8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d

Sharing

Copy URL Twitter E-mail

General

Target

8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
Size

50.5MB
MD5

3e783a62c7fc85f00e66e14c5486dd3c
SHA1

74db726e7647b5761e5ee59a4af9186d4bc0565d
SHA256

8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
SHA512

fef258075bb9e33894ec59e3156b71d5acbdee8cfeb642091db2ce1777197cdbfa3c31c51474b695ba238360b9bb14e338a79495b965c96cab680b07bf9d899f
SSDEEP

1572864:mQB4fzl1mP4qEZ2z9ztZ/aXT2rEsabUOmkTLUZbgW:mA4fuP4qEirPrEFUOmkTibV

Score

1^/10

Malware Config

Signatures

Files

8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
.exe windows:5 windows x86 arch:x86

2c249b0e6e58031d6f455ddf67bc0098

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:bb:7e:65:86:c7:d0:0d:36:17:00:e4:13:9f:e7:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/02/2015, 00:00

Not After

06/02/2016, 23:59

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\nsis2\src\build\urelease\stub_lzma\stub_lzma.pdb

Imports

kernel32

CloseHandle
SetFileTime
SetEndOfFile
SetFilePointer
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
HeapAlloc
GetModuleFileNameW
GetProcAddress
TerminateProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
UnregisterWaitEx
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
lstrcpynA
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
RegisterWaitForSingleObject
GetEnvironmentVariableW
CreateEventW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetSystemDirectoryW
GetSystemTimeAsFileTime
InterlockedExchange
OpenProcess
lstrcpyW
LoadLibraryA
GetVersionExW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
SetConsoleCtrlHandler
FileTimeToLocalFileTime
SetConsoleMode
GetConsoleMode
GetStdHandle
DeleteCriticalSection
lstrcmpiW
LeaveCriticalSection
LocalFree
FormatMessageW
GetCurrentDirectoryW
SetLastError
FindCloseChangeNotification
FindFirstChangeNotificationW
GetLogicalDriveStringsW
FileTimeToSystemTime
WaitForMultipleObjects
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
CreateFileA
WriteConsoleW
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
FatalAppExitA
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
GetLocaleInfoW
IsProcessorFeaturePresent
VirtualQuery
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
IsValidLocale
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
HeapSetInformation
HeapReAlloc
RtlUnwind
EncodePointer
DecodePointer
RaiseException
ExitThread
lstrcmpW
GlobalFree
ExpandEnvironmentStringsW
GlobalAlloc
GetExitCodeProcess
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
WriteFile
MultiByteToWideChar
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
SetDllDirectoryW
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
VirtualAlloc
VirtualFree
WaitForSingleObject
GetFileSize
ReadFile
GetProcessHeap
EnterCriticalSection
HeapFree

user32

CharPrevW
CharUpperW
CharNextA
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
wvsprintfW
SystemParametersInfoW
DispatchMessageW
GetClassInfoW
DialogBoxParamW
SetWindowPos
EndPaint
DrawTextW
FillRect
GetClientRect
BeginPaint
DefWindowProcW
SendMessageW
InvalidateRect
EnableWindow
PeekMessageW
CreateWindowExW
wsprintfA
CharPrevExA
CharLowerW
CharToOemW
RegisterClassW
DestroyWindow
IsWindowEnabled
SetClassLongW
GetDC
LoadImageW
SetWindowLongW
CallWindowProcW
GetSystemMenu
EnableMenuItem
CreateDialogParamW
EndDialog
GetSystemMetrics
CreatePopupMenu
AppendMenuW
GetWindowRect
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadBitmapW
IsWindowVisible
GetMessagePos
ScreenToClient
IsDlgButtonChecked
GetAsyncKeyState
CheckDlgButton
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
ExitWindowsEx
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem

gdi32

SetBkColor
GetDeviceCaps
CreateBrushIndirect
DeleteObject
SelectObject
SetTextColor
CreateFontIndirectW
SetBkMode

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteW
SHFileOperationW
SHGetFileInfoW

advapi32

RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
RegDeleteKeyW

comctl32

ImageList_Destroy
ImageList_AddMasked
ImageList_Create
ord17

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

oleaut32

SysAllocStringByteLen
VariantCopy
VariantClear
SysFreeString
SysAllocString

psapi

GetModuleInformation

dnsapi

DnsQuery_A
DnsFree

ws2_32

inet_addr
htonl
inet_ntoa

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

Sections

.text
Size: 550KB - Virtual size: 550KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c249b0e6e58031d6f455ddf67bc0098

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:bb:7e:65:86:c7:d0:0d:36:17:00:e4:13:9f:e7:72Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

oleaut32

psapi

dnsapi

ws2_32

iphlpapi

Sections

.text Size: 550KB - Virtual size: 550KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 16KB - Virtual size: 2.9MB

.idata Size: 9KB - Virtual size: 9KB

.ndata Size: - Virtual size: 1.1MB

.rsrc Size: 367KB - Virtual size: 367KB

.reloc Size: 31KB - Virtual size: 31KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:bb:7e:65:86:c7:d0:0d:36:17:00:e4:13:9f:e7:72
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 550KB - Virtual size: 550KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 16KB - Virtual size: 2.9MB

.idata
Size: 9KB - Virtual size: 9KB

.ndata
Size: - Virtual size: 1.1MB

.rsrc
Size: 367KB - Virtual size: 367KB

.reloc
Size: 31KB - Virtual size: 31KB