03c4352f492c49f46f0a0af96b945af01b1a3e506b4f9df376efb50aad86440c

Sharing

Copy URL Twitter E-mail

General

Target

03c4352f492c49f46f0a0af96b945af01b1a3e506b4f9df376efb50aad86440c
Size

623KB
MD5

71eeeb9abec05844e99bfcb2b7768b19
SHA1

72172de4954f78f10621df4be420baeb852c2386
SHA256

03c4352f492c49f46f0a0af96b945af01b1a3e506b4f9df376efb50aad86440c
SHA512

c7b3a32a136fbe155e72c7e9355560743f1ba05b166f275c621237ab27541e64737a863ea043bddab5737738c8099a2c089f492182f02cb3d853a5cddcf6ba34
SSDEEP

12288:zE6Li6xfBJmq3erx1ZpZNXlFvKxbRFWhDIMVpb:zNxP/3Y19NXlORFiMMVpb

Score

1^/10

Malware Config

Signatures

Files

03c4352f492c49f46f0a0af96b945af01b1a3e506b4f9df376efb50aad86440c
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5a:60:d1:2b:c8:ff:d4:af:ae:16:1f:a0:47:15:cb:c4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=WL+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:df:0e:6a:8b:87:80:77:03:df:8d:9b:a4:51:0a:81:3d:97:fd:58
Signer

Actual PE Digest

b6:df:0e:6a:8b:87:80:77:03:df:8d:9b:a4:51:0a:81:3d:97:fd:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 7.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/DM_loader.gif
.gif
$PLUGINSDIR/FDMClient.dll
.dll windows:5 windows x86 arch:x86

26354f18363e84db3ad0df15b94f135a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=DM4+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:25:09:66:40:a5:88:84:8b:13:4d:29:f2:c2:5f:f1:2c:e0:3f:8d
Signer

Actual PE Digest

62:25:09:66:40:a5:88:84:8b:13:4d:29:f2:c2:5f:f1:2c:e0:3f:8d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetOpenA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCreateUrlA
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
InternetGetCookieA
HttpOpenRequestA
InternetWriteFile
HttpSendRequestExA
HttpEndRequestA
InternetGetLastResponseInfoA
FtpSetCurrentDirectoryA
InternetQueryOptionA
FtpFindFirstFileA
FtpCommandA
InternetSetOptionA
InternetReadFile
InternetConnectA

ws2_32

bind
htons
socket
gethostname
send
connect
accept
listen
closesocket
recv
WSAGetLastError
gethostbyname
WSAStartup

user32

PeekMessageA
TranslateMessage
DispatchMessageA
CharLowerA
MessageBoxA

ole32

OleRun
CoUninitialize
CoInitialize
CoCreateInstance

kernel32

GetCommandLineA
lstrcmpiA
GetProcessHeap
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetCurrentDirectoryA
Sleep
lstrcpyA
lstrlenA
GetProcAddress
LoadLibraryA
GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFileTime
lstrcatA
InterlockedDecrement
WriteFile
CreateThread
InterlockedIncrement
SetEndOfFile
GetFileSize
WideCharToMultiByte
MultiByteToWideChar
GetFileTime
CreateFileW
GetFileAttributesW
GetLastError
SetFileAttributesW
SetFilePointer
DeleteFileW
MoveFileW
SetLastError
GetExitCodeThread
TerminateThread
WaitForSingleObject
FreeLibrary
GetCurrentThreadId
CompareStringA
GetModuleFileNameA
CreateDirectoryW
ReadFile
SystemTimeToFileTime
GetTickCount
CreateMutexA
ReleaseMutex
CreateFileA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
HeapAlloc
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
VirtualAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

Exports

Exports

FromCppDownload
Load

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Failed.htm
.js
$PLUGINSDIR/FirefoxHandler.dll
.dll windows:5 windows x86 arch:x86

0b0bd9a74b81c20dd1ca10dffb1e2ff5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=DM4+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:2a:54:eb:f4:12:cf:73:ea:8d:70:b3:3d:76:36:5a:c9:3e:80:5c
Signer

Actual PE Digest

66:2a:54:eb:f4:12:cf:73:ea:8d:70:b3:3d:76:36:5a:c9:3e:80:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SmartBar\DevelopmentTools\FF\FirefoxHandler\Release\FirefoxHandler.pdb

