419828e28d2781cb45c57d88421d066b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

419828e28d2781cb45c57d88421d066b_JaffaCakes118
Size

18.2MB
MD5

419828e28d2781cb45c57d88421d066b
SHA1

daa39d7642cfe49f25943fe2800c40ff37b00c0a
SHA256

8e8087bdd7cd43d0641278c1eb9ad54ae662667b7478755060c285d87fe3ef01
SHA512

5d12d49b10520ce20d76328ea55c16d1be219838367aa7b84744f5820ddbfe2b4fe1ac36d3d19f3923d189912307e53211fd27bc50aa2b42a65ddb6ce2676ba4
SSDEEP

393216:x1PCj0S8jGBkJdt8t5OhSjPFQopwtfufrCj0AR:xZCj0pasde9UtfujCj0O

Score

1^/10

Malware Config

Signatures

Files

419828e28d2781cb45c57d88421d066b_JaffaCakes118
.cab
avgcorea.dll
.dll windows:5 windows x64 arch:x64

47d42ba58893d60433e322cd56791da9

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

02-12-2013 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2012 00:00

Not After

05-01-2015 23:59

Subject

CN=AVG Technologies CZ\, s.r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies CZ\, s.r.o.,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:0d:b9:8c:6a:ca:a2:5d:87:50:5e:60:3d:8c:1c:cd:15:40:76:c2
Signer

Actual PE Digest

50:0d:b9:8c:6a:ca:a2:5d:87:50:5e:60:3d:8c:1c:cd:15:40:76:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2013_0301_185640_2013-02_CoreDist\source\core\core_vs100\bin\Release_Unicode_NTDLL_vs100\x64\avgcorea.pdb

Imports

ntdll

ZwQueryPerformanceCounter
memset
__chkstk
memcpy
memmove
memcmp
RtlRaiseException
RtlUnwindEx
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
ZwClose
ZwOpenProcessToken
NtClose
RtlOpenCurrentUser
RtlFreeUnicodeString
ZwCreateKey
ZwOpenKey
RtlCreateSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAceEx
ZwQueryInformationToken
RtlEqualSid
RtlGetAce
ZwOpenFile
ZwQuerySecurityObject
ZwQueryValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryInformationProcess
ZwOpenProcess
ZwQueryVirtualMemory
ZwReadVirtualMemory
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlTimeFieldsToTime
ZwTerminateProcess
DbgPrint
RtlLookupFunctionEntry
RtlGetFullPathName_U
LdrUnloadDll
LdrGetProcedureAddress
RtlInitAnsiString
LdrLoadDll
RtlInitUnicodeString
strncpy
toupper
_stricmp
_strnicmp
_strcmpi
towupper
ZwCreateEvent
ZwWaitForSingleObject
ZwSetEvent
RtlDowncaseUnicodeString
RtlUpcaseUnicodeString
ZwOpenThread
ZwQueryInformationThread
ZwSetInformationThread
ZwDelayExecution
ZwResumeThread
ZwTerminateThread
ZwFreeVirtualMemory
ZwDuplicateObject
RtlExitUserThread
CsrClientCallServer
RtlCreateUserThread
RtlQueryEnvironmentVariable_U
RtlGetNativeSystemInformation
RtlInitializeCriticalSection
RtlDeleteCriticalSection
ZwReleaseMutant
RtlDosPathNameToNtPathName_U
RtlExpandEnvironmentStrings_U
RtlCreateUnicodeString
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwFlushBuffersFile
ZwFlushVirtualMemory
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwFsControlFile
ZwMapViewOfSection
ZwCreateSection
ZwSetInformationProcess
RtlGetCurrentDirectory_U
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlAnsiStringToUnicodeString
RtlOemStringToUnicodeString
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
NtRaiseException
RtlPcToFileHeader
RtlVirtualUnwind
RtlCaptureContext
ZwDeviceIoControlFile
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryVolumeInformationFile
RtlReleasePebLock
RtlAcquirePebLock
LdrGetDllHandle
RtlCopySid
RtlAddAccessDeniedAceEx
ZwSetSecurityObject
floor
ZwDisplayString
iswdigit
islower
iswspace
RtlDowncaseUnicodeChar
RtlUpcaseUnicodeChar
ZwResetEvent
RtlClearBits
RtlFindClearBitsAndSet
RtlAreBitsSet
ZwAllocateVirtualMemory
ZwQueryDirectoryFile
RtlIsDosDeviceName_U
isalpha
sprintf
memchr
strncmp
strchr
strrchr
atoi
_memicmp
cos
log
pow
sin
sqrt
atan
ceil
tan
strtoul
strtol
strstr
_snprintf
_wcsnicmp
_wcsicmp
wcsrchr
fabs
sscanf
ZwCancelIoFile
tolower
isxdigit
isalnum
isupper
isspace
ispunct
isdigit
iscntrl
strpbrk
strncat
strcspn
ZwWaitForMultipleObjects
RtlTimeToTimeFields
ZwCreateSemaphore
ZwReleaseSemaphore

Exports

Exports

AvgModuleFinish
AvgModuleInit
CoreMergeSdkGetInstance
CoreMergeSdkGetInstance_V2
CoreSdkGetInstance
CoreSdkGetInstance_V2
CoreSdkGetScannerVersionInfo
CoreSdkSetAviLoaderName
CoreSdkSetBinaryPath
CoreSdkSetChjw
CoreSdkSetChjwPipeName
CoreSdkSetDataPath
CoreSdkSetLogPath
CoreSdkSetLogger
CoreSdkSetMergeLogger
CoreSdkSetRegistryPath
CoreSdkSetTempPath
CoreSdkSetUserDataPath

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dmpcb
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
avgcorex.dll
.dll windows:5 windows x86 arch:x86

fae3572e1b18c80ccb9245dbd9bb3994

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

02-12-2013 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2012 00:00

Not After

05-01-2015 23:59

Subject

CN=AVG Technologies CZ\, s.r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies CZ\, s.r.o.,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:c1:45:9e:66:58:a1:0e:cf:31:61:1e:14:74:47:e5:e3:e4:2b:87
Signer

Actual PE Digest

5b:c1:45:9e:66:58:a1:0e:cf:31:61:1e:14:74:47:e5:e3:e4:2b:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2013_0301_185640_2013-02_CoreDist\source\core\core_vs100\bin\Release_Unicode_NTDLL_vs100\Win32\avgcorex.pdb

Imports

ntdll

ZwQueryPerformanceCounter
_aulldiv
_allmul
memset
_chkstk
memcpy
memmove
RtlRaiseException
floor
sprintf
_CIpow
isspace
strtoul
strchr
strncat
strcspn
strncpy
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
RtlNtStatusToDosError
ZwClose
NtClose
RtlOpenCurrentUser
RtlFreeUnicodeString
ZwCreateKey
ZwOpenKey
RtlCreateSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAceEx
ZwQueryInformationToken
RtlEqualSid
RtlGetAce
ZwOpenFile
ZwQuerySecurityObject
ZwQueryValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryInformationProcess
ZwOpenProcess
ZwQueryVirtualMemory
ZwReadVirtualMemory
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlTimeFieldsToTime
_aulldvrm
RtlGetFullPathName_U
LdrUnloadDll
LdrGetProcedureAddress
RtlInitAnsiString
LdrLoadDll
RtlInitUnicodeString
DbgPrint
toupper
_stricmp
_strnicmp
_ftol
_strcmpi
towupper
ZwCreateEvent
ZwWaitForSingleObject
ZwSetEvent
RtlDowncaseUnicodeString
RtlUpcaseUnicodeString
ZwOpenThread
ZwQueryInformationThread
ZwSetInformationThread
ZwDelayExecution
ZwResumeThread
ZwTerminateThread
ZwFreeVirtualMemory
ZwDuplicateObject
LdrShutdownThread
ZwTerminateProcess
CsrClientCallServer
RtlCreateUserThread
RtlQueryEnvironmentVariable_U
RtlInitializeCriticalSection
RtlDeleteCriticalSection
ZwReleaseMutant
RtlDosPathNameToNtPathName_U
RtlExpandEnvironmentStrings_U
RtlCreateUnicodeString
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwFlushBuffersFile
ZwFlushVirtualMemory
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwFsControlFile
ZwMapViewOfSection
ZwCreateSection
ZwSetInformationProcess
RtlGetCurrentDirectory_U
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlAnsiStringToUnicodeString
RtlOemStringToUnicodeString
RtlxUnicodeStringToAnsiSize
RtlxUnicodeStringToOemSize
RtlUnicodeStringToAnsiString
RtlUnicodeStringToOemString
_aullshr
NtRaiseException
ZwDeviceIoControlFile
RtlUnwind
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQueryVolumeInformationFile
RtlReleasePebLock
RtlAcquirePebLock
LdrGetDllHandle
RtlCopySid
RtlAddAccessDeniedAceEx
ZwSetSecurityObject
_allshl
ZwDisplayString
iswdigit
islower
iswspace
RtlUpcaseUnicodeChar
ZwResetEvent
RtlClearBits
RtlFindClearBitsAndSet
RtlAreBitsSet
ZwAllocateVirtualMemory
ZwQueryDirectoryFile
RtlIsDosDeviceName_U
isalpha
_alldiv
_allrem
memchr
strncmp
strrchr
_alldvrm
atoi
_memicmp
_allshr
_aullrem
strtol
strstr
_snprintf
_wcsicmp
_wcsnicmp
wcsrchr
sscanf
ZwCancelIoFile
tolower
isxdigit
isalnum
isupper
ispunct
isdigit
iscntrl
strpbrk
ZwWaitForMultipleObjects
RtlTimeToTimeFields
ZwCreateSemaphore
ZwReleaseSemaphore

Exports

Exports

AvgModuleFinish
AvgModuleInit
CoreMergeSdkGetInstance
CoreMergeSdkGetInstance_V2
CoreSdkGetInstance
CoreSdkGetInstance_V2
CoreSdkGetScannerVersionInfo
CoreSdkSetAviLoaderName
CoreSdkSetBinaryPath
CoreSdkSetChjw
CoreSdkSetChjwPipeName
CoreSdkSetDataPath
CoreSdkSetLogPath
CoreSdkSetLogger
CoreSdkSetMergeLogger
CoreSdkSetRegistryPath
CoreSdkSetTempPath
CoreSdkSetUserDataPath

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dmpcb
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
avgcrema.exe
.sys windows:5 windows x64 arch:x64

315ec4816ffc3a9cfbe993eb81b5b2aa

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

02-12-2013 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-01-2012 00:00

Not After

05-01-2015 23:59

Subject

CN=AVG Technologies CZ\, s.r.o.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies CZ\, s.r.o.,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ca:bf:88:1d:0a:46:7b:f9:2b:e2:a4:79:b2:90:2b:0f:c9:9e:a1:59
Signer

Actual PE Digest

ca:bf:88:1d:0a:46:7b:f9:2b:e2:a4:79:b2:90:2b:0f:c9:9e:a1:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\build\user\sandbox_2013_0301_185640_2013-02_CoreDist\source\core\core_vs100\bin\Release_Unicode_NTDLL_vs100\x64\avgcrema.pdb

Imports

ntdll

RtlNtStatusToDosError
RtlDosPathNameToNtPathName_U
RtlCreateUnicodeString
isalpha
RtlInitUnicodeString
RtlFreeHeap
ZwClose
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
ZwCreateFile
NtAllocateLocallyUniqueId
pow
tan
log
cos
sin
__chkstk
sprintf
_memicmp
_stricmp
memchr
atan
strtoul
strncmp
strtol
strstr
_snprintf
swprintf
_wcsicmp
wcsrchr
NtOpenKey
RtlAllocateHeap
NtQueryValueKey
NtClose
NtSetValueKey
RtlDestroyProcessParameters
NtWaitForMultipleObjects
NtResumeThread
RtlCreateUserProcess
NtOpenProcess
RtlCreateProcessParameters
NtCreateEvent
NtOpenFile
NtLoadDriver
NtCreateKey
NtUnloadDriver
NtDeviceIoControlFile
__C_specific_handler
wcsncpy
NtQueryInformationFile
NtQueryDirectoryFile
NtCreateFile
NtSetSecurityObject
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
NtQueryInformationToken
NtOpenProcessToken
RtlFreeSid
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
wcsstr
NtSetInformationFile
RtlGetAce
RtlGetDaclSecurityDescriptor
NtQuerySecurityObject
NtQueryAttributesFile
NtWaitForSingleObject
NtWriteFile
NtFsControlFile
NtReadFile
wcschr
NtDelayExecution
NtAdjustPrivilegesToken
NtShutdownSystem
NtOpenSymbolicLinkObject
NtSetInformationProcess
NtQueryInformationProcess
LdrGetProcedureAddress
RtlInitAnsiString
LdrGetDllHandle
NtCreateSymbolicLinkObject
RtlOpenCurrentUser
NtDeleteValueKey
NtFlushKey
NtEnumerateKey
NtEnumerateValueKey
NtDeleteKey
RtlUnicodeStringToAnsiString
RtlReAllocateHeap
NtQuerySystemInformation
vsprintf
NtQueryVolumeInformationFile
NtQueryKey
wcsncmp
RtlValidateHeap
RtlFillMemory
RtlMoveMemory
ceil
floor
sqrt
RtlFreeUnicodeString
NtDisplayString
RtlCreateUnicodeStringFromAsciiz
_vsnprintf
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtCancelIoFile
NtResetEvent
RtlInitializeCriticalSection
RtlDeleteCriticalSection

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47d42ba58893d60433e322cd56791da9

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:caCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

50:0d:b9:8c:6a:ca:a2:5d:87:50:5e:60:3d:8c:1c:cd:15:40:76:c2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 170KB - Virtual size: 214KB

.pdata Size: 235KB - Virtual size: 234KB

.dmpcb Size: 512B - Virtual size: 80B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 77KB - Virtual size: 76KB

fae3572e1b18c80ccb9245dbd9bb3994

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:caCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5b:c1:45:9e:66:58:a1:0e:cf:31:61:1e:14:74:47:e5:e3:e4:2b:87Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 4.5MB - Virtual size: 4.5MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 104KB - Virtual size: 138KB

.dmpcb Size: 512B - Virtual size: 72B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 226KB - Virtual size: 226KB

315ec4816ffc3a9cfbe993eb81b5b2aa

Code Sign

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

50:0d:b9:8c:6a:ca:a2:5d:87:50:5e:60:3d:8c:1c:cd:15:40:76:c2
Signer

.text
Size: 5.1MB - Virtual size: 5.1MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 170KB - Virtual size: 214KB

.pdata
Size: 235KB - Virtual size: 234KB

.dmpcb
Size: 512B - Virtual size: 80B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 77KB - Virtual size: 76KB

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5b:c1:45:9e:66:58:a1:0e:cf:31:61:1e:14:74:47:e5:e3:e4:2b:87
Signer

.text
Size: 4.5MB - Virtual size: 4.5MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 104KB - Virtual size: 138KB

.dmpcb
Size: 512B - Virtual size: 72B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 226KB - Virtual size: 226KB

22:d8:78:bd:5f:56:04:31:89:22:60:a2:e8:8c:d3:50
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

49:84:48:9d:ec:62:00:de:ce:ad:93:d4:73:2c:ab:ca
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ca:bf:88:1d:0a:46:7b:f9:2b:e2:a4:79:b2:90:2b:0f:c9:9e:a1:59
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 3.8MB - Virtual size: 3.8MB

.data
Size: 2KB - Virtual size: 13KB

.pdata
Size: 57KB - Virtual size: 56KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 54KB - Virtual size: 53KB