a68c575bd486435ce132cef27aa77ac429ab99e5bd5e43a792f09b14c8376611

Sharing

Copy URL Twitter E-mail

General

Target

a68c575bd486435ce132cef27aa77ac429ab99e5bd5e43a792f09b14c8376611
Size

2.8MB
MD5

72342be2ac7cc5df1c239d2597aac74b
SHA1

d530085ca610d10d98d28b3df2139a9a4b0dfae5
SHA256

a68c575bd486435ce132cef27aa77ac429ab99e5bd5e43a792f09b14c8376611
SHA512

d26883d748deaa049652e8ec6d3876ffbe9774c0a3ee2e8ef03f9c7478243a99540df8af9af913f52744a6cb99a8d7803b7d8359dac2feb8bf736b41a322191b
SSDEEP

49152:1ozFCgLwaVZ9D6//kI0sweLWbpOzkQ9+rRyGL1jXoSL4bwFFYelUZvzC+:2ggLfVf+/kvAzkeKRyk1DoU4bClKN

Score

1^/10

Malware Config

Signatures

Files

a68c575bd486435ce132cef27aa77ac429ab99e5bd5e43a792f09b14c8376611
.exe windows:4 windows x86 arch:x86

81638d02019c0bfcaaf23a9c69f2f12c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:4a:2a:52:9c:47:7c:2a:3c:10:45:5a:54:da:10:ec:3a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

21/12/2011, 15:39

Not After

03/02/2013, 07:25

Subject

CN=Atarimax LLC,O=Atarimax LLC,L=Lakewood,ST=OH,C=US,1.2.840.113549.1.9.1=#0c15636c6173736963734061746172696d61782e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

49:c2:df:99:ea:64:81:9c:7d:ae:47:0f:3d:a2:53:e0:80:ea:13:50
Signer

Actual PE Digest

49:c2:df:99:ea:64:81:9c:7d:ae:47:0f:3d:a2:53:e0:80:ea:13:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingA
WaitForSingleObject
CreateProcessA
GetCommandLineA
CloseHandle
UnmapViewOfFile
WriteFile
MapViewOfFile
DeleteFileA
GetTempFileNameA
GetTempPathA
CreateFileA
GetShortPathNameA
GetModuleFileNameA

user32

wsprintfA

Sections

.text
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81638d02019c0bfcaaf23a9c69f2f12c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:4a:2a:52:9c:47:7c:2a:3c:10:45:5a:54:da:10:ec:3aCertificate

Extended Key Usages

Key Usages

49:c2:df:99:ea:64:81:9c:7d:ae:47:0f:3d:a2:53:e0:80:ea:13:50Signer

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 512B - Virtual size: 510B

.rdata Size: 1024B - Virtual size: 533B

.data Size: 512B - Virtual size: 20B

.rsrc Size: 2.8MB - Virtual size: 2.8MB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:4a:2a:52:9c:47:7c:2a:3c:10:45:5a:54:da:10:ec:3a
Certificate

49:c2:df:99:ea:64:81:9c:7d:ae:47:0f:3d:a2:53:e0:80:ea:13:50
Signer

.text
Size: 512B - Virtual size: 510B

.rdata
Size: 1024B - Virtual size: 533B

.data
Size: 512B - Virtual size: 20B

.rsrc
Size: 2.8MB - Virtual size: 2.8MB