cd648ef57f0d80860475e5fcbf5786fa5491b94b4c5aa679aa3e6f91e16dbbfb

Sharing

Copy URL

Twitter E-mail

General

Target

cd648ef57f0d80860475e5fcbf5786fa5491b94b4c5aa679aa3e6f91e16dbbfb
Size

1.4MB
MD5

9be744d3027cb2b73bad6602697a0bb7
SHA1

c6c7f6c1a39ed0c3355bccbaa42ef8ef61f2ecef
SHA256

cd648ef57f0d80860475e5fcbf5786fa5491b94b4c5aa679aa3e6f91e16dbbfb
SHA512

3a00be88cfba028d5deeb61803db0f8216f2c2b2f8ebbbe5c06c4c3f6c37c5727e322e5e111cfb377a7ec41bce3057674b55c7d5323f511c9b0e90edc32c0e81
SSDEEP

24576:Hvc8tsywstsywctsywutsywdvcXvcHvcxvcn:Pc8aPsaPcaPuaPFcfcPc5cn

Score

1^/10

Malware Config

Signatures

Files

cd648ef57f0d80860475e5fcbf5786fa5491b94b4c5aa679aa3e6f91e16dbbfb
.dll windows:5 windows x86 arch:x86

f79a40f34199f251d24ae1c013954d58

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08-04-2013 00:00

Not After

08-04-2014 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f4:28:74:f2:0b:80:ee:45:b1:ce:3b:f7:34:88:11:68:f9:36:81:89
Signer

Actual PE Digest

f4:28:74:f2:0b:80:ee:45:b1:ce:3b:f7:34:88:11:68:f9:36:81:89

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\lps\mihaih\trunk\4.0\src\workstation\helpers\win\Win32\Release\msi_custom_action.pdb

Imports

psapi

GetModuleFileNameExW
EnumProcesses

msi

ord121
ord17
ord145
ord74
ord8
ord103

kernel32

GetConsoleOutputCP
WriteConsoleA
CreateDirectoryW
WaitForSingleObject
OutputDebugStringW
WriteFile
OpenProcess
LoadLibraryW
Sleep
WriteConsoleW
GetFileAttributesW
TerminateProcess
CreateFileW
GetLastError
GetProcAddress
RemoveDirectoryW
CloseHandle
DeleteFileW
HeapSize
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
GetVersionExW
HeapReAlloc
SetStdHandle
GetLocaleInfoA
HeapFree
HeapAlloc
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
SetEnvironmentVariableA
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
GetStringTypeA
GetStringTypeW

advapi32

RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHFileOperationW
ShellExecuteExW
SHGetSpecialFolderPathW

Exports

Exports

CaFolderCleanUp
CaSetLicenseId
CaUninstallPlugins
CreateSecondFlagCA
CreateSecondFlagTC
CsFolderCleanUp
DisableSafeBoot
HideCancelButton
LogInstallCA
LogInstallTC
QueryStartupKey
SetLocaleId
SilentExecute
StopUnits
TcFolderCleanUp
TcSetLicenseId
TcUninstallPlugins
UninstallLPS3

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f79a40f34199f251d24ae1c013954d58

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90Certificate

Extended Key Usages

Key Usages

f4:28:74:f2:0b:80:ee:45:b1:ce:3b:f7:34:88:11:68:f9:36:81:89Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

msi

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

f4:28:74:f2:0b:80:ee:45:b1:ce:3b:f7:34:88:11:68:f9:36:81:89
Signer

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB