c0dc8028f2e9675801d2e45cfbc71ced

Sharing

Copy URL Twitter E-mail

General

Target

c0dc8028f2e9675801d2e45cfbc71ced
Size

65KB
MD5

c0dc8028f2e9675801d2e45cfbc71ced
SHA1

962fd43ac3500c3242a8431aa64ca19f29d3ed62
SHA256

b80d134e4433fefce8af7f69ae176bdc8b6a12e413a54db112e160c436676faa
SHA512

d1516518ad53e40be9e6c2f09ad2e82300451eac80da0ec772508b4d7bc75302cfe76b9e0f7f4b0192d78b4881dd4ff7593d51b857c378b52e119ad0c7471ab9
SSDEEP

1536:u2QKFcmeaF0ledejwbk2tTgbQZ9s7DbNb:uNDVO0SbkdQZ9kDbp

Score

1^/10

Malware Config

Signatures

Files

c0dc8028f2e9675801d2e45cfbc71ced
.exe windows:4 windows x86 arch:x86

2334340a80aa3e1a58bc7dd91e5535d7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteAtom
GetPrivateProfileSectionNamesA
ResetEvent
UTRegister
PeekNamedPipe
EraseTape
SizeofResource
ResumeThread
GlobalFindAtomA
LocalFree
GlobalCompact
HeapDestroy
SetEvent
SetSystemTime
GetStdHandle
GetComputerNameA
CreateFiber
GetNamedPipeHandleStateA
UnlockFileEx
SetVolumeLabelA
DebugActiveProcess
GetCPInfoExA
OutputDebugStringA
FreeConsole
SetDefaultCommConfigA
GetSystemTimeAdjustment
GenerateConsoleCtrlEvent
GetFileAttributesExA
WaitForSingleObject
IsBadReadPtr
GetVersionExA
TransactNamedPipe
SetNamedPipeHandleState
FlushConsoleInputBuffer
WriteConsoleOutputAttribute
CreateDirectoryExA
GetBinaryTypeA
GetConsoleOutputCP
SleepEx
lstrcat
SetConsoleOutputCP
GetProcessVersion
SetCommBreak
VirtualAlloc
LocalLock
LockFileEx
GetCommState
InterlockedIncrement
SetProcessAffinityMask
GetUserDefaultLangID
SwitchToFiber
GetDriveTypeA
lstrcmpi
SetEnvironmentVariableA
CopyFileA
lstrcmp
GetDiskFreeSpaceA
EnumSystemLocalesA
GlobalLock

shlwapi

SHDeleteValueA
PathIsRelativeA
PathFindOnPathA
PathFileExistsA
PathCommonPrefixA
StrRChrIA
PathStripToRootA
PathIsUNCA
PathGetDriveNumberA
HashData
SHRegWriteUSValueA
StrToIntExA
ColorHLSToRGB
SHRegCreateUSKeyA
SHCreateStreamWrapper
StrCSpnA
PathRemoveBlanksA
PathSearchAndQualifyA
AssocQueryStringA
StrIsIntlEqualA
SHRegOpenUSKeyA
SHIsLowMemoryMachine
StrChrIA
PathQuoteSpacesA
PathAppendA
UrlIsOpaqueA
UrlGetLocationA
SHRegEnumUSKeyA
PathIsFileSpecA
StrFormatByteSize64A
SHAutoComplete

advapi32

ObjectDeleteAuditAlarmA

Sections

.gjwne
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ohkzs
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxoj
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tkpoz
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2334340a80aa3e1a58bc7dd91e5535d7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.gjwne Size: 22KB - Virtual size: 45KB

.ohkzs Size: 5KB - Virtual size: 10KB

.sxoj Size: 1KB - Virtual size: 2KB

.tkpoz Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.gjwne
Size: 22KB - Virtual size: 45KB

.ohkzs
Size: 5KB - Virtual size: 10KB

.sxoj
Size: 1KB - Virtual size: 2KB

.tkpoz
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB