General

Malware Config

Signatures

Files

• 60f853180a79a596f490b01c554832dac7f2e469a94d8a213b1e5452c1e49d5b.exe

  .exe windows:6 windows x86 arch:x86

  7ea32c306ac565556e3d4606515b19e5

  
  

  Code Sign

  38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

  Certificate

  Issuer

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Not Before

  15-06-2007 00:00

  Not After

  14-06-2012 23:59

  Subject

  CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  04-12-2003 00:00

  Not After

  03-12-2013 23:59

  Subject

  CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  16-07-2004 00:00

  Not After

  15-07-2014 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1a:ab:a1:ed:0c:8f:63:f3:bf:2b:e0:d4:c0:50:a2:08

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

  Not Before

  07-05-2007 00:00

  Not After

  18-05-2008 23:59

  Subject

  CN=CACE TECHNOLOGIES\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CACE TECHNOLOGIES\, LLC,L=Davis,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:0c:12:06:00:00:00:00:00:1b

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-05-2006 17:01

  Not After

  23-05-2016 17:11

  Subject

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  14:cf:1c:71:50:10:54:7b:ae:80:45:a1:46:cb:a5:04:e9:49:53:4b

  Signer

  Actual PE Digest

  14:cf:1c:71:50:10:54:7b:ae:80:45:a1:46:cb:a5:04:e9:49:53:4b

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FreeLibrary

  CreateDirectoryW

  SetLastError

  GetCommandLineW

  FindNextFileW

  GetCurrentProcess

  FindClose

  MultiByteToWideChar

  GetLastError

  GlobalFlags

  GetSystemInfo

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateProcessW

  GetModuleHandleW

  WideCharToMultiByte

  VirtualQuery

  HeapFree

  HeapReAlloc

  HeapAlloc

  GetProcessHeap

  SetEvent

  CreateThread

  ResetEvent

  GetSystemTimeAsFileTime

  WriteConsoleW

  HeapSize

  LoadLibraryW

  GetStringTypeW

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  LCMapStringW

  CompareStringW

  GetConsoleMode

  GetConsoleOutputCP

  GetFileType

  SetFilePointerEx

  DecodePointer

  GetStdHandle

  GetCommandLineA

  GetModuleHandleExW

  LoadLibraryExW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  EncodePointer

  RaiseException

  RtlUnwind

  InitializeSListHead

  QueryPerformanceCounter

  GetStartupInfoW

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetTickCount

  DeleteCriticalSection

  FindResourceW

  LoadResource

  LockResource

  FreeResource

  GetCurrentThreadId

  Sleep

  InitializeCriticalSection

  SizeofResource

  MulDiv

  GlobalUnlock

  GlobalLock

  GlobalFree

  GlobalAlloc

  LeaveCriticalSection

  EnterCriticalSection

  GetProcAddress

  TryEnterCriticalSection

  GetProcessHandleCount

  TerminateProcess

  OpenProcess

  GetCurrentProcessId

  GetLocalTime

  WriteFile

  IsDebuggerPresent

  CreateEventW

  GetModuleFileNameW

  WaitForSingleObjectEx

  InitializeCriticalSectionAndSpinCount

  ExitProcess

  CloseHandle

  CreateFileW

  FlushFileBuffers

  user32

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetDC

  LoadImageW

  GetParent

  GetDesktopWindow

  LoadCursorW

  LoadIconW

  LoadStringW

  SendMessageW

  GetWindowLongW

  MessageBoxW

  ReleaseDC

  GetWindowThreadProcessId

  MonitorFromWindow

  WaitForInputIdle

  EnumWindows

  gdi32

  SelectObject

  CreateDIBSection

  SetDIBColorTable

  CreateCompatibleDC

  GetDeviceCaps

  DeleteDC

  GetObjectW

  DeleteObject

  shell32

  ShellExecuteW

  ole32

  CreateStreamOnHGlobal

  CoUninitialize

  CoInitializeEx

  oleaut32

  SystemTimeToVariantTime

  comctl32

  ImageList_Destroy

  ImageList_Create

  ImageList_AddMasked

  gdiplus

  GdipCreateBitmapFromScan0

  GdiplusStartup

  GdiplusShutdown

  GdipGetImageHeight

  GdipGetImagePaletteSize

  GdipBitmapUnlockBits

  GdipCreateBitmapFromStream

  GdipAlloc

  GdipDrawImageRectI

  GdipDisposeImage

  GdipGetImagePixelFormat

  GdipFree

  GdipBitmapLockBits

  GdipGetImageGraphicsContext

  GdipDeleteGraphics

  GdipGetImagePalette

  GdipSetCompositingMode

  GdipGetImageWidth

  GdipCreateBitmapFromFile

  GdipCloneImage

  ws2_32

  WSACleanup

  Exports

  Exports

  ?get_active_implementation@simdutf@@YAAAV?$atomic_ptr@$$CBVimplementation@simdutf@@@internal@1@XZ

  ?get_available_implementations@simdutf@@YAABVavailable_implementation_list@internal@1@XZ

  Sections

  .text

  Size: 192KB - Virtual size: 192KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 52KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