cae501a10cbcedbbbf6f213b3b6b8f34

Sharing

Copy URL

Twitter E-mail

General

Target

cae501a10cbcedbbbf6f213b3b6b8f34
Size

189KB
MD5

cae501a10cbcedbbbf6f213b3b6b8f34
SHA1

6308d47e30f3ee02630c0004112deb756c25b10f
SHA256

be3757324a4ccff20d54eedc416729e59187b1ffeacf88da32bf59474f9621a0
SHA512

a9e02fa91e69a045e726d88913b07b6b7f8420ee0aa858d61435a922fbddaeb1fb94a5a35eda31f5ca2751920e69793d70360f7423647997227cebe55b4dd563
SSDEEP

3072:srDqXHY74Ef7BJuS2acIetvt3/qvjJPm/FzopSkfyfemUlZQC+GnR:wz4YBJuxx/ijJPm/FvkfycQC+i

Score

1^/10

Malware Config

Signatures

Files

cae501a10cbcedbbbf6f213b3b6b8f34
.exe windows:4 windows x86 arch:x86

5d0db0116ac90a7402cfd2eb5250b722

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:75:5d:01:68:68:5a:2f:99:74:67:05:73:06:8d:75
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

05-04-2006 00:00

Not After

05-04-2007 23:59

Subject

CN=Nous-Tech Solutions Ltd.,OU=Secure Application Development,O=Nous-Tech Solutions Ltd.,L=Nicosia,ST=Nicosia,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b4:b3:74:25:77:35:37:14:61:e1:fe:cd:0e:c0:fd:d5:ee:94:23:61
Signer

Actual PE Digest

b4:b3:74:25:77:35:37:14:61:e1:fe:cd:0e:c0:fd:d5:ee:94:23:61

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\My Projects\Ultimate Defender\trunk\utils\Uninstaller\Release\Uninstall.pdb

Imports

kernel32

GetShortPathNameA
GetModuleFileNameA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
FindClose
FindNextFileA
FreeLibrary
GetProcAddress
LoadLibraryA
FindFirstFileA
GetFileAttributesA
CreateProcessA
GetCurrentProcessId
GetEnvironmentVariableA
GetTempPathA
MoveFileA
DeleteFileA
SetFileAttributesA
RemoveDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryA
MultiByteToWideChar
RaiseException
InitializeCriticalSection
DeleteCriticalSection
EnumSystemLocalesA
lstrcpyA
lstrcatA
GetCurrentProcess
SetPriorityClass
SetEndOfFile
GetCurrentThread
SetThreadPriority
SetProcessPriorityBoost
OpenProcess
TerminateProcess
GetLastError
WaitForSingleObject
CopyFileA
CloseHandle
GetUserDefaultLCID
SetFilePointer
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetFileType
GetLocaleInfoW
SetStdHandle
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
SetHandleCount
GetEnvironmentStringsW
CreateFileA
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
DeviceIoControl
GetModuleHandleA
WriteFile
ReadFile
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetCommandLineA
LCMapStringA
LCMapStringW
GetCPInfo
GetTickCount
GetCurrentThreadId
GetOEMCP
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
HeapCreate
VirtualFree
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
IsValidLocale

user32

MessageBoxA

advapi32

RegEnumKeyA
RegEnumValueA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryInfoKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetMalloc
ShellExecuteExA
SHChangeNotify

wininet

InternetOpenUrlA
InternetOpenA
InternetCanonicalizeUrlA
InternetGetConnectedState
InternetCloseHandle
InternetReadFile

netapi32

Netbios

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d0db0116ac90a7402cfd2eb5250b722

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3e:75:5d:01:68:68:5a:2f:99:74:67:05:73:06:8d:75Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

b4:b3:74:25:77:35:37:14:61:e1:fe:cd:0e:c0:fd:d5:ee:94:23:61Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

wininet

netapi32

Sections

.text Size: 128KB - Virtual size: 126KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 12KB - Virtual size: 10KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3e:75:5d:01:68:68:5a:2f:99:74:67:05:73:06:8d:75
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

b4:b3:74:25:77:35:37:14:61:e1:fe:cd:0e:c0:fd:d5:ee:94:23:61
Signer

.text
Size: 128KB - Virtual size: 126KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 12KB - Virtual size: 10KB