ca8205d3f09fd6cff6029e19ffa3708c

Sharing

Copy URL Twitter E-mail

General

Target

ca8205d3f09fd6cff6029e19ffa3708c
Size

30KB
MD5

ca8205d3f09fd6cff6029e19ffa3708c
SHA1

b86cb3bbec186111b5cb714df07305aeb16fe83c
SHA256

c6593cd7ea41c1016c54ca51c2af262815dca59e3d41e696b842ed7ef5e84aa3
SHA512

0f17198e3ca77c95a8ac9866e3c0d9e5cb0a883dc1dbfd44400969d06785dff47b3ef35d159f8965e1f3ba1514acf266235113e2a02d42a772474449523a2ed0
SSDEEP

384:9T9ZdgR4/4wy2uNYqCGmlv1oc7gPplMHyyH7Ruzlo0Qdn15rcrLchl:9gXw2qqCp7Upl8y2Ruzlo0InIrLc

Score

1^/10

Malware Config

Signatures

Files

ca8205d3f09fd6cff6029e19ffa3708c
.exe windows:4 windows x86 arch:x86

71b2eada43851d0d02debb8191ddd99e

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:de:cb:b7:36:d1:f6:1f:da:47:d3:2e:b1:38:da:33
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

08/11/2006, 00:00

Not After

08/11/2008, 23:59

Subject

CN=HIPOINT Ltd.\, S.A.,OU=SECURE APPLICATION DEVELOPMENT,O=HIPOINT Ltd.\, S.A.,L=Panama,ST=Panama,C=PA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
WriteFile
ReadFile
DeleteFileA
CloseHandle
GetFileSize
CreateFileA
CreateThread
CopyFileA
GetStringTypeA
LCMapStringW
GetModuleFileNameA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
ExitProcess
CreateDirectoryA
GetWindowsDirectoryA
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
Sleep
WinExec
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetFileType
GetStdHandle
GetStringTypeW
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
LCMapStringA
HeapReAlloc
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte

user32

DispatchMessageA
TranslateMessage
GetMessageA
wsprintfA

advapi32

RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA

wsock32

connect
socket
WSAStartup
ioctlsocket
sendto
recvfrom
htons

comctl32

InitCommonControlsEx

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71b2eada43851d0d02debb8191ddd99e

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

58:de:cb:b7:36:d1:f6:1f:da:47:d3:2e:b1:38:da:33Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wsock32

comctl32

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 240B

01
Certificate

0a
Certificate

58:de:cb:b7:36:d1:f6:1f:da:47:d3:2e:b1:38:da:33
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 240B