86e4e88b83c8ff870a787d28c4a405ee8fab1fbd35568ec13617786f8e540ae8

Sharing

Copy URL

Twitter E-mail

General

Target

86e4e88b83c8ff870a787d28c4a405ee8fab1fbd35568ec13617786f8e540ae8
Size

737KB
MD5

11dd55f44830ee3a22e55805f77a0185
SHA1

ac09aa9300ab86f8ea5223bd6beea92b202b45cb
SHA256

86e4e88b83c8ff870a787d28c4a405ee8fab1fbd35568ec13617786f8e540ae8
SHA512

39813cf188da3cd986becea2dd5acca2ee071b55a4f43ad3fbddff613786511d6fe44dda42c44deaf71d7837fc3bc2045245869a68a7687ddd5708440516b6fc
SSDEEP

12288:VkCW8Dbl0fTzK8XhpQPnTyvvYOnzyU0YO7bJqaWRHCKl8UgnQcnoKdqNQUmT:VSLjJv9zyyNgnQcnoKYmT

Score

1^/10

Malware Config

Signatures

Files

86e4e88b83c8ff870a787d28c4a405ee8fab1fbd35568ec13617786f8e540ae8
.dll windows:5 windows x64 arch:x64

dca3073666ce2a9d7f55a408c6c24dcb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:0f:10:9d:92:32:32:2c:28:0e:f2:c2:d3:f2:b9:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

08/02/2016, 23:59

Subject

CN=Bitdefender SRL,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=PD,O=Bitdefender SRL,L=Bucharest,ST=Romania,C=RO

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:49:04:ed:fd:8e:83:c7:3c:fb:24:3c:3c:47:b7:ca:fa:18:e8:94
Signer

Actual PE Digest

fd:49:04:ed:fd:8e:83:c7:3c:fb:24:3c:3c:47:b7:ca:fa:18:e8:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Bamboo\home\xml-data\build-dir\AS-BUILD-WX\bin\x64\Static Release\ascore.pdb

Imports

kernel32

GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
CloseHandle
CreateEventA
SetEvent
OutputDebugStringA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
IsValidCodePage
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FindClose
GetTempFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileW
FreeLibrary
GetProcAddress
FormatMessageA
LoadLibraryW
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
HeapFree
HeapAlloc
MultiByteToWideChar
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
Sleep
SetLastError
GetCurrentThread
GetStdHandle
WriteFile
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetACP
GetOEMCP
GetCPInfo
GetFileType
GetStartupInfoW
GetProcessHeap
GetModuleFileNameA
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
CreateSemaphoreW
ReadFile
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStringTypeW
LoadLibraryExW
SetConsoleCtrlHandler
HeapReAlloc
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
FlushFileBuffers
SetEnvironmentVariableW
SetFilePointerEx
CreateFileW
WriteConsoleW
SetEndOfFile

Exports

Exports

as_blackbox_clone
as_blackbox_create
as_blackbox_empty
as_blackbox_get
as_blackbox_release
as_blackbox_set
as_core_command_process
as_core_err
as_core_errmsg
as_core_global_settings_copy
as_core_instance_get
as_core_instance_init
as_core_instance_release
as_core_item_create
as_core_item_process
as_core_item_process_alt
as_core_item_release
as_core_session_create
as_core_session_release
as_core_setting_get
as_core_setting_set
as_core_settings_apply
as_core_settings_apply_alt
as_core_settings_copy
as_core_version_get

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dca3073666ce2a9d7f55a408c6c24dcb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

76:0f:10:9d:92:32:32:2c:28:0e:f2:c2:d3:f2:b9:53Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fd:49:04:ed:fd:8e:83:c7:3c:fb:24:3c:3c:47:b7:ca:fa:18:e8:94Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 188KB - Virtual size: 187KB

.data Size: 12KB - Virtual size: 310KB

.pdata Size: 25KB - Virtual size: 25KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 6KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

76:0f:10:9d:92:32:32:2c:28:0e:f2:c2:d3:f2:b9:53
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fd:49:04:ed:fd:8e:83:c7:3c:fb:24:3c:3c:47:b7:ca:fa:18:e8:94
Signer

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 188KB - Virtual size: 187KB

.data
Size: 12KB - Virtual size: 310KB

.pdata
Size: 25KB - Virtual size: 25KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 6KB