e0fd7154211531745de9f5ac8203d963

Sharing

Copy URL

Twitter E-mail

General

Target

e0fd7154211531745de9f5ac8203d963
Size

19.8MB
MD5

e0fd7154211531745de9f5ac8203d963
SHA1

df69c38706c1a69e6652aca962352ae1011bed40
SHA256

931a0f3e33dfb105366e5a098b5dda491e9448c7412ef4e3431f215907039eb7
SHA512

0b002a63f4f41e11b3044822228f2ee40c794cf2528dba88adca62982829c5b2eb602a2395cab2cec16589f2d61317e8dec0c114d35a47f06b459095b200224b
SSDEEP

393216:FzFzHJn5/UFVMqkMIzmNeu6MEsmjyEEJxao5DxG2qVbdI+lNb5Py7MvyVY:9FHV5/kMqLIzmojDjyrJxFtxG2+a+jVn

Score

1^/10

Malware Config

Signatures

Files

e0fd7154211531745de9f5ac8203d963
.rar
autocad2008lockedsp1x32.exe
.exe windows:4 windows x86 arch:x86

b09e598179dfeac80a7c5e8bcd5d88cf

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

21/09/2009, 23:59

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameW
GlobalFree
GetCommandLineW
GetLastError
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempPathW
SetLastError
GetSystemInfo
GetProcAddress
GetModuleHandleW
GetVersionExW
DeleteFileW
SetThreadLocale
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReadFile
SetEndOfFile
CreateFileA
LoadLibraryA
InitializeCriticalSection
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
Sleep
DeleteCriticalSection
GetFileAttributesW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

MessageBoxW
wsprintfW
LoadStringW

shell32

CommandLineToArgvW

msi

ord96
ord70
ord78
ord113
ord8
ord150
ord190
ord72
ord141

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
autocad2008lockedsp1x64.exe
.exe windows:4 windows x64 arch:x64

9634c5d2bd155b4a5d9a3ac3e207aa9c

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

21/09/2009, 23:59

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFullPathNameW
GlobalFree
GetCommandLineW
GetLastError
LockResource
LoadResource
SizeofResource
FindResourceW
GetTempPathW
SetLastError
GetSystemInfo
GetProcAddress
GetModuleHandleW
GetVersionExW
DeleteFileW
SetThreadLocale
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReadFile
SetEndOfFile
CreateFileA
LoadLibraryA
HeapReAlloc
InitializeCriticalSection
CreateFileW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetStartupInfoA
GetModuleHandleA
FlsGetValue
FlsSetValue
TlsFree
FlsFree
GetCurrentThreadId
FlsAlloc
RtlVirtualUnwind
GetCPInfo
GetACP
GetOEMCP
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
Sleep
DeleteCriticalSection
GetFileAttributesW
HeapSetInformation
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

MessageBoxW
wsprintfW
LoadStringW

shell32

CommandLineToArgvW

msi

ord96
ord70
ord78
ord113
ord8
ord150
ord190
ord72
ord141

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11.7MB - Virtual size: 11.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b09e598179dfeac80a7c5e8bcd5d88cf

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

shell32

msi

Sections

.text Size: 72KB - Virtual size: 70KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 8.1MB - Virtual size: 8.1MB

9634c5d2bd155b4a5d9a3ac3e207aa9c

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msi

Sections

.text Size: 97KB - Virtual size: 96KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 11.7MB - Virtual size: 11.7MB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42
Certificate

.text
Size: 72KB - Virtual size: 70KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 8.1MB - Virtual size: 8.1MB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

73:7e:5b:e4:2a:5d:46:2e:3e:c1:1d:6c:a4:14:4c:42
Certificate

.text
Size: 97KB - Virtual size: 96KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 11.7MB - Virtual size: 11.7MB