown_QueryInterface_Proxy NdrOleFree NdrStubForwardingFunction NdrOleAllocate CStdStubBuffer_CountRefs NdrStubCall2 IUnknown_Release_Proxy CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke UuidCreate

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpCrackUrl

kernel32

SetStdHandle GetConsoleMode GetConsoleCP EnterCriticalSection LeaveCriticalSection FreeLibrary lstrlenW GetProcAddress GetModuleHandleW lstrcmpiW RaiseException GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InterlockedDecrement InterlockedIncrement CloseHandle IsDebuggerPresent Sleep DebugBreak GetCurrentProcessId CreateFileW CreateDirectoryW MulDiv GetThreadLocale SetThreadLocale DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError GetCurrentProcess FlushInstructionCache FindFirstFileW FindNextFileW FindClose GetDiskFreeSpaceExW GlobalMemoryStatusEx FileTimeToSystemTime ReadFile SetFilePointerEx GetFileInformationByHandle LockResource WriteConsoleW GlobalLock GlobalUnlock lstrlenA lstrcmpW GetSystemTimeAsFileTime WaitForSingleObject CreateProcessW CopyFileW MoveFileExW DeleteFileW LoadLibraryW CreateThread GlobalHandle GlobalFree InterlockedCompareExchange SetEvent InitializeCriticalSection CreateEventW OpenProcess GetExitCodeProcess SystemTimeToFileTime CreatePipe SetHandleInformation GetStdHandle WideCharToMultiByte FindResourceExW FormatMessageW GetVersionExW GetSystemInfo GetUserDefaultLCID GetLocaleInfoW GetSystemDirectoryW GetTempPathW GetEnvironmentVariableW ExpandEnvironmentStringsW GetShortPathNameW GetLocalTime WriteFile GetFileAttributesW QueryPerformanceCounter GetTickCount RtlUnwind SetFilePointer FlushFileBuffers GetProcessHeap InterlockedPushEntrySList VirtualFree VirtualAlloc GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount LCMapStringW IsProcessorFeaturePresent GetStringTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCommandLineA IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize ExitProcess HeapDestroy HeapCreate SetUnhandledExceptionFilter UnhandledExceptionFilter HeapFree HeapAlloc EncodePointer DecodePointer HeapReAlloc InterlockedPopEntrySList GlobalAlloc TerminateProcess

user32

InvalidateRect GetKeyState ReleaseDC GetDC PtInRect IsWindow DestroyWindow UnionRect SetWindowPos SetWindowRgn OffsetRect EqualRect IntersectRect EndPaint GetClientRect BeginPaint GetFocus IsChild ShowWindow RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW SetWindowLongW GetWindowLongW DefWindowProcW LoadStringW GetDlgItem EnableWindow GetDesktopWindow MapWindowPoints GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow SetActiveWindow SetForegroundWindow MoveWindow EndDialog SetWindowContextHelpId MapDialogRect SendDlgItemMessageW DestroyAcceleratorTable DialogBoxIndirectParamW GetActiveWindow RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetFocus SendMessageW GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW ClientToScreen UnregisterClassA SetCapture ReleaseCapture FillRect InvalidateRgn SetWindowTextW CharNextW CallWindowProcW ScreenToClient

gdi32

CreateSolidBrush CreateCompatibleDC TextOutW CreateCompatibleBitmap SelectObject DeleteObject BitBlt GetStockObject GetObjectW CreateRectRgnIndirect CreateDCW LPtoDP SaveDC SetMapMode SetWindowOrgEx SetViewportOrgEx GetDeviceCaps SetTextAlign RestoreDC DeleteDC

advapi32

RegEnumKeyW RegEnumValueW RegQueryValueExW FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

