virussign[.]com_91a61c739c4abc764c13fb0cc6287550[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

virussign.com_91a61c739c4abc764c13fb0cc6287550.vir
Size

126KB
MD5

91a61c739c4abc764c13fb0cc6287550
SHA1

0ceff0ccb0fdb15d8cf594386a6d09e18e047dc3
SHA256

5f035a447ffe035c9a2c90ba50abf199cc7f74d543a8a829cdb607b3e9b5472a
SHA512

83f7dd9be51d3c14c371960bc84c93fff85b9befe4ae8113efda154b1c7aac85f57973cc7d09137e4f1b0758d0d56eae16c3e203bd69073b8e0186a945c4a5ee
SSDEEP

3072:z/MN2/6tr42KP/gAMeXkkq94Ikkq94Ukkq94YpzzlLsU8JOcOoi:z/MW6trYIeWiMkOcVi

Score

1^/10

Malware Config

Signatures

Files

virussign.com_91a61c739c4abc764c13fb0cc6287550.vir
.exe windows:5 windows x86 arch:x86

61b0223c0a624458d129e077ec3876c2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:f7:74:b1:cf:be:7d:71:1a:05:c1:bd:c5:c9:b4:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

15/10/2009, 00:00

Not After

15/11/2012, 23:59

Subject

CN=Commvault Systems,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Commvault Systems,O=Commvault Systems,L=Oceanport,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a3:28:e8:a2:18:0b:d1:c3:da:76:5a:31:e2:dd:66:0d:f4:8b:78:ca
Signer

Actual PE Digest

a3:28:e8:a2:18:0b:d1:c3:da:76:5a:31:e2:dd:66:0d:f4:8b:78:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\REL_9_0_0_B84\vaultcx\build\Win32\Release\QSDK\QCreate.pdb

Imports

cvfocus

?setFocus@CVPI_Focus@@SAXPBDW4COMMVAULT_PRODUCT_TYPE@@_N@Z

qsdkapi

QSDKGetVMName
QSDKGetErrorString
QSDKDeInitialize

qapi

QAPI_Create

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentProcess

stlport.5.0

??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@PB_W@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
?substr@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBE?AV12@II@Z
?empty@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBE_NXZ
?length@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBEIXZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@ABV01@@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV01@@Z
?deallocate@?$__node_alloc@$00$0A@@stlp_std@@SAXPAXI@Z
?allocate@?$__node_alloc@$00$0A@@stlp_std@@SAPAXI@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEIXZ
?empty@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBE_NXZ
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ID@Z
??Y?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@PBD@Z
?assign@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEAAV01@_J@Z
??0?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@H@Z
??6?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEAAV01@H@Z
?str@?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBE?AV?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_ostringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEXXZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@PB_WABV?$allocator@_W@1@@Z
??0?$allocator@_W@stlp_std@@QAE@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@ABV?$allocator@_W@1@@Z
??1?$allocator@_W@stlp_std@@QAE@XZ
??0?$allocator@D@stlp_std@@QAE@XZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV?$allocator@D@1@@Z
??1?$allocator@D@stlp_std@@QAE@XZ
?c_str@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEPBDXZ
??1?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@XZ
?c_str@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBEPB_WXZ
??1?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@XZ
??A?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAA_WI@Z
?_M_decrement@?$_Rb_global@_N@stlp_std@@SAPAU_Rb_tree_node_base@2@PAU32@@Z
?_Rebalance@?$_Rb_global@_N@stlp_std@@SAXPAU_Rb_tree_node_base@2@AAPAU32@@Z
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@V?$__move_source@V?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@@1@@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@V?$__move_source@V?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@1@@Z
??4?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@PB_W@Z

msvcr90

_stricmp
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
exit
_wcsicmp
strcmp
__CxxFrameHandler3
free
strcat
vsprintf
sprintf
fprintf
__iob_func
memset
printf
strlen
wcscpy
wcslen
strcpy
malloc
vprintf
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??_V@YAXPAX@Z
wcsncmp
wcstol
wcstok
wcstombs
mbstowcs
sscanf
_mktime32
qsort
wcscmp
??2@YAPAXI@Z
_wcsnicmp

cvlib

?WideChar2UTF8String@@YAJPB_WAAV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@@Z
?UTF8String2WideChar@@YAJAAV?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@ABV?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@2@@Z

cvbasiclib

??0EvDebug@@QAE@PAVEvDebugFileInstance@@@Z
?initialize@EvDebug@@QAE_NPBD_J_N@Z
?handleMsgEventDebug_NEW@EvDebug@@QAEXHPBDH_J00PAD@Z
??1EvDebug@@QAE@XZ

Exports

Exports

??4MDEvent@@QAEAAV0@ABV0@@Z
??4MDMutex@@QAEAAV0@ABV0@@Z
?getLastTimeAcquired@MDEvent@@QAEJXZ
?getLastTimeAcquired@MDLock@@QAEJXZ
?getLastTimeAcquired@MDMutex@@QAEJXZ

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61b0223c0a624458d129e077ec3876c2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

02:f7:74:b1:cf:be:7d:71:1a:05:c1:bd:c5:c9:b4:b0Certificate

Extended Key Usages

Key Usages

a3:28:e8:a2:18:0b:d1:c3:da:76:5a:31:e2:dd:66:0d:f4:8b:78:caSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cvfocus

qsdkapi

qapi

kernel32

stlport.5.0

msvcr90

cvlib

cvbasiclib

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 61KB - Virtual size: 61KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

02:f7:74:b1:cf:be:7d:71:1a:05:c1:bd:c5:c9:b4:b0
Certificate

a3:28:e8:a2:18:0b:d1:c3:da:76:5a:31:e2:dd:66:0d:f4:8b:78:ca
Signer

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 61KB - Virtual size: 61KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 3KB