19539a00b79765903c5b832a9b717ff310ae82f088fae2a8f36bce08141aa8d4

Sharing

Copy URL Twitter E-mail

General

Target

19539a00b79765903c5b832a9b717ff310ae82f088fae2a8f36bce08141aa8d4
Size

2.0MB
MD5

8be87814c747aa872265566f1a7a0ae0
SHA1

a3967992027cd18176b7980341f853278aa24293
SHA256

19539a00b79765903c5b832a9b717ff310ae82f088fae2a8f36bce08141aa8d4
SHA512

f60cacd46dacf041424b0fa0277eecf33d419650b444dfd3f23a316ca1f2a9f0eb8e1b83574866582cbaa6db2972eab327ccc5aa3d7c87e0888b9d281ba2ac59
SSDEEP

49152:GL4LwOR6xQ6MpHG2/t+ReHGqOJ+XliJrEfqr+1EasaV9cmdMvae+461XbRaeOvbQ:GcLwORMQ6MDttmqOJ+XliJrECrxasaVV

Score

1^/10

Malware Config

Signatures

Files

19539a00b79765903c5b832a9b717ff310ae82f088fae2a8f36bce08141aa8d4
.exe windows:5 windows x86 arch:x86

f29c32d85b2eb99e0f1e0067f1213eff

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/09/2010, 00:00

Not After

23/11/2013, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:ba:e1:d1:ab:2f:99:f6:a8:4d:69:28:08:70:ee:87:80:19:47:1e
Signer

Actual PE Digest

bb:ba:e1:d1:ab:2f:99:f6:a8:4d:69:28:08:70:ee:87:80:19:47:1e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\bld_area\SEP_12.1\Output\SEPClientCI\Bin.iru\smcinst.pdb

Imports

user32

InvertRect
SubtractRect
MapVirtualKeyExA
IsCharLowerA
GetIconInfo
GetDoubleClickTime
CharUpperBuffA
CopyIcon
RegisterClipboardFormatA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetMenuDefaultItem
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
PostThreadMessageA
CreateMenu
IsMenu
UpdateLayeredWindow
EnableScrollBar
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
UnionRect
GetKeyNameTextA
HideCaret
GetNextDlgTabItem
EndDialog
CopyImage
LockWindowUpdate
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CopyAcceleratorTableA
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawStateA
MessageBeep
GetSystemMenu
LoadMenuW
SetClassLongA
GetAsyncKeyState
NotifyWinEvent
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
IsRectEmpty
GetMenuItemInfoA
InflateRect
UnpackDDElParam
ReuseDDElParam
GetNextDlgGroupItem
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
CreateDialogIndirectParamA
LoadMenuA
DestroyMenu
LoadImageA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
IntersectRect
OffsetRect
BringWindowToTop
TranslateAcceleratorA
UnregisterClassA
DestroyIcon
IsIconic
ShowWindow
MoveWindow
IsDialogMessageA
CheckDlgButton
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
IsChild
GetClassLongA
DrawEdge
GetActiveWindow
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetSystemMetrics
DispatchMessageW
GetMessageA
IsWindowUnicode
DispatchMessageA
TranslateMessage
GetMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
CharNextA
GetWindowTextA
GetClassNameA
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
AppendMenuA
GetMenuStringA
GetMenuState
PostMessageA
PostQuitMessage
PeekMessageA
WaitMessage
KillTimer
SetTimer
EnableWindow
CheckMenuItem
EnableMenuItem
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
GetKeyState
IsWindowVisible
MessageBoxA
CallNextHookEx
SetWindowsHookExA
SetCursor
ShowOwnedPopups
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowThreadProcessId
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
LoadCursorA
UnhookWindowsHookEx
GetWindowTextLengthA
ClientToScreen
ScreenToClient
SetCapture
WindowFromPoint
GetCapture
LoadCursorW
ReleaseCapture
GetDesktopWindow
DeleteMenu
CopyRect
SetRectEmpty
GetMonitorInfoA
SystemParametersInfoA
EnumDisplayMonitors
SetLayeredWindowAttributes
GetClientRect
MapWindowPoints
DefWindowProcA
GetClassInfoA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
SetWindowTextA
PtInRect
GetWindowRect
GetDlgCtrlID
GetWindow
RealChildWindowFromPoint
UpdateWindow
InvalidateRect
CharUpperA
SetWindowPos
SetWindowLongA
GetMenu
CallWindowProcA