SHGetFolderPathW

ole32

StringFromGUID2 OleSaveToStream WriteClassStm ReadClassStm CoCreateInstance CoCreateGuid ProgIDFromCLSID OleRegGetUserType OleRegEnumVerbs CoUninitialize CoInitializeEx CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal OleUninitialize OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize CoRegisterClassObject CoRegisterPSClsid CoRevokeClassObject CreateOleAdviseHolder CoDisconnectObject OleRegGetMiscStatus

oleaut32

UnRegisterTypeLi BSTR_UserSize VARIANT_UserSize VARIANT_UserUnmarshal BSTR_UserMarshal RevokeActiveObject RegisterActiveObject GetActiveObject OleCreateFontIndirect GetErrorInfo SafeArrayLock SafeArrayRedim SafeArrayUnlock SafeArrayDestroy SafeArrayCreate CreateErrorInfo SafeArrayGetLBound SafeArrayGetUBound SetErrorInfo VARIANT_UserMarshal RegisterTypeLi SysAllocStringByteLen DispCallFunc OleCreatePropertyFrame SysStringByteLen LoadTypeLi LoadRegTypeLi SysStringLen SysAllocStringLen VariantChangeType VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString BSTR_UserFree VARIANT_UserFree BSTR_UserUnmarshal

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/FirefoxHandler.dll

IMPHASH 0b0bd9a74b81c20dd1ca10dffb1e2ff5
SHA256 6eef17cfaa4e4420f41a5e80c2fc49f4c1b8e44c8b648982c5cf5311fbd91dca
MD5 297f686666aab3309cabc430199dfd10
SHA1 0e57ded3db82a5c6de284a6fa93cc38bb8834ac9
SHA512 39ba6a6523df27c9e4e5d764a6ddde8129bbf80800b4b660354307d2601e84ed0783a6c035c5c1411a12177f95617db43d7ae2f3b0a2f5389d4d2681276196ac
SSDEEP 768:J92TwvrKHG8lvQdxk/+IX19elUSrMQLisawIUqoULdAOfK+2+ZI:X2kvkyxkWIF9elU1+ALWOfZZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\SmartBar\DevelopmentTools\FF\FirefoxHandler\Release\FirefoxHandler.pdb

psapi

EnumProcessModules GetModuleBaseNameW GetModuleFileNameExW EnumProcesses

kernel32

CopyFileW CreateFileW GetFileSize CloseHandle GetDiskFreeSpaceExW ReadFile MultiByteToWideChar WideCharToMultiByte OpenProcess DeleteFileW TerminateProcess Sleep CreateProcessW LoadLibraryA GetProcAddress GetVersionExW GetTempPathW lstrcpynW GlobalAlloc GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcess InterlockedCompareExchange InterlockedExchange DecodePointer UnhandledExceptionFilter EncodePointer

user32

GetWindowThreadProcessId FindWindowW CharUpperW wsprintfW

advapi32

RegCloseKey RegOpenKeyExW DuplicateTokenEx OpenProcessToken RegQueryValueExW

shlwapi

PathFileExistsW

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common __clean_type_info_names_internal memset memcpy _CxxThrowException __CxxFrameHandler3 ??3@YAXPAX@Z ??0exception@std@@QAE@ABV01@@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBD@Z ??2@YAPAXI@Z memmove _wfsopen fwrite fflush fclose ??_V@YAXPAX@Z fseek ftell rewind fread malloc realloc free _wtoi calloc iswspace _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook

$PLUGINSDIR/OCSetupHlp.dll

IMPHASH bcc9fc26368b3f6e1a5258f41bed8ac8
SHA256 2c028b33da28063270a7c4f7f8affafdea63a766627178cb166253f14f3a4c4e
MD5 5b8d0d2cd9d60412262f166e15357961
SHA1 cab78c31f513d1f2bf43205af88a3bbfab11b1ca
SHA512 e4a05b5479c1b9edc49d36356e1a7e212cc100f11d600bae8d6303a6c1e1ed329c10eaa1d5228860d3a7999147bc8c920c07f3acaf197f1b8df955a583c7230f
SSDEEP 12288:b+wnK6z+X9XgFnDgQlOpmtZkYZYiWRREaQDEK/8MoSTLyrQCT30:iTdwZDgQ4p2ZkCYHtQIK/8M7TLyrQe0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

dc:e0:4f:f2:18:36:46:37:ce:11:b5:05:e9:2b:e7:3d:77:5a:f8:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Chains

Mar 29, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Serial Number

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2011 - Mar 14, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

446515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetErrorMode GetFileAttributesW CreateFileW GetFileSize GetCurrentProcessId GetEnvironmentVariableW FindFirstFileW FindNextFileW FindClose ReadFile GetTimeZoneInformation GetTempPathW DeleteFileW WriteFile ProcessIdToSessionId HeapAlloc GetProcessHeap HeapFree CreateDirectoryW ExpandEnvironmentStringsW WaitForSingleObject OutputDebugStringW CreateMutexW OpenMutexW ReleaseMutex UnmapViewOfFile MapViewOfFileEx CreateFileMappingW OpenFileMappingW GetShortPathNameW SetFilePointer CreateEventW GlobalFree ResumeThread FreeResource SetEvent ResetEvent GetTickCount GetCurrentThread CreateProcessW MoveFileExW OpenEventW lstrlenA WideCharToMultiByte SetEnvironmentVariableW SetEnvironmentVariableA CompareStringW CompareStringA GetExitCodeProcess GetStringTypeW GetStringTypeA GetLocaleInfoA GetFullPathNameW SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA DeleteCriticalSection CreateFileA lstrcmpiW GetProcAddress PeekNamedPipe GetFileInformationByHandle GetFullPathNameA FlushFileBuffers GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount LCMapStringA ExitProcess LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle HeapCreate RtlUnwind GetDriveTypeW GetFileType GetConsoleMode GetConsoleCP FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess ExitThread GetSystemTimeAsFileTime HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange FindResourceA GlobalMemoryStatusEx GetDiskFreeSpaceExW GetFileAttributesExW CompareFileTime GetVersion GetTempFileNameW ReleaseSemaphore InitializeCriticalSectionAndSpinCount CreateSemaphoreW GetSystemInfo GetVersionExW FileTimeToSystemTime GetSystemDefaultLCID FormatMessageA ExpandEnvironmentStringsA SleepEx GetThreadLocale GetLastError SetThreadLocale MultiByteToWideChar GetModuleFileNameW InitializeCriticalSection GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadLibraryExW GlobalUnlock GlobalLock GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot CloseHandle OpenProcess GetUserDefaultUILanguage GetLocaleInfoW FreeLibrary LoadLibraryW MulDiv lstrlenW lstrcpynW SetLastError RaiseException Sleep CreateThread FindResourceExW FindResourceW LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FlushInstructionCache GetCurrentDirectoryA GetCurrentProcess

psapi

GetProcessImageFileNameW EnumProcesses

ws2_32

select WSACleanup WSAStartup closesocket WSAGetLastError socket recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect WSASetLastError __WSAFDIsSet gethostname freeaddrinfo ioctlsocket getaddrinfo

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

DestroyMenu SetActiveWindow DestroyCursor NotifyWinEvent FindWindowW PeekMessageW TrackPopupMenu ReleaseCapture DrawFocusRect UnregisterClassA GetCursor SetCursor SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow LoadCursorW IsWindow GetDesktopWindow MsgWaitForMultipleObjects GetWindow MonitorFromWindow GetSysColor GetUpdateRect SetRect CreateDialogParamW GetSystemMetrics CallNextHookEx UnhookWindowsHookEx SystemParametersInfoW SetWindowsHookExW DrawIconEx GetIconInfo SetMenuItemInfoW IsWindowVisible PostQuitMessage KillTimer SetTimer PostMessageW GetWindowTextLengthW GetWindowTextW EnumChildWindows EnumWindows RegisterClassExW GetClassInfoExW CreateWindowExW GetSysColorBrush GetDC SendMessageW SetFocus TrackMouseEvent InvalidateRect GetClientRect BeginPaint EndPaint GetCursorPos SetForegroundWindow SetDlgItemTextW SendDlgItemMessageW EnableMenuItem GetSystemMenu EnableWindow LoadImageW MessageBoxW MapWindowPoints GetParent CharNextW GetAsyncKeyState CopyRect GetMonitorInfoW MonitorFromPoint GetForegroundWindow SetClipboardData CloseClipboard EmptyClipboard OpenClipboard GetWindowThreadProcessId SetWindowPos SetWindowTextW LoadIconW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW GetDlgItem ShowWindow ReleaseDC DrawTextW FillRect MoveWindow GetWindowRect GetAncestor PtInRect ScreenToClient

gdi32

SelectObject SetBkMode SetTextColor GetDeviceCaps DPtoLP CreateFontIndirectW CreateSolidBrush SetViewportOrgEx GetTextExtentPoint32W GetObjectW CreatePatternBrush SetBkColor ExtTextOutW CreateDIBSection GdiFlush DeleteDC GetStockObject CreateCompatibleBitmap DeleteObject CreateCompatibleDC BitBlt

advapi32

RegCreateKeyExW RegOpenKeyExW RegCloseKey RegEnumKeyW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx LookupAccountSidW GetUserNameW CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW

shell32

Shell_NotifyIconW SHGetFolderPathW ShellExecuteW

ole32

CoInitializeSecurity CreateStreamOnHGlobal CLSIDFromProgID CoInitialize CoUninitialize CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid CoTaskMemAlloc StringFromGUID2 CoTaskMemRealloc

oleaut32

LoadTypeLi UnRegisterTypeLi VarUI4FromStr RegisterTypeLi SysFreeString SysStringLen VariantClear SysAllocStringLen VariantChangeType LoadRegTypeLi OleLoadPicture SysAllocString VariantInit

comctl32

InitCommonControlsEx

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipLoadImageFromFile GdipCloneImage GdipDrawImagePointRectI GdipDrawImageRectRect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW InternetGetConnectedStateExW

DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer OCPRD1162OpenCandy1 OCPRD1162OpenCandy10 OCPRD1162OpenCandy11 OCPRD1162OpenCandy12 OCPRD1162OpenCandy13 OCPRD1162OpenCandy14 OCPRD1162OpenCandy15 OCPRD1162OpenCandy16 OCPRD1162OpenCandy17 OCPRD1162OpenCandy18 OCPRD1162OpenCandy19 OCPRD1162OpenCandy20 OCPRD1162OpenCandy21 OCPRD1162OpenCandy22 OCPRD1162OpenCandy23 OCPRD1162OpenCandy24 OCPRD1162OpenCandy29 OCPRD1162OpenCandy30 OCPRD1162OpenCandy31 OCPRD1162OpenCandy32 OCPRD1162OpenCandy33 OCPRD1162OpenCandy34 OCPRD1162OpenCandy35 OCPRD1162OpenCandy36 OCPRD1162OpenCandy37 OCPRD1162OpenCandy38 OCPRD1162OpenCandy39 OCPRD1162OpenCandy40 OCPRD1162OpenCandy41 OCPRD1162OpenCandy42 OCPRD1162OpenCandy44 OCPRD1162OpenCandy45 OCPRD1162OpenCandy46 OCPRD1162OpenCandy47 OCPRD1162OpenCandy48 OCPRD1162OpenCandy49 OCPRD1162OpenCandy5 OCPRD1162OpenCandy50 OCPRD1162OpenCandy51 OCPRD1162OpenCandy52 OCPRD1162OpenCandy53 OCPRD1162OpenCandy54 OCPRD1162OpenCandy55 OCPRD1162OpenCandy56 OCPRD1162OpenCandy57 OCPRD1162OpenCandy58 OCPRD1162OpenCandy59 OCPRD1162OpenCandy6 OCPRD1162OpenCandy60 OCPRD1162OpenCandy61 OCPRD1162OpenCandy62 OCPRD1162OpenCandy63 OCPRD1162OpenCandy64 OCPRD1162OpenCandy65 OCPRD1162OpenCandy7 OCPRD1162OpenCandy8 OCPRD1162OpenCandy9 _OCPRD1162OpenCandy2@16 _OCPRD1162OpenCandy3@16 _OCPRD1162OpenCandy43@16 _OCPRD1162OpenCandy4@16

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 e1180e1e3344c7536150275e33de53dc1dd1a3ca03be66c4d4875fe5bcd4e436
MD5 a4f38d1c7a480f5da1bb8097b8b939db
SHA1 b3129c2a0e61881381463f5e0cbbffa573daa845
SHA512 fed89f7ee9364fc2f4b9f82c4563713497043947e98dbb03e7d755681adf3ae661aba80d08e59988a23695fc64481b69d9842b7ec7d2b572cc872c4c9957febc
SSDEEP 192:WN2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/KxKb+nYe+PjPArJUxVy:tJoiO8V2upW7vQjS/0nYPLWUHWteMy8v
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

78:2b:69:d9:a6:d3:2b:02:2f:0d:f6:35:ca:3e:de:c8:b4:96:ab:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Mar 11, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/execDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 bdc28057be0a9e5b4f3735197a382680f646c1bcadb18fcdb6bed0caf6bcad31
MD5 84eac2b0da307a3b0d17c35838d8e7ee
SHA1 ea472569b5d8c11132fac266f5e340300a33df76
SHA512 8f6c662b2de6ff3a306f2024a127e0eb79f8160dde7bfbc00095e25e0e2d905df8c291f854fae40005718478eac83db5f4622a40f7b8600ac19255b37dadfce9
SSDEEP 192:Wx9pJ7jQs5toD6Cln/6tt19nYe+PjPArJUxVl+vlJar9ZCspE+TMQrs5R:WJtGblEnYPLWUHWteMHR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

58:e1:a1:33:8b:28:3a:2c:6f:24:11:4d:15:7f:5e:9e:44:f1:99:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Feb 10, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 917ae9b9adb269abd5543f5bf5676bac
SHA256 37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e
MD5 dccdcb124064a1d9a5eb12232348b898
SHA1 f294fac154cb1c6c18fe054ac584f767594b93fb
SHA512 bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e
SSDEEP 384:c4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO7nYPLWUHWteM9Ms8:cG8sUAUnt88CFJDhmajMAWtsP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

25:cc:a5:24:8b:f6:3f:d7:e8:f0:66:8a:50:51:b3:bc:7c:15:da:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Feb 10, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

15169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcschr _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul memset wcsstr wcstol

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError CreateFileW GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpOpenRequestW HttpAddRequestHeadersW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/nsArray.dll

SHA256 072086de8c1d354733b4f3555482656728e0a26be715e76b90c3a71faac7f8f6
MD5 6c41b7846fccb6edbbeba7ae13abbce2
SHA1 eebf8ef6bc529262ed9b0b38f21e49af243b8d75
SHA512 8189f41c564cb330c0f4c4b73c53f41c924a54914a62e80885451643d8ed7a3d7c5b6f7cd4b2a88a83a2ef1b6f063184812c53dda398eabd3508dd0ea02044de
SSDEEP 192:OaNHOZqWdn+/a4YZkv1uULW1C4w2X2bMsj/nYe+PjPArJUxVl+vlJar9ZCspE+Tf:OQudRQaYAU6hXUnYPLWUHWteMu/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

94:eb:94:4b:9d:24:33:a9:67:f4:ef:16:fa:e3:25:c3:31:df:07:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Feb 10, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

36256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 771c56e921b4afb27be8fc6b93a6efee818924e8ecf65edb8b0922c83ee35fd8
MD5 71369d6fabdb848702b1f425a5253dfc
SHA1 f506fa22ac1fe9c7a89c3e0e6d19263c653f4597
SHA512 5e1d8363acfe5c030c3d0baefa31003677b83165661c825b142a6d681520a0d73ee8064403f4f9eac120e71db98c5610db41a59e4f1e0acc4f06404420c892c8
SSDEEP 96:duNDLJvhx8NeQojexz2U96EFU83ACTbKsJ26ZHUDeA3leWHbGCE6oS+hSVfA7SfG:KNENebat3yCT5J1Z0HYW7GJ++hSe2X2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/webapphost.dll

IMPHASH 70517b7257478154cb6e76d395f60480
SHA256 54c6ca5ddcc600bb6ffd283760b843cc0af41b7b9ea1767a9aa4826262c407fc
MD5 ca7f07bcde734c3a3072841e412c45e5
SHA1 75c03a7b14b2827242447fec95e4869a76518747
SHA512 2f134f85aaea11eb4dfbbda62efe1ce45c04781da5fb138231c2f62578c80a5cd9cbe45c901fd15c5a85c86f49f70ecf5cd8213e9784bc888f8581c8850ced1e
SSDEEP 12288:Q0liibTLW8aqfoiauUz/tnKSNyFegAl1lSFb1zOvtyPjJwaAW:Q+lMZiauUz/thsAl1lMBzwYPjJRAW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

64:68:bf:a7:ef:b4:bb:0b:3a:8d:94:ba:5f:a7:95:3e:44:16:b1:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Aug 25, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

325441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileAttributesW GetFileSizeEx GetFileTime WritePrivateProfileStringW GetTickCount ExitThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetFileType VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA HeapAlloc RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize SetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapDestroy VirtualFree SetHandleCount GetStartupInfoA GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP CreateFileA SetEnvironmentVariableA GlobalFlags InterlockedCompareExchange GetProcessHeap GetCurrentProcessId SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange lstrcmpA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime InterlockedIncrement lstrlenA SuspendThread GetModuleFileNameW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetFileSize SetEndOfFile UnlockFile LockFile SetFilePointer GetThreadLocale GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA GetModuleHandleA SetLastError FormatMessageW CreateThread GetExitCodeThread Sleep lstrcatW lstrcmpiW ReadFile GetExitCodeProcess PeekNamedPipe FlushFileBuffers lstrlenW CreateProcessW GetCurrentProcess DuplicateHandle CreatePipe GetModuleHandleW GetLastError lstrcpynW lstrcpyW WideCharToMultiByte ResetEvent SetEvent FreeResource GlobalAlloc ResumeThread GlobalFree MulDiv GlobalUnlock GlobalLock CreateEventW GetProcAddress LoadLibraryW FreeLibrary ReleaseMutex CreateMutexW WriteConsoleW GetStdHandle AllocConsole FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar LocalFree CloseHandle WriteFile CreateFileW LocalAlloc InterlockedDecrement WaitForSingleObject SleepEx HeapCreate GetVersionExW

