ab4cde8c7954d8855ad85a6274a563838d7474e43800dda997c109240624f03a

Sharing

Copy URL

Twitter E-mail

General

Target

ab4cde8c7954d8855ad85a6274a563838d7474e43800dda997c109240624f03a
Size

1.5MB
MD5

0c270b331c2247ccbf0a618404b843b5
SHA1

f1a71c48fff4cc4aee5af8bd4e4e796eae58c94e
SHA256

ab4cde8c7954d8855ad85a6274a563838d7474e43800dda997c109240624f03a
SHA512

00c9e20cdc8ea7e4b6032395ea30aa6e5fc8a25b7ca39d16d4938f69587a5bfb1166d2a02243904f20d7103f46d322805c0032cd122bb4c9d80a5f6a9deedea9
SSDEEP

24576:yvcwvcWtsywstsywctsywutsywPvcFvcYvc+vcS:4cecWaPsaPcaPuaPXcNcmc0cS

Score

1^/10

Malware Config

Signatures

Files

ab4cde8c7954d8855ad85a6274a563838d7474e43800dda997c109240624f03a
.dll windows:5 windows x86 arch:x86

f79a40f34199f251d24ae1c013954d58

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a4:0b:a4:3d:73:1c:ea:8b:27:b6:cc:15:a2:b2:1f:55:70:5c:9c:45
Signer

Actual PE Digest

a4:0b:a4:3d:73:1c:ea:8b:27:b6:cc:15:a2:b2:1f:55:70:5c:9c:45

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\lps\mihaih\tags\4.10.75w\src\workstation\helpers\win\Win32\Release\msi_custom_action.pdb

Imports

psapi

GetModuleFileNameExW
EnumProcesses

msi

ord121
ord17
ord145
ord74
ord8
ord103

kernel32

GetConsoleOutputCP
WriteConsoleA
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
OpenProcess
LoadLibraryW
Sleep
WriteConsoleW
GetFileAttributesW
TerminateProcess
CreateFileW
GetLastError
GetProcAddress
RemoveDirectoryW
CloseHandle
DeleteFileW
HeapSize
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
GetVersionExW
HeapReAlloc
SetStdHandle
GetLocaleInfoA
HeapFree
HeapAlloc
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
SetEnvironmentVariableA
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
GetStringTypeA
GetStringTypeW

advapi32

RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW

Exports

Exports

CaFolderCleanUp
CaSetLicenseId
CaUninstallPlugins
CreateSecondFlagCA
CreateSecondFlagTC
CsFolderCleanUp
DisableSafeBoot
HideCancelButton
LogInstallCA
LogInstallTC
QueryStartupKey
SetLocaleId
SilentExecute
StopUnits
TcFolderCleanUp
TcSetLicenseId
TcUninstallPlugins
UninstallLPS3

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f79a40f34199f251d24ae1c013954d58

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90Certificate

Extended Key Usages

Key Usages

a4:0b:a4:3d:73:1c:ea:8b:27:b6:cc:15:a2:b2:1f:55:70:5c:9c:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

msi

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

a4:0b:a4:3d:73:1c:ea:8b:27:b6:cc:15:a2:b2:1f:55:70:5c:9c:45
Signer

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB