29c46832bd6d41417796797b7f433395da17b49867436e50c0260857638c9f05

Sharing

Copy URL Twitter E-mail

General

Target

29c46832bd6d41417796797b7f433395da17b49867436e50c0260857638c9f05
Size

807KB
MD5

266e0dc11222194836eca5f5a15d3675
SHA1

04c255a4e001ef28d64b01ef82fc6ab58259191d
SHA256

29c46832bd6d41417796797b7f433395da17b49867436e50c0260857638c9f05
SHA512

3e551a0eeae1bb3b3e23ef04456e7f2994d0c17d4dc66a7c63b21fe06495c344825d353b10f3a4e64994b5174ef39139deea052716dce119eccfb5505f1de0bf
SSDEEP

12288:OjvyTI429d965FsJY0goZHTIgFWNVDTdHL5HSIX+AeKRql8E6c3CxspTr46IJ1:OjvyQl6rUgoZHTIgis1l8Ef3C2TrfIJ1

Score

1^/10

Malware Config

Signatures

Files

29c46832bd6d41417796797b7f433395da17b49867436e50c0260857638c9f05
.exe windows:4 windows x86 arch:x86

1cc4021d9f64305cda61a58af6da6627

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:b5:e3:2b:01:ba:96:b1:8c:a4:95:0f:ce:d7:3d:c0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/07/2012, 00:00

Not After

16/08/2014, 23:59

Subject

CN=Eurofluxo-Suporte a Novas Tecnologias\, Lda.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desenvolvimento,O=Eurofluxo-Suporte a Novas Tecnologias\, Lda.,L=Vila Nova de Gaia,ST=Vila Nova de Gaia,C=PT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:80:dd:ea:be:75:bd:20:bd:82:fc:54:b8:e6:2c:87:dc:77:e3:b7
Signer

Actual PE Digest

a9:80:dd:ea:be:75:bd:20:bd:82:fc:54:b8:e6:2c:87:dc:77:e3:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Develop\VC8\EasyLynqVersao140\ELTableUpdate\rti-release\RTCallInsert.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

rpcrt4

RpcNetworkIsProtseqValidA
RpcStringBindingComposeA
RpcStringFreeA
RpcBindingFromStringBindingA
RpcBindingFree
RpcMgmtSetComTimeout
NdrServerCall2
NdrClientCall2

odbc32

ord2
ord24
ord44
ord31
ord18
ord8
ord40
ord15
ord9
ord4
ord57
ord10
ord7
ord11
ord54
ord13
ord75

winmm

timeBeginPeriod
timeEndPeriod

kernel32

VirtualProtect
LoadLibraryExA
EnumResourceLanguagesA
ConvertDefaultLocale
GetFileAttributesA
SetFileTime
GetTempFileNameA
GetDiskFreeSpaceA
GlobalFlags
InterlockedIncrement
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SuspendThread
FindResourceExA
WritePrivateProfileStringA
VirtualAlloc
HeapReAlloc
GetSystemTimeAsFileTime
ExitProcess
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
ExitThread
HeapSize
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetACP
IsValidCodePage
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
ResumeThread
SetThreadPriority
GetShortPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
GetThreadLocale
DeleteFileA
MoveFileA
InterlockedDecrement
GetModuleFileNameW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
lstrcmpA
GetCurrentProcessId
MulDiv
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
ReleaseMutex
GetSystemDirectoryA
GetTimeZoneInformation
GetTickCount
GetLocaleInfoA
LCMapStringA
WaitForSingleObject
FreeResource
GetFullPathNameA
SystemTimeToFileTime
WriteFile
CreateFileA
VirtualQuery
FormatMessageA
GetFileTime
SetFilePointer
GetModuleFileNameA
FileTimeToSystemTime
CreateMutexA
CreateProcessA
OutputDebugStringA
GetCurrentThreadId
ResetEvent
Sleep
CreateEventA
WaitForMultipleObjects
CreateThread
SetEvent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentDirectoryA
SetLastError
FindResourceA
LockResource
SizeofResource
LoadResource
GetModuleHandleA
GetProcessHeap
GlobalUnlock
GetCurrentThread
GetComputerNameA
GlobalAlloc
LocalFree
HeapAlloc
LocalAlloc
GlobalLock
CloseHandle
HeapFree
GetVersionExA
GlobalFree
GetCurrentProcess
LoadLibraryA
FreeLibrary
GetProcAddress
MultiByteToWideChar
InterlockedExchange
WideCharToMultiByte
lstrcmpiA
CompareStringW
GetVersion
GetLastError
GetStringTypeExA
CompareStringA
lstrlenA

user32

GrayStringA
DrawTextExA
TabbedTextOutA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetFocus
GetWindowTextLengthA
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
CreateWindowExA
GetClassInfoExA
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
GetWindow
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
DispatchMessageA
TranslateMessage
IsIconic
GetPropA
EnumThreadWindows
ShowWindow
MoveWindow
GetWindowPlacement
CallWindowProcA
EnumWindows
GetMenu
GetMenuItemCount
DeleteMenu
GetMenuItemID
GetWindowDC
IsMenu
SetRectEmpty
EqualRect
ValidateRect
ReuseDDElParam
IsRectEmpty
GetClassInfoA
GetNextDlgTabItem
DrawTextA
DefWindowProcA
GetCaretPos
RegisterClassA
GetClassNameA
EnumChildWindows
MessageBoxA
wvsprintfA
GetSubMenu
LoadMenuA
ClientToScreen
ShowCaret
HideCaret
RedrawWindow
MessageBeep
OffsetRect
BringWindowToTop
AttachThreadInput
SetPropA
GetWindowThreadProcessId
RemovePropA
GetForegroundWindow
PostQuitMessage
LoadIconA
LoadCursorA
SetCursor
SendMessageW
PeekMessageA
SystemParametersInfoA
InflateRect
IsWindow
IsWindowVisible
WindowFromPoint
ScreenToClient
GetCursorPos
GetCapture
SetForegroundWindow
SetParent
SetActiveWindow
GetDesktopWindow
GetWindowRect
GetSystemMetrics
SetWindowLongA
EndDialog
SetWindowTextA
SetWindowPos
GetWindowTextA
IsWindowEnabled
ReleaseCapture
UpdateWindow
SetCapture
GetDC
KillTimer
SetTimer
ReleaseDC
LoadBitmapA
MapDialogRect
IntersectRect
GetKeyState
CopyRect
GetWindowLongA
PtInRect
InvalidateRect
GetFocus
BeginPaint
EndPaint
GetMessageA
LockWindowUpdate
GetDCEx
SetRect
DestroyIcon
PostMessageA
DrawFocusRect
UnregisterClassA
GetSysColorBrush
IsZoomed
SetMenu
UnpackDDElParam
FillRect
GetParent
GetClientRect
GetSysColor
GetDlgItem
SendMessageA
CharUpperA
EnableWindow
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
TranslateAcceleratorA
DestroyMenu
GetMenuItemInfoA
SetWindowRgn
DrawIcon
FindWindowA
ShowOwnedPopups
FrameRect
GetAsyncKeyState
DrawMenuBar

gdi32

CreatePatternBrush
GetStockObject
SetRectRgn
SetViewportExtEx
CombineRgn
PatBlt
CreateEllipticRgn
LPtoDP
Ellipse
GetBkColor
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetTextMetricsA
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CreateCompatibleBitmap
RoundRect
CreateFontIndirectA
CreateSolidBrush
CreateRectRgnIndirect
DeleteObject
CreatePen
GetObjectA
GetTextExtentPoint32A
SelectObject
BitBlt
EnumFontFamiliesExA
CreateCompatibleDC
GetPixel
CreateRectRgn
SelectClipRgn
ScaleViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

DeregisterEventSource
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegQueryValueA
RegOpenKeyA
RegSetValueA
ConvertSidToStringSidA
RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
ReportEventA
OpenSCManagerA
RegisterEventSourceA
ControlService
QueryServiceStatus
FreeSid
CloseServiceHandle
OpenServiceA
CreateServiceA
SetServiceStatus
DeleteService
StartServiceA
OpenThreadToken
AllocateAndInitializeSid
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeAcl
AddAccessAllowedAce
GetTokenInformation
GetLengthSid
IsValidSecurityDescriptor
EqualSid
OpenProcessToken
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ExtractIconExA
ExtractIconA
DragQueryFileA
DragFinish
SHGetMalloc
ShellExecuteA
SHGetFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCA
PathFindFileNameA
PathStripToRootA
PathFindExtensionA

ole32

CoUninitialize

oleaut32

VariantClear
SysAllocStringLen
VariantInit
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate

Sections

.text
Size: 580KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cc4021d9f64305cda61a58af6da6627

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

79:b5:e3:2b:01:ba:96:b1:8c:a4:95:0f:ce:d7:3d:c0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

a9:80:dd:ea:be:75:bd:20:bd:82:fc:54:b8:e6:2c:87:dc:77:e3:b7Signer

Headers

File Characteristics

PDB Paths

Imports

version

rpcrt4

odbc32

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

Sections

.text Size: 580KB - Virtual size: 577KB

.rdata Size: 152KB - Virtual size: 149KB

.data Size: 16KB - Virtual size: 35KB

.rsrc Size: 48KB - Virtual size: 47KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

79:b5:e3:2b:01:ba:96:b1:8c:a4:95:0f:ce:d7:3d:c0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a9:80:dd:ea:be:75:bd:20:bd:82:fc:54:b8:e6:2c:87:dc:77:e3:b7
Signer

.text
Size: 580KB - Virtual size: 577KB

.rdata
Size: 152KB - Virtual size: 149KB

.data
Size: 16KB - Virtual size: 35KB

.rsrc
Size: 48KB - Virtual size: 47KB