user32

MessageBeep GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn IsRectEmpty CopyAcceleratorTableW GetWindowThreadProcessId GetSysColorBrush UnregisterClassW SetWindowContextHelpId MapDialogRect PostQuitMessage CharNextW GetMessageW TranslateMessage ValidateRect DestroyMenu GetDesktopWindow GetActiveWindow GetNextDlgTabItem EndDialog CharUpperW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetForegroundWindow SetActiveWindow DispatchMessageW GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DefWindowProcW CallWindowProcW GetMenu OffsetRect IntersectRect GetWindowRect IsWindow InvalidateRect EnableWindow SystemParametersInfoA GetWindowPlacement EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuState GetMenuItemID PostThreadMessageW RegisterClipboardFormatW GetLastActivePopup SetRect GetDC ReleaseDC FillRect GetSysColor CopyRect LoadIconW LoadCursorW GetSystemMenu AppendMenuW SendMessageW IsIconic GetSystemMetrics GetClientRect DrawIcon GetCursorPos ScreenToClient PtInRect SetCursor EnableScrollBar IsWindowVisible UpdateWindow PostMessageW LoadImageW MessageBoxW wsprintfW GetClassNameW GetWindow GetDlgItem SendDlgItemMessageW IsDialogMessageW GetWindowLongW SetWindowTextW GetMenuItemCount GetSubMenu GetWindowTextW GetFocus GetParent SetWindowPos SetFocus IsWindowEnabled ShowWindow MoveWindow SetWindowLongW GetDlgCtrlID CreateDialogIndirectParamW

gdi32

GetBkColor GetTextColor CreateRectRgnIndirect GetMapMode GetRgnBox GetStockObject CreateBitmap ExtSelectClipRgn SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetObjectW GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateCompatibleBitmap ScaleWindowExtEx SetWindowExtEx GetDeviceCaps CreateCompatibleDC BitBlt CreateSolidBrush DeleteObject DeleteDC SelectObject ScaleViewportExtEx

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueW

shell32

ShellExecuteExW ShellExecuteW SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderPathW

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathStripToRootW

oledlg

OleUIBusyW

ole32

CoFreeUnusedLibrariesEx CoCreateInstance CreateStreamOnHGlobal CoInitializeEx OleInitialize CoTaskMemFree OleUninitialize CoUninitialize CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoDisconnectObject CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CoInitialize

oleaut32

SysAllocStringByteLen SysStringByteLen SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocStringLen SysStringLen VariantChangeType VariantCopy OleCreateFontIndirect LoadTypeLi VariantInit SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime VariantClear OleLoadPicture SysAllocString GetErrorInfo SysFreeString

crypt32

CertFindCertificateInStore CryptQueryObject CertCloseStore CryptMsgClose CertGetNameStringW CertFreeCertificateContext CryptMsgGetParam

oleacc

LresultFromObject CreateStdAccessibleObject

wininet

HttpOpenRequestW InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW InternetCloseHandle HttpQueryInfoW InternetQueryDataAvailable InternetCanonicalizeUrlW

$PLUGINSDIR/xml.dll

IMPHASH b5ed5b3a951d4443ce56e5453702d536
SHA256 288a66549f2699eba1010c5ec989f546a1381411413e56f12b3dc6c5eb6694d5
MD5 8123bd4d3b32b352c4651d89d6597d88
SHA1 1655ae3b35cf3ed2dfa0a1212c6fd5c444a52d9c
SHA512 13a45cb9df3c062f473d0b7371370b24d7355aabe688254d93b4f7474264c4d79fe945591947765e8477db664ad00e132f247499cb64949f0378481aa5c0ba60
SSDEEP 1536:S2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KCZC:8zjLkarn7O+n9z2L6whFtGF42bKcC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

30:76:b4:0f:a4:fd:d9:44:17:a0:90:5d:e0:2c:9a:83:74:65:c4:84

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Chains

Feb 10, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Serial Number

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 3, 2013 - Apr 3, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

60879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/$_286_/ProxyInstaller.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/$_287_/BI.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/$_288_/DownloadAcc.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/BunndleOfferManager.dll

PE Signature issue

secur32

netapi32

rpcrt4

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

generic

$PLUGINSDIR/DM_loader.gif

$PLUGINSDIR/Failed.htm

$PLUGINSDIR/FirefoxHandler.dll

psapi

kernel32

user32

advapi32

shlwapi

msvcp100

msvcr100

generic

$PLUGINSDIR/OCSetupHlp.dll

PE Signature issue

kernel32

psapi

ws2_32