General

Malware Config

Signatures

Files

• dccc7ec50c5068b1d2fc2a67b93ff582

  .exe windows:4 windows x86 arch:x86

  e5343039bb297b649d3d7398fbb715b2

  
  

  Code Sign

  28:d3:eb:57:67:3a:c1:9b:4a:8e:19:84:35:aa:02:25

  Certificate

  Issuer

  CN=5JCU

  Not Before

  08-06-2012 08:28

  Not After

  31-12-2039 23:59

  Subject

  CN=5JCU

  Extended Key Usages

  ExtKeyUsageCodeSigning

  bd:80:8f:12:46:7e:00:b2:af:37:09:b3:36:7b:57:8f:f7:97:31:0c

  Signer

  Actual PE Digest

  bd:80:8f:12:46:7e:00:b2:af:37:09:b3:36:7b:57:8f:f7:97:31:0c

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ReadFile

  LoadLibraryA

  GetProcAddress

  GetWindowsDirectoryW

  lstrcatW

  CreateFileW

  CloseHandle

  VirtualAllocEx

  gdi32

  GetStockObject

  advapi32

  RegCloseKey

  Sections

  .text

  Size: 32KB - Virtual size: 31KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 91KB - Virtual size: 90KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data6

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data5

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data4

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data3

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data2

  Size: 512B - Virtual size: 100B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