msi

ord31
ord117
ord160
ord141
ord8
ord91
ord67
ord204
ord159

kernel32

GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
EnumSystemLocalesA
HeapReAlloc
WriteConsoleW
SetEnvironmentVariableA
SetHandleCount
GetTimeZoneInformation
GetLocaleInfoW
GetStdHandle
LCMapStringW
IsValidCodePage
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
SetStdHandle
HeapQueryInformation
CreateThread
ExitThread
ExitProcess
VirtualQuery
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
InterlockedIncrement
GetUserDefaultLCID
VirtualProtect
GetNumberFormatA
SearchPathA
GetProfileIntA
GetACP
GetOEMCP
GetCPInfo
GetTempPathA
GetTempFileNameA
SetErrorMode
FindResourceA
FreeResource
GlobalFindAtomA
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
GetFileAttributesExA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpiA
GlobalFlags
lstrcpyA
GetCurrentDirectoryA
FileTimeToSystemTime
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
ReleaseActCtx
CreateActCtxW
GlobalAddAtomA
GetPrivateProfileIntA
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThreadId
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
LoadLibraryExA
CompareStringA
ActivateActCtx
DeactivateActCtx
lstrcmpA
SetLastError
MulDiv
CopyFileA
CreateDirectoryA
DeleteFileA
SleepEx
GetExitCodeProcess
CreateProcessA
CreateFileA
GetStartupInfoA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
WaitForSingleObject
WaitForMultipleObjectsEx
WaitForMultipleObjects
OpenEventW
CreateEventW
ResetEvent
PulseEvent
OpenSemaphoreW
CreateSemaphoreW
ReleaseSemaphore
DuplicateHandle
GetCurrentProcessId
OpenProcess
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
InitializeCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
EnterCriticalSection
DeleteCriticalSection
LoadLibraryExW
LoadLibraryW
GetModuleHandleW
CompareStringW
LocalAlloc
LocalFree
FindFirstFileA
FindClose
VirtualAlloc
HeapAlloc
HeapSize
VirtualFree
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetModuleFileNameW
GetFileAttributesW
OutputDebugStringW
CreateFileW
GetFileSize
ReadFile
GetVersionExW
GetSystemInfo
GetCurrentThread
GetCurrentProcess
VerSetConditionMask
VerifyVersionInfoW
lstrlenW
FindResourceExW
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryA
SetEvent
OpenEventA
CloseHandle
WaitForSingleObjectEx
CreateMutexA
CreateEventA
InterlockedExchange
GetLocalTime
GetTickCount
lstrlenA
FormatMessageA
SetConsoleCtrlHandler
Sleep
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetLastError
GetVersionExA
SetFileAttributesA
GetFileAttributesA
WritePrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
GetPrivateProfileStringA
IsValidLocale

gdi32

SetMapMode
CopyMetaFileA
CreateDCA
CreateBitmap
SetPixelV
GetTextFaceA
EnumFontFamiliesExA
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
GetSystemPaletteEntries
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
Rectangle
SetPixel
StretchBlt
RealizePalette
SetDIBColorTable
GetRgnBox
OffsetRgn
DPtoLP
SetRectRgn
Polygon
Ellipse
Polyline
CreateEllipticRgn
PatBlt
GetTextColor
GetBkColor
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetTextExtentPoint32A
CreateHatchBrush
GetObjectType
SelectPalette
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
DeleteObject
GetTextCharsetInfo
EnumFontFamiliesA
GetTextMetricsA
BitBlt
CreateCompatibleDC
CreateRectRgnIndirect
CreateCompatibleBitmap
GetObjectA
CreateFontIndirectA
CreatePatternBrush
CreateSolidBrush
CreatePen
GetStockObject
CreateDIBitmap
GetDeviceCaps

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExW
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
FreeSid
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
RegEnumKeyExA
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
EqualSid
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
InitializeSecurityDescriptor
RegQueryValueExW
RegDeleteValueW
TraceMessage
ChangeServiceConfigA
StartServiceA
StartServiceCtrlDispatcherA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
CloseServiceHandle
ChangeServiceConfig2A
CreateServiceA
OpenSCManagerA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
DeleteAce
GetAclInformation

comctl32

ImageList_GetIconSize

shlwapi

PathAppendW
SHDeleteEmptyKeyW
PathIsUNCServerW
PathRemoveFileSpecW
PathAddBackslashW
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
SHDeleteKeyW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
IIDFromString
OleLoadFromStream
CreateStreamOnHGlobal
GetHGlobalFromStream
OleSaveToStream
StringFromGUID2
CLSIDFromString
CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoCreateGuid
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitialize

oleaut32

VarBstrFromDate
GetErrorInfo
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
SysAllocStringLen
SafeArrayCreate
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnlock
SafeArrayRedim
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantCopyInd
VariantClear
VariantInit
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString

wsock32

WSACleanup
WSASetLastError
WSAStartup

gdiplus

GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipDeleteGraphics
GdiplusShutdown
GdipFree
GdipCreateFromHDC
GdipAlloc
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipDisposeImage

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundA

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 314KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f29c32d85b2eb99e0f1e0067f1213eff

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bfCertificate

Extended Key Usages

Key Usages

bb:ba:e1:d1:ab:2f:99:f6:a8:4d:69:28:08:70:ee:87:80:19:47:1eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

msi

kernel32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

wsock32

gdiplus

oleacc

imm32

winmm

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 314KB - Virtual size: 314KB

.data Size: 26KB - Virtual size: 56KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 187KB - Virtual size: 186KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

bb:ba:e1:d1:ab:2f:99:f6:a8:4d:69:28:08:70:ee:87:80:19:47:1e
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 314KB - Virtual size: 314KB

.data
Size: 26KB - Virtual size: 56KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 187KB - Virtual size: 186KB