rss-2011[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rss-2011.exe
Size

33.9MB
MD5

612ba1fc8607e7a943edfaf14c05334e
SHA1

728c5e31a13bcf7081aab8919588692f902c3f31
SHA256

040bbefca0919d503d1f0a2a19ef7d101dccd8015545d926fe745840dbe3f0b2
SHA512

9abee23a05e5068f59265b2d6e34583e0a24fe82ee74d2bf130dbec8677a57c4c278dd50ede71e6f3b4e68860da70d48f9378cfce7fd6f7a525beb1aa21a404b
SSDEEP

786432:Msge4/KQPafQYoNPtIWThhKrnGpRd7n5y2PTeIMupKcUR/+opOwG08Q4A6:Ge4SQPaf0Rnkgr75y2PTbPUEogwp8E6

Score

1^/10

Malware Config

Signatures

Files

rss-2011.exe
.exe windows:6 windows x86 arch:x86

ef0f1c1159f66f8a6a97197feea6daf1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:94:19:90:6e:d9:8d:b4:72:c3:76:50:ba:46:d6:d2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/03/2009, 00:00

Not After

11/03/2011, 23:59

Subject

CN=CJSC Returnil Software,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Configuration Management,O=CJSC Returnil Software,L=St. Petersburg,ST=St. Petersburg,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:44:e0:01:4e:c8:2c:48:b8:0a:7f:71:05:4a:a4:8d:be:29:cf:12
Signer

Actual PE Digest

4b:44:e0:01:4e:c8:2c:48:b8:0a:7f:71:05:4a:a4:8d:be:29:cf:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ML_SETUP.pdb

Imports

kernel32

LoadLibraryA
GetModuleHandleA
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
FormatMessageW
lstrlenW
GetLastError
LockResource
LoadResource
SizeofResource
FindResourceW
DeleteFileW
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTempPathW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcatW
lstrcpyW
HeapAlloc
GetCommandLineW
GetModuleFileNameW
GetLocaleInfoW
GetSystemDefaultLCID
GetUserDefaultLCID
SetLastError
OutputDebugStringA
HeapFree
CreateThread
TerminateProcess
GetCurrentProcess
HeapDestroy
GetExitCodeThread
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind

user32

EndDialog
SetWindowTextW
EnableWindow
SendDlgItemMessageA
SendDlgItemMessageW
LoadStringW
GetDlgItem
DialogBoxParamW
MessageBoxW
SendMessageA
SendMessageW
wsprintfW
ShowWindow

ntdll

memset
wcsncpy
_wcsnicmp
_chkstk
_itow

shell32

SHFileOperationW

shlwapi

StrCmpNIW
StrCmpNW
StrStrW

msi

ord8
ord92
ord19
ord20

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33.7MB - Virtual size: 33.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef0f1c1159f66f8a6a97197feea6daf1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

6c:94:19:90:6e:d9:8d:b4:72:c3:76:50:ba:46:d6:d2Certificate

Extended Key Usages

Key Usages

4b:44:e0:01:4e:c8:2c:48:b8:0a:7f:71:05:4a:a4:8d:be:29:cf:12Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ntdll

shell32

shlwapi

msi

Sections

.text Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 33.7MB - Virtual size: 33.7MB

.reloc Size: 4KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

6c:94:19:90:6e:d9:8d:b4:72:c3:76:50:ba:46:d6:d2
Certificate

4b:44:e0:01:4e:c8:2c:48:b8:0a:7f:71:05:4a:a4:8d:be:29:cf:12
Signer

.text
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 33.7MB - Virtual size: 33.7MB

.reloc
Size: 4KB - Virtual size: 4KB