07282c0676d8bb44e8e3c8b65c603519efbb50e7dd2a2c56e00a2ecba5a800f3

Sharing

Copy URL Twitter E-mail

General

Target

07282c0676d8bb44e8e3c8b65c603519efbb50e7dd2a2c56e00a2ecba5a800f3
Size

127KB
MD5

b2618be4c1eec450a6cade2dec9ce5f4
SHA1

d0ef7b7a14cdc2a0026c54e800f1fbdeeb082b23
SHA256

07282c0676d8bb44e8e3c8b65c603519efbb50e7dd2a2c56e00a2ecba5a800f3
SHA512

d15d1f9dcac5ea61d7e0e2d45f17baff5ca84de46201cc908be35ec782662715c1b6acd5e88c9fac2395ef9b426ce243c8967405a22adb23fbffb8619a014e36
SSDEEP

1536:li5X+Ab7hWqghVUgI2A48d02rhVeXUiby18Kk8+sfDw2TgcTyvQHQtsMBrdhi7:li5X+An0ypT/ZHQtsMBr+7

Score

1^/10

Malware Config

Signatures

Files

07282c0676d8bb44e8e3c8b65c603519efbb50e7dd2a2c56e00a2ecba5a800f3
.exe windows:6 windows x86 arch:x86

4f892fabf39bc5d624fc581ab48eb0c8

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26/07/2012, 20:50

Not After

26/10/2013, 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/07/2012, 00:14

Not After

07/10/2013, 00:14

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:4f:65:1a:45:27:62:ae:fc:a7:f1:5c:e3:86:75:c9:ed:b8:f9:b1:e2:59:0d:b6:2d:ce:e1:04:6f:50:c4:12
Signer

Actual PE Digest

21:4f:65:1a:45:27:62:ae:fc:a7:f1:5c:e3:86:75:c9:ed:b8:f9:b1:e2:59:0d:b6:2d:ce:e1:04:6f:50:c4:12

Digest Algorithm

sha256

PE Digest Matches

false

0a:b1:4c:fa:b1:c5:41:da:58:39:a5:f6:87:33:ec:26:3a:7a:0d:4c
Signer

Actual PE Digest

0a:b1:4c:fa:b1:c5:41:da:58:39:a5:f6:87:33:ec:26:3a:7a:0d:4c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\dd\vsu\target\briqsShared\BRIQS03\retail\i386\MSIPatchRegFix.pdb

Imports

advapi32

RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegDeleteValueA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid

kernel32

GetModuleHandleA
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA
GetLastError
LocalFree
LocalAlloc
FormatMessageA
GetTempPathA
CreateDirectoryA
ExpandEnvironmentStringsA
LoadLibraryA
FreeLibrary
GetProcAddress
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetLocalTime
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
MultiByteToWideChar
LCMapStringW
Sleep
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LeaveCriticalSection
EnterCriticalSection
CloseHandle
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SetEndOfFile
ReadFile

user32

LoadStringA
MessageBoxA

msi

ord148
ord8
ord77

shlwapi

PathFileExistsA
SHDeleteKeyA

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f892fabf39bc5d624fc581ab48eb0c8

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88Certificate

Extended Key Usages

Key Usages

61:02:92:4a:00:00:00:00:00:20Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

21:4f:65:1a:45:27:62:ae:fc:a7:f1:5c:e3:86:75:c9:ed:b8:f9:b1:e2:59:0d:b6:2d:ce:e1:04:6f:50:c4:12Signer

0a:b1:4c:fa:b1:c5:41:da:58:39:a5:f6:87:33:ec:26:3a:7a:0d:4cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msi

shlwapi

Sections

.text Size: 96KB - Virtual size: 92KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 2KB

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

21:4f:65:1a:45:27:62:ae:fc:a7:f1:5c:e3:86:75:c9:ed:b8:f9:b1:e2:59:0d:b6:2d:ce:e1:04:6f:50:c4:12
Signer

0a:b1:4c:fa:b1:c5:41:da:58:39:a5:f6:87:33:ec:26:3a:7a:0d:4c
Signer

.text
Size: 96KB - Virtual size: 92KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 2KB