cbb63341506b0ad017f844c27d6e44c0

Sharing

Copy URL Twitter E-mail

General

Target

cbb63341506b0ad017f844c27d6e44c0
Size

15.2MB
MD5

cbb63341506b0ad017f844c27d6e44c0
SHA1

66085cdd0fc4cb52f246b10207f2acef403f4143
SHA256

7ff2a2ea7bf91cca05a577a3e483696206b218a8661907da01ba0247421421d3
SHA512

bf292ce582abb92bbc6056a67eb52378a0d620b287d92116047c9ecd66ef670da3bb1aa86c7757c5e2a52ee4306266b79d6859132abd283e427e553272869e4b
SSDEEP

393216:l+isVmvs3Uji+W+vgwhbQAO76qugD1TdWIG0fU:lVS3UO+WedhUNm7gDtdDRU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/keygen.exe

Files

cbb63341506b0ad017f844c27d6e44c0
.rar
keygen.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
setup.exe
.exe windows:1 windows x86 arch:x86

Code Sign

05:ab:96
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

01/02/2006, 21:44

Not After

30/01/2016, 21:44

Subject

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8
Certificate

Issuer

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Not Before

25/08/2006, 14:34

Not After

25/08/2009, 14:34

Subject

CN=SiSoftware Ltd,OU=Development+OU=GeoTrust Code Signing,O=SiSoftware Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:35:8f
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

13/02/2006, 15:40

Not After

11/02/2016, 15:40

Subject

CN=GeoTrust TrustCenter Authenticode Timestamp I,OU=GeoTrust TrustCenter Timestamp,O=GeoTrust Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ff:33:e2:c0:e5:59:f4:34:3c:6c:48:f4:4f:e6:a8:c1:36:49:90:14
Signer

Actual PE Digest

ff:33:e2:c0:e5:59:f4:34:3c:6c:48:f4:4f:e6:a8:c1:36:49:90:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
安装说明.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

Size: - Virtual size: 180KB

Size: 90KB - Virtual size: 92KB

Code Sign

05:ab:96Certificate

Extended Key Usages

Key Usages

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8Certificate

Extended Key Usages

Key Usages

02:35:8fCertificate

Extended Key Usages

Key Usages

ff:33:e2:c0:e5:59:f4:34:3c:6c:48:f4:4f:e6:a8:c1:36:49:90:14Signer

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 35KB

DATA Size: 1024B - Virtual size: 584B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 86KB - Virtual size: 85KB

05:ab:96
Certificate

8d:a9:00:01:00:20:ba:96:5f:e3:dc:47:1b:a8
Certificate

02:35:8f
Certificate

ff:33:e2:c0:e5:59:f4:34:3c:6c:48:f4:4f:e6:a8:c1:36:49:90:14
Signer

CODE
Size: 36KB - Virtual size: 35KB

DATA
Size: 1024B - Virtual size: 584B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 86KB - Virtual size: 85KB