c92812864223881fd940f73a67e8c06c

Sharing

Copy URL Twitter E-mail

General

Target

c92812864223881fd940f73a67e8c06c
Size

1.4MB
MD5

c92812864223881fd940f73a67e8c06c
SHA1

03dee096dd3577f7592e09fb16498771c797e214
SHA256

718f68d905b7f70dabf7153b86ddffee9a6aa508c5b2e9a24e90e74f3aa8537a
SHA512

a4a2547008a3f4aaf386e7fa1fdc52401b9238fce39cf4aa8851d22bc00e67873561440ed330eb3f51836d3c954524e97773ecfb56f248c455f0698b18f117c4
SSDEEP

6144:Y+hZrXPt0cBedutArzziSP2Re8J2xiSP2Re8J2xiSP2Re8J2xiSP2Re8J2+:Y+jrXPt0Me6AGk8k8k8ky

Score

1^/10

Malware Config

Signatures

Files

c92812864223881fd940f73a67e8c06c
.exe windows:4 windows x86 arch:x86

e472a84ff2a4a4dd12084c56c0e26dcf

Code Sign

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2014, 17:13

Not After

23/08/2015, 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:dc:d6:0c:e8:21:e1:de:b7:e5:85:96:97:76:ec:85:81:cd:03:20
Signer

Actual PE Digest

c5:dc:d6:0c:e8:21:e1:de:b7:e5:85:96:97:76:ec:85:81:cd:03:20

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\3128312830128312831283918391823

Imports

kernel32

GetLocalTime
GetProcAddress
LoadLibraryExA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
IsBadWritePtr
IsBadReadPtr
HeapValidate
RaiseException
DebugBreak
LoadLibraryA
TerminateProcess
GetCurrentProcess
ExitProcess
GetLastError
GetFileAttributesA
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
SetUnhandledExceptionFilter
GetProcessHeap
CloseHandle
FreeLibrary
GetCPInfo
GetACP
GetOEMCP
CreateFileW
SetConsoleCtrlHandler
VirtualQuery
InterlockedExchange
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadCodePtr
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
ReadFile
SetFilePointer
SetStdHandle
VirtualProtect
GetSystemInfo
GetLocaleInfoA
FlushFileBuffers

Sections

.rda1834
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 244KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e472a84ff2a4a4dd12084c56c0e26dcf

Code Sign

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59Certificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

c5:dc:d6:0c:e8:21:e1:de:b7:e5:85:96:97:76:ec:85:81:cd:03:20Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

Sections

.rda1834 Size: 64KB - Virtual size: 64KB

.text Size: 192KB - Virtual size: 188KB

.data Size: 244KB - Virtual size: 299KB

.idata Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

c5:dc:d6:0c:e8:21:e1:de:b7:e5:85:96:97:76:ec:85:81:cd:03:20
Signer

.rda1834
Size: 64KB - Virtual size: 64KB

.text
Size: 192KB - Virtual size: 188KB

.data
Size: 244KB - Virtual size: 299KB

.idata
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB