General

Malware Config

Signatures

Files

• vcredist_x64_2012.exe

  .exe windows:5 windows x86 arch:x86

  a1f6f100bff4507a3332f3f0cdfc24f5

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f

  Signer

  Actual PE Digest

  3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  sfxcab.pdb

  Imports

  msvcrt

  __setusermatherr

  _initterm

  __getmainargs

  __initenv

  exit

  _cexit

  _adjust_fdiv

  _exit

  _c_exit

  strncpy

  strstr

  _strlwr

  strrchr

  _stricmp

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler3

  _controlfp

  _XcptFilter

  _snprintf

  sprintf

  strchr

  _strnicmp

  _vsnprintf

  advapi32

  InitializeAcl

  AddAccessAllowedAce

  SetSecurityDescriptorDacl

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  AllocateAndInitializeSid

  OpenProcessToken

  GetTokenInformation

  GetLengthSid

  InitiateSystemShutdownA

  InitializeSecurityDescriptor

  kernel32

  CreateThread

  GetFileSize

  ExpandEnvironmentStringsA

  CreateProcessA

  GetExitCodeProcess

  InitializeCriticalSectionAndSpinCount

  LocalFileTimeToFileTime

  SetFileTime

  SetEndOfFile

  CreateEventA

  QueryDosDeviceA

  GetDiskFreeSpaceA

  GetSystemTime

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentDirectoryA

  GetProcessHeap

  CopyFileA

  SetFileAttributesA

  DosDateTimeToFileTime

  SetEvent

  GetVersionExA

  ReadFile

  SetFilePointer

  MoveFileExA

  RemoveDirectoryA

  GetLastError

  CreateDirectoryA

  GetTickCount

  SetErrorMode

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetSystemDirectoryA

  CloseHandle

  DeviceIoControl

  CreateFileA

  GetDriveTypeA

  HeapFree

  FormatMessageA

  LeaveCriticalSection

  DeleteFileA

  EnterCriticalSection

  TerminateProcess

  WaitForMultipleObjects

  CreateEventW

  FindFirstFileA

  Sleep

  SetEnvironmentVariableA

  GetEnvironmentVariableA

  WideCharToMultiByte

  HeapAlloc

  SetLastError

  WriteFile

  MoveFileA

  ExitProcess

  DeleteCriticalSection

  FlushFileBuffers

  WaitForSingleObject

  OpenEventA

  GetCurrentProcess

  GetFileAttributesA

  GetCommandLineA

  GetModuleFileNameA

  FindClose

  FindNextFileA

  SystemTimeToFileTime

  user32

  SendDlgItemMessageA

  SendMessageA

  DialogBoxParamA

  MessageBoxA

  SetParent

  EndDialog

  LoadStringA

  ShowWindow

  ntdll

  NtOpenProcessToken

  NtAdjustPrivilegesToken

  NtClose

  NtShutdownSystem

  comctl32

  ord17

  shell32

  SHBrowseForFolderA

  SHGetPathFromIDListA

  Sections

  .text

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9.8MB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