c0d2536c5bc21e47128ecf3f60180bdd9ed193c53722640135f2ecbd5cf93c0c

Sharing

Copy URL Twitter E-mail

General

Target

c0d2536c5bc21e47128ecf3f60180bdd9ed193c53722640135f2ecbd5cf93c0c
Size

4.8MB
MD5

3ce68e3e372246e209bf1a8280dd9bf2
SHA1

14b7e53f20a9bfcf3e95faec7c9644189209675a
SHA256

c0d2536c5bc21e47128ecf3f60180bdd9ed193c53722640135f2ecbd5cf93c0c
SHA512

8d2e06f8dae5d9d3c6713ba2c3845b46ea17073b7a98e21afe69180ce049a335dfa0a4b53ee60e39bca2f9f15294734fb841d339112ae19a9ca308c2639a2644
SSDEEP

98304:eQn1Kg2QQn1KvNsQn1KklVM2hHtWHB594hnPBgDhiZ+MFkOFLPIX:eiKeiKqiKn2pkHNanZgDm+MFtLY

Score

1^/10

Malware Config

Signatures

Files

c0d2536c5bc21e47128ecf3f60180bdd9ed193c53722640135f2ecbd5cf93c0c
.dll windows:4 windows x86 arch:x86

468901d3f7b4a89c8b49777daf875d49

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

23:9e:5a:4f:bb:27:4d:9b:f1:9c:65:4d:6c:eb:e3:8b:97:7f:05:f1
Signer

Actual PE Digest

23:9e:5a:4f:bb:27:4d:9b:f1:9c:65:4d:6c:eb:e3:8b:97:7f:05:f1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\msishared\x86\ship\0\CustomActions\ocfxca.pdb

Imports

msi

ord160
ord118
ord32
ord159
ord163
ord166
ord51
ord173
ord165
ord219
ord111
ord116
ord49
ord48
ord139
ord58
ord145
ord74
ord125
ord171
ord17
ord121
ord103
ord8

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

advapi32

RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegQueryInfoKeyW
RegDeleteValueW

kernel32

lstrlenW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
DeleteFileW
GetVersion
SystemTimeToTzSpecificLocalTime
GetSystemTime
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
LocalAlloc
GetModuleHandleW
GetTempPathW
FindClose
FindFirstFileW
CreateFileW
lstrlenA
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSectionAndSpinCount
lstrcmpW

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

shell32

SHCreateDirectoryExW

user32

CharLowerW
CharLowerA
CharUpperW
CharUpperA

dbghelp

SymCleanup
SymInitialize
SymGetLineFromAddr64
SymGetSymFromAddr64

Exports

Exports

DoNiceRegistry
FormatFilesInUseTemplate
HashSetupMetadataFiles
MigrateInfoPathSolutionHive
OPCSetRemoveFeatureList
OcaArpWrite
ProcessBranding
RegisterBranding
UserInfo

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

468901d3f7b4a89c8b49777daf875d49

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

23:9e:5a:4f:bb:27:4d:9b:f1:9c:65:4d:6c:eb:e3:8b:97:7f:05:f1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

ole32

advapi32

kernel32

oleaut32

shell32

user32

dbghelp

Exports

Exports

Sections

.text Size: 201KB - Virtual size: 201KB

.data Size: 7KB - Virtual size: 14KB

.reloc Size: 15KB - Virtual size: 14KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

23:9e:5a:4f:bb:27:4d:9b:f1:9c:65:4d:6c:eb:e3:8b:97:7f:05:f1
Signer

.text
Size: 201KB - Virtual size: 201KB

.data
Size: 7KB - Virtual size: 14KB

.reloc
Size: 15KB - Virtual size: 14KB