Imports

psapi

EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW
EnumProcesses

kernel32

CopyFileW
CreateFileW
GetFileSize
CloseHandle
GetDiskFreeSpaceExW
ReadFile
MultiByteToWideChar
WideCharToMultiByte
OpenProcess
DeleteFileW
TerminateProcess
Sleep
CreateProcessW
LoadLibraryA
GetProcAddress
GetVersionExW
GetTempPathW
lstrcpynW
GlobalAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
UnhandledExceptionFilter
EncodePointer

user32

GetWindowThreadProcessId
FindWindowW
CharUpperW
wsprintfW

advapi32

RegCloseKey
RegOpenKeyExW
DuplicateTokenEx
OpenProcessToken
RegQueryValueExW

shlwapi

PathFileExistsW

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

msvcr100

?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
memset
memcpy
_CxxThrowException
__CxxFrameHandler3
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
memmove
_wfsopen
fwrite
fflush
fclose
??_V@YAXPAX@Z
fseek
ftell
rewind
fread
malloc
realloc
free
_wtoi
calloc
iswspace
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook

Exports

Exports

DllIsFireFoxRunning
DllRestoreFF
DllTerminateFF

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NoneSilentSuccess.htm
.js
$PLUGINSDIR/StdUtils.dll
.dll windows:5 windows x86 arch:x86

6e63471b3d7c59cf9b8572bf93e2cf35

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=DM4+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:f0:36:8c:6d:35:c4:1e:87:a5:59:a6:5d:04:90:19:22:7a:2a:47
Signer

Actual PE Digest

4d:f0:36:8c:6d:35:c4:1e:87:a5:59:a6:5d:04:90:19:22:7a:2a:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_snprintf
swscanf
_snwprintf
rand
srand
time
_wcsicmp
??2@YAPAXI@Z
wcsncpy
??3@YAXPAX@Z
wcschr
_beginthreadex
memset

shlwapi

ord176

kernel32

LeaveCriticalSection
lstrcpynW
GlobalFree
MultiByteToWideChar
EnterCriticalSection
GetProcAddress
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
DeleteCriticalSection
GetCommandLineW
GetVersionExW
WaitForSingleObject
CloseHandle
Sleep
CreateEventW
GetTickCount
FreeLibrary
LoadLibraryW
GetModuleHandleW
TerminateThread
GlobalAlloc

user32

MessageBoxA
LoadStringW
MessageBoxW
wsprintfW
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW

shell32

ShellExecuteExW
SHFileOperationW
ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

Exports

Exports

DisableVerboseMode
Dummy
EnableVerboseMode
ExecShellAsUser
ExecShellWait
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetDays
GetHours
GetMinutes
GetParameter
InvokeShellVerb
Rand
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
Time
TrimStr
TrimStrLeft
TrimStrRight
WaitForProc

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Success.htm
.js
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=DM4+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:2b:69:d9:a6:d3:2b:02:2f:0d:f6:35:ca:3e:de:c8:b4:96:ab:13
Signer

Actual PE Digest

78:2b:69:d9:a6:d3:2b:02:2f:0d:f6:35:ca:3e:de:c8:b4:96:ab:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/icon.png
.png
$PLUGINSDIR/proxy.html
.html .js polyglot
$PLUGINSDIR/webapphost.dll
.dll windows:5 windows x86 arch:x86

31fb764b224f4f11bd284c1a073d9969

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2014, 00:00

Not After

05/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=DM4+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:bb:1f:65:f6:66:c3:ae:ae:b7:18:ec:45:e5:6c:85:7f:ba:06:e4
Signer

Actual PE Digest

94:bb:1f:65:f6:66:c3:ae:ae:b7:18:ec:45:e5:6c:85:7f:ba:06:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFlags
GetFileSizeEx
GetFileTime
WritePrivateProfileStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileType
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
ExitThread
GetCommandLineA
RaiseException
RtlUnwind
HeapReAlloc
ExitProcess
HeapSize
SetStdHandle
HeapCreate
HeapDestroy
VirtualFree
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleFileNameA
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetFileAttributesA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
CreateProcessA
CreateFileA
SetErrorMode
TlsFree
TlsSetValue
LocalReAlloc
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryExW
CompareStringA
InterlockedExchange
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
InterlockedIncrement
SuspendThread
GetModuleFileNameW
GetFullPathNameW
GetVolumeInformationW
GetFileSize
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
GetThreadLocale
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GetModuleHandleA
FormatMessageW
SetLastError
OpenProcess
lstrcatW
lstrcmpiW
ReadFile
PeekNamedPipe
FlushFileBuffers
lstrlenW
GetCurrentProcess
DuplicateHandle
CreatePipe
GetModuleHandleW
lstrcpyW
lstrcpynW
CopyFileW
CreateDirectoryW
ExpandEnvironmentStringsW
GetCurrentThreadId
FreeResource
GlobalAlloc
ResumeThread
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
GetProcAddress
LoadLibraryW
FreeLibrary
OpenEventW
WideCharToMultiByte
GetUserDefaultLangID
WaitForMultipleObjects
HeapFree
GetProcessHeap
HeapAlloc
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
FileTimeToSystemTime
GetFileAttributesW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
lstrlenA
InterlockedDecrement
LocalFree
LocalAlloc
DeleteFileW
GetCurrentProcessId
GetWindowsDirectoryW
GetVersionExW
GetSystemTime
TerminateThread
GetExitCodeThread
FindClose
FindFirstFileW
GetTickCount
ResetEvent
WriteFile
CreateFileW
SetEvent
CreateThread
CreateEventW
ReleaseMutex
CreateMutexW
WaitForSingleObject
CloseHandle
GetExitCodeProcess
Sleep
CreateProcessW
GetEnvironmentStringsW
WriteConsoleW
GetStdHandle
AllocConsole
GetACP
GetLastError
InterlockedCompareExchange

user32

CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DefWindowProcW
CallWindowProcW
GetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetFocus
GetParent
IsWindowEnabled
GetDlgCtrlID
SetWindowTextW
GetWindowLongW
IsDialogMessageW
SendDlgItemMessageW
GetWindow
SetParent
SetWindowLongW
LoadImageW
GetClassNameW
DispatchMessageW
TranslateMessage
PeekMessageW
MessageBoxW
AllowSetForegroundWindow
SystemParametersInfoW
GetForegroundWindow
SetForegroundWindow
BringWindowToTop
SetActiveWindow
AttachThreadInput
GetWindowThreadProcessId
UpdateWindow
IsWindowVisible
RegisterClipboardFormatW
EnableScrollBar
SetCursor
PtInRect
ScreenToClient
GetCursorPos
DrawIcon
GetSystemMetrics
IsIconic
AppendMenuW
GetSystemMenu
LoadCursorW
LoadIconW
CopyRect
GetSysColor
FillRect
ReleaseDC
GetDC
SetRect
InvalidateRect
IsWindow
MoveWindow
GetClientRect
GetDesktopWindow
DialogBoxParamW
EndDialog
SetMenu
GetKeyState
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetLastActivePopup
RemovePropW
GetPropW
SetPropW
GetClassLongW
GetMessageW
PostThreadMessageW
wsprintfW
EnumWindows
GetWindowTextW
ShowWindow
EnumChildWindows
PostMessageW
GetWindowRect
EnableWindow
GetDlgItem
SendMessageW
SetWindowPos
SetFocus
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
IsRectEmpty
CopyAcceleratorTableW
GetSysColorBrush
UnregisterClassW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
CharNextW
ValidateRect
DestroyMenu
CharUpperW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CallNextHookEx
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
FindWindowExW
SetWindowsHookExW
CheckMenuItem

gdi32

GetObjectW
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreateBitmap
GetStockObject
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetMapMode
GetRgnBox
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
CreateSolidBrush
DeleteObject
DeleteDC
GetDeviceCaps
SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegDeleteValueW
CryptDestroyKey
CryptAcquireContextW
CryptImportKey
CryptCreateHash
CryptSetHashParam
CryptHashData
RegEnumKeyW
RegDeleteKeyW
RegQueryValueW
RegOpenKeyW
RegCreateKeyW
RegEnumValueW
RegEnumKeyExW
GetUserNameW
CryptDestroyHash
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptReleaseContext
CryptGetHashParam

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

shlwapi

ord2
PathAddBackslashW
PathAddExtensionW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

OleUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
OleRun
OleInitialize
CoDisconnectObject
CLSIDFromProgID

oleaut32

VariantChangeType
GetErrorInfo
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
OleLoadPicture
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysAllocString
VariantClear
VariantInit
LoadTypeLi
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantCopy
OleCreateFontIndirect

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptQueryObject
CertGetNameStringW

wininet

InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetCanonicalizeUrlW
InternetCanonicalizeUrlA
HttpSendRequestW
InternetCheckConnectionW
HttpEndRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpQueryInfoW
InternetReadFile
FtpOpenFileW
InternetQueryOptionW

httpapi

HttpInitialize
HttpAddUrl
HttpReceiveHttpRequest
HttpSendHttpResponse
HttpCreateHttpHandle

oleacc

CreateStdAccessibleObject
LresultFromObject

Exports

Exports

AddDynamicAttributesToVector
BuildClientXML
CallJSMethod
CallJSMethodWithParams
CreateCommLayer
CreateHttpServer
CreateWebInstallerBrowser
DeleteMasterPuidFromReg
DisableWindow
DownloadAndRunCustomOfferFiles
DownloadFileHttp
DownloadUninstaller
EnableCurrentWindow
EnableProxyConsoleLog
ExecWait
FillDMData
ForceInnerRegistryCHecker
GetBunndleParams
GetDONumAvailable
GetDONumToPresent
GetDOParam
GetDmFlowType
GetDoBroswerRestart
GetDynamicAttributesFromVector
GetDynamicHideModeState
GetDynamicIsExternal
GetDynamicOfferId
GetDynamicOffersCount
GetEngineDuration
GetGeneralParams
GetGlobalPageNavigationStatus
GetGlobalUIParams
GetInitToInitCompleteDuration
GetInstallOffersSync
GetIsSkipAllParams
GetLCONavigationStatus
GetMONonSIlentDownloadedFileName
GetMOPosition
GetMachineID
GetMainOfferCMD
GetMainSoftwareInnerVersion
GetMainTotalSteps
GetMrsParams
GetNavigateError
GetNextAntiOfferId
GetOfferParam
GetOfferSuccessCodes
GetPixelFireNumUrls
GetPixelFireParams
GetPixelFireUrl
GetProductParams
GetPublisherReportingParams
GetShouldInstallOffer
GetSouldRunUninstaller
GetToolbarParams
GetUIParams
GetUserLanguage
GetVectorAndRuleId
GetWelcomePageParams
Hide
HideBrowser
HmacEncryptQueryString
InitToInitComplete_MeasureAdd
InitToInitComplete_MeasureStart
InstallLCO
InstallManagerRetryMO
InstallNonSIlentMO
IsBrowserCompletedNavigation
Load
LoadNavigate
Navigate
NavigateAsync
NavigateAsyncGlobal
NavigateAsyncMO
NotifyStubOnDMFinishInit
ParseEngineXML
PhaseDuration_MeasureGet
PhaseDuration_MeasureStart
PreInstallChecking
PreLoad
PrepareLCO
ReplaceCommadLine
ReportBI_DownloadComplete
ReportBI_DownloadStart
ReportBI_EndOfSession
ReportBI_Init
ReportBI_InitComplete
ReportBI_InstallStatus
ReportBI_OfferPresented
ReportBI_OfferSuggested
ReportBI_Technical_GlobalPage
ReportBI_Technical_Language
ReportBI_Technical_RegistryCheckEnded
ReportBI_Technical_ReportToPublisher
ReportTechnicalFromNsis
SearchInFile
SearchInFileExtended
SearchInFileExtendedChrome
SearchInText
SearchNumberInText
SendClientXML
SetBIAttempt
SetBIIsSilent
SetDOParam
SetDownloadBrowserForWelcomePage
SetDynamicParsedParamsInBI
SetOfferFlag
SetOfferParam
SetPhase
SetUserAgent
SetUserProfile
SetUserSelectedSkipAll
SetUserSession
Show
ShowBrowser
ShowCertificate
ShowFileOnNonSilent
ShowLoadingScreen
StartOffersInstallation
StartOffersLoop
UnLoad1
UrlDecode
WaitAndInstallDynamics
WaitForAsyncExternalShowFinish
WaitForDocComplete
WaitForFinishModal
WaitForUserLanguage
WebAppHostExec
WebAppHostExecProcess
WebAppHostExecProcessWait
WebAppHostExecWait

Sections

.text
Size: 761KB - Virtual size: 761KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 307KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

5a:60:d1:2b:c8:ff:d4:af:ae:16:1f:a0:47:15:cb:c4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

b6:df:0e:6a:8b:87:80:77:03:df:8d:9b:a4:51:0a:81:3d:97:fd:58Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 7.8MB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

26354f18363e84db3ad0df15b94f135a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

62:25:09:66:40:a5:88:84:8b:13:4d:29:f2:c2:5f:f1:2c:e0:3f:8dSigner

Headers

DLL Characteristics

File Characteristics

Imports

wininet

ws2_32

user32

ole32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

0b0bd9a74b81c20dd1ca10dffb1e2ff5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

5a:60:d1:2b:c8:ff:d4:af:ae:16:1f:a0:47:15:cb:c4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

b6:df:0e:6a:8b:87:80:77:03:df:8d:9b:a4:51:0a:81:3d:97:fd:58
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 7.8MB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

62:25:09:66:40:a5:88:84:8b:13:4d:29:f2:c2:5f:f1:2c:e0:3f:8d
Signer

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

66:2a:54:eb:f4:12:cf:73:ea:8d:70:b3:3d:76:36:5a:c9:3e:80:5c
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4d:f0:36:8c:6d:35:c4:1e:87:a5:59:a6:5d:04:90:19:22:7a:2a:47
Signer

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 68B

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 1KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

20:1c:61:61:3e:36:ef:7d:d1:63:28:01:96:cd:80:f7
Certificate