fcff5c4416755f2ddd02b533d76b944307774b06e395d5fd7ed9d80664b768ac

Sharing

Copy URL Twitter E-mail

General

Target

fcff5c4416755f2ddd02b533d76b944307774b06e395d5fd7ed9d80664b768ac
Size

23KB
MD5

4faa12d62ec10b53b7fb2fc391a39ac3
SHA1

830dcb6d90aeb0c9275b99beceae31b1aa776bec
SHA256

fcff5c4416755f2ddd02b533d76b944307774b06e395d5fd7ed9d80664b768ac
SHA512

b5b8c7bf2b3c3592e6e0745aac47a601ebe41d5b6ed40dabe58d3a179afa31cd81221e277abdcc2eb0203605e844c49abdcf72005518c902aebbd215ee9e6bef
SSDEEP

384:JDFE5K1S8US0RT9qgN/v6KnmYJKN5ljXF/qSG/jOkHnYPL02TeZsHLEQa:vE5K8K0RhzN/v6KmlN5Ojy2a7m

Score

1^/10

Malware Config

Signatures

Files

fcff5c4416755f2ddd02b533d76b944307774b06e395d5fd7ed9d80664b768ac
.dll windows:6 windows x86 arch:x86

cb63baffad5b251ddca60832d6dd051a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:54:de:48:31:59:ad:f7:93:80:40:96:c7:01:8a:fe
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/05/2017, 00:00

Not After

15/05/2020, 12:00

Subject

SERIALNUMBER=ΗΕ 359200,CN=VisualSVN Software Ltd.,O=VisualSVN Software Ltd.,POSTALCODE=4003,STREET=CENTRO IMPERIO\, 2nd floor\, Flat/Office 201+STREET=Grigori Afxentiou\, 11,L=Limassol,C=CY,1.3.6.1.4.1.311.60.2.1.3=#13024359,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:e4:ed:54:c6:aa:9e:b9:c5:3e:d4:98:c9:42:7b:c4:72:e0:6c:9d
Signer

Actual PE Digest

a8:e4:ed:54:c6:aa:9e:b9:c5:3e:d4:98:c9:42:7b:c4:72:e0:6c:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

mod_authn_visualsvn_svn.pdb

Imports

libhttpd

_ap_field_noparam@8
ap_log_rerror_
ap_rprintf
_ap_parse_form_data@20
_ap_rwrite@12
ap_set_file_slot
_ap_hook_handler@16
_ap_cstr_casecmp@8

libapr-1

_apr_conv_utf8_to_ucs2@16
_apr_pool_clear@4
_apr_table_get@8
_apr_palloc@8
apr_pstrcat
_apr_pool_destroy@4
_apr_strtok@12
apr_pool_cleanup_null
_apr_pool_cleanup_register@16
_apr_os_file_put@16
_apr_file_close@4
_apr_pstrdup@8

libaprutil-1

_apr_password_validate@8
_apr_brigade_pflatten@16
_apr_md5_encode@16

libsvn_subr-1

svn_stream_from_aprfile2
svn_error_compose_create
svn_stream_readline
svn_io_file_close
svn_error_create
svn_error__malfunction
svn_dirent_local_style
svn_io_remove_file2
svn_io_open_uniquely_named
svn_error_wrap_apr
svn_dirent_dirname
svn_io_set_file_read_write
svn_io_file_flush_to_disk
svn_error_createf
svn_dirent_basename
svn_stream_puts
svn_pool_create_ex
svn_err_best_message
svn_stream_close
svn_io_lock_open_file
svn_io_unlock_open_file
svn_stream_open_readonly
svn_error_clear
svn_string_ncreate

msvcr120

_itoa
_except_handler4_common
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
memset
__crtTerminateProcess
memchr
rand
srand
_time64
abort
strcpy_s
strcat_s
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException

kernel32

GetLastError
QueryPerformanceCounter
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentThread
CreateFileW
MoveFileExW
CloseHandle

advapi32

SetThreadToken
ImpersonateLoggedOnUser
ImpersonateAnonymousToken
OpenThreadToken

Exports

Exports

authn_visualsvn_svn_module

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb63baffad5b251ddca60832d6dd051a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0a:54:de:48:31:59:ad:f7:93:80:40:96:c7:01:8a:feCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

a8:e4:ed:54:c6:aa:9e:b9:c5:3e:d4:98:c9:42:7b:c4:72:e0:6c:9dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libhttpd

libapr-1

libaprutil-1

libsvn_subr-1

msvcr120

kernel32

advapi32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 932B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 752B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0a:54:de:48:31:59:ad:f7:93:80:40:96:c7:01:8a:fe
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

a8:e4:ed:54:c6:aa:9e:b9:c5:3e:d4:98:c9:42:7b:c4:72:e0:6c:9d
Signer

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 932B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 752B