36e2479f23ae4715643ce9e79a1dc3d659ff4e0f53aea4016557c1a7ceafc93b

Sharing

Copy URL Twitter E-mail

General

Target

36e2479f23ae4715643ce9e79a1dc3d659ff4e0f53aea4016557c1a7ceafc93b
Size

366KB
MD5

5709b7d011ee32d5333887053ed6c18a
SHA1

5ca74d9d093a1a26326814d48bf7ddb7a27e2b4e
SHA256

36e2479f23ae4715643ce9e79a1dc3d659ff4e0f53aea4016557c1a7ceafc93b
SHA512

665a9546459463d135475c91e7fde5f9d90d472839a39d762aea353dccf41212e6a64596e59ac25c3d4da935ac436ba327e5cffbd3c6331be1f92112a4fdfe68
SSDEEP

6144:g0io/B3T1KzUHY5ahdW+YDpI2BQk+/VV4J6pFt6vZS80vhLxLaPky4:g0ii3T1KLahdVYDGzk+/TyqxkkT

Score

1^/10

Malware Config

Signatures

Files

36e2479f23ae4715643ce9e79a1dc3d659ff4e0f53aea4016557c1a7ceafc93b
.exe windows:5 windows x86 arch:x86

19ef22b21bc0c9a13fac9100b930a053

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9e
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

06/03/2013, 00:00

Not After

05/03/2016, 23:59

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:c8:81:52:14:98:0a:b5:29:57:d6:97:5b:c4:1c:02:4f:48:8c:f6
Signer

Actual PE Digest

54:c8:81:52:14:98:0a:b5:29:57:d6:97:5b:c4:1c:02:4f:48:8c:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Build\onlinetech\Protector3\Build\Release\GameStub.pdb

Imports

kernel32

FreeLibrary
GetUserDefaultUILanguage
GetProcAddress
LoadLibraryA
GetFileAttributesW
Sleep
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
WriteConsoleW
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
LoadResource
FormatMessageA
GetCurrentThreadId
DebugBreak
GetLastError
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InitializeCriticalSection
CreateProcessA
CloseHandle
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
SetFilePointer
GetConsoleMode
GetConsoleCP
GetStringTypeW
InterlockedCompareExchange
InterlockedExchange
EncodePointer
DecodePointer
RaiseException
RtlUnwind
ExitProcess
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapFree
GetCPInfo
LCMapStringW
HeapAlloc
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
IsValidCodePage

user32

MessageBoxW

advapi32

RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.phs
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19ef22b21bc0c9a13fac9100b930a053

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9eCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

54:c8:81:52:14:98:0a:b5:29:57:d6:97:5b:c4:1c:02:4f:48:8c:f6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 131KB - Virtual size: 130KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 7KB - Virtual size: 15KB

.phs Size: 1KB - Virtual size: 1KB

.rsrc Size: 191KB - Virtual size: 190KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

5f:42:e6:d0:d1:6b:e0:7e:09:42:f0:be:a6:71:5a:9e
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

54:c8:81:52:14:98:0a:b5:29:57:d6:97:5b:c4:1c:02:4f:48:8c:f6
Signer

.text
Size: 131KB - Virtual size: 130KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 7KB - Virtual size: 15KB

.phs
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 191KB - Virtual size: 190KB