880f97760265db4f0a986c76130f16bb34196497c027cd0625a00e30690a14b1

Sharing

Copy URL Twitter E-mail

General

Target

880f97760265db4f0a986c76130f16bb34196497c027cd0625a00e30690a14b1
Size

348KB
MD5

1cf1ed99c6d3067e9ff7d7816484288b
SHA1

5dfd587148b2c55b2c1edcadf69139a770b7ad3f
SHA256

880f97760265db4f0a986c76130f16bb34196497c027cd0625a00e30690a14b1
SHA512

508d9769775189cfcba94e627a3569fbcdc673b1bb6d80add08a55be7f8b3282a7f648cd6ff305361d981da2450762fede06d3f0addd7a8f336ba7881927ff55
SSDEEP

6144:0b9/mXlYiJPhYqJ272uKbrzXOafptRSFGQRrPsYTBIXOfq8iyv:0bMXlYizYqJ272v+afpCFnRLsYTGSv

Score

1^/10

Malware Config

Signatures

Files

880f97760265db4f0a986c76130f16bb34196497c027cd0625a00e30690a14b1
.dll regsvr32 windows:5 windows x86 arch:x86

e767057712ed8c69d064966957ffddac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:05:00:e2:58:ae:12:dd:99:fa:7b:d3:18:b6:7a:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/07/2011, 00:00

Not After

01/09/2014, 23:59

Subject

CN=Hyperionics Technology\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Hyperionics Technology\, LLC,L=Murrysville,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c7:8a:42:1d:59:78:08:4a:ed:1b:d3:5b:35:0a:bf:e4:f8:a8:f5:2a
Signer

Actual PE Digest

c7:8a:42:1d:59:78:08:4a:ed:1b:d3:5b:35:0a:bf:e4:f8:a8:f5:2a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesWrapMode
GdipDrawImagePointRectI
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImageI
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipSetImageAttributesColorKeys
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromGdiDib
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCloneImage
GdipGetPathData
GdipClonePath
GdipCloneBrush
GdipDrawImageRectRect
GdipDrawImage
GdipFillPath
GdipFillEllipse
GdipFillPolygon
GdipFillRectangle
GdipDrawPath
GdipDrawPolygon
GdipImageRotateFlip
GdipDrawLine
GdipGetWorldTransform
GdipMultiplyWorldTransform
GdipSetWorldTransform
GdipSetPixelOffsetMode
GdipGetPixelOffsetMode
GdipSetSmoothingMode
GdipGetSmoothingMode
GdipSetInterpolationMode
GdipGetInterpolationMode
GdipSetCompositingMode
GdipReleaseDC
GdipGetDC
GdipCreateFromHDC
GdipGetPathPointsI
GdipGetPathPoints
GdipGetPointCount
GdipTransformPath
GdipAddPathPath
GdipAddPathEllipse
GdipAddPathRectangle
ord1
GdipAddPathLine
GdipClosePathFigure
GdipResetPath
GdipSetPenDashStyle
GdipSetPenColor
GdipSetPenCustomEndCap
GdipSetPenCustomStartCap
GdipSetPenLineCap197819
GdipSetPenWidth
GdipCreateSolidFill
GdipTransformMatrixPointsI
GdipTransformMatrixPoints
GdipInvertMatrix
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipCreateMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipGetPathWorldBounds
GdipFlush
GdipDeleteGraphics
GdipDeleteCustomLineCap
GdipCreateCustomLineCap
GdipDeletePath
GdipCreatePath2
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipDeleteMatrix
GdipAlloc
GdipFree
GdipDrawRectangle

mfc100u

ord892
ord1294
ord2069
ord12001
ord3428
ord1945
ord6073
ord6655
ord6409
ord715
ord1592
ord7399
ord1934
ord2068
ord2064
ord2062
ord6869
ord3421
ord404
ord3413
ord13871
ord13901
ord13870
ord13891
ord13890
ord14130
ord9496
ord4755
ord4764
ord13309
ord3623
ord3670
ord11085
ord11880
ord2375
ord8615
ord13804
ord13950
ord13939
ord13738
ord13962
ord13743
ord14216
ord14129
ord14211
ord11509
ord4950
ord11706
ord8334
ord10296
ord8220
ord5538
ord4981
ord2504
ord12684
ord12886
ord9329
ord8349
ord965
ord1957
ord10019
ord6719
ord6358
ord322
ord13605
ord374
ord3495
ord945
ord890
ord11982
ord2184
ord2185
ord5799
ord4086
ord7624
ord7548
ord11784
ord13854
ord4744
ord2164
ord11476
ord11477
ord13381
ord7108
ord13387
ord8530
ord3684
ord3625
ord11864
ord7126
ord1739
ord14162
ord10976
ord13267
ord11469
ord7179
ord13570
ord13567
ord13572
ord13569
ord13571
ord13568
ord3416
ord5261
ord11228
ord11236
ord7391
ord9498
ord11240
ord11209
ord11845
ord7176
ord5118
ord5467
ord9328
ord6140
ord1292
ord2030
ord1296
ord12783
ord4151
ord7913
ord7914
ord11801
ord7524
ord2829
ord280
ord290
ord3846
ord11838
ord1479
ord1310
ord1244
ord5558
ord12610
ord2887
ord2884
ord7385
ord2418
ord14146
ord14148
ord14147
ord14145
ord14149
ord14132
ord14059
ord14060
ord8277
ord11081
ord3402
ord10937
ord13380
ord8112
ord11210
ord6247
ord10045
ord8393
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord1512
ord1519
ord4388
ord4425
ord4396
ord4408
ord4404
ord4400
ord4430
ord4421
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord14067
ord3992
ord2665
ord13382
ord7109
ord13388
ord6156
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord2952
ord2951
ord2852
ord11159
ord4642
ord4923
ord5115
ord8483
ord4901
ord5143
ord4645
ord1301
ord323
ord1873
ord2088
ord2090
ord1953
ord408
ord4794
ord4623
ord5468
ord6931
ord6932
ord6922
ord4792
ord7393
ord9333
ord8346
ord6099
ord897
ord1944
ord13127
ord5264
ord285
ord2629
ord5229
ord337
ord265
ord266
ord5801
ord5862
ord3446
ord296
ord4290
ord1987
ord1298
ord286
ord1450
ord902
ord1300
ord908
ord2091
ord2055
ord2053
ord2080
ord1984
ord2045
ord6552

msvcr100

__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
strtod
_setjmp3
abort
__iob_func
longjmp
exp
strncmp
strrchr
_stricmp
??0exception@std@@QAE@XZ
fwrite
fflush
_fileno
_filelength
fgetpos
feof
fsetpos
fgetc
fread_s
strcpy
ceil
_endthreadex
wcsncpy_s
_beginthreadex
sqrt
cos
pow
acos
sin
abs
fabs
floor
fprintf
wcslen
memcmp
_snprintf
strncpy
strlen
_recalloc
wcscat_s
memset
free
fread
fclose
malloc
fseek
_wfopen
__CxxFrameHandler3
_wtof
memmove
_CIatan2
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_CIsqrt
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
calloc
memcpy
_purecall
wcsstr
memcpy_s
wcscpy_s

kernel32

lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GlobalAlloc
LocalFree
LocalAlloc
OutputDebugStringW
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
CreateEventA
GlobalFree
GlobalUnlock
GlobalLock
MultiByteToWideChar
WideCharToMultiByte
WaitForMultipleObjects
ResumeThread
ResetEvent
WaitForSingleObject
SetEvent
TlsFree
GetLocalTime
TlsAlloc
QueryPerformanceCounter
GlobalReAlloc
GetTickCount
lstrlenW
MulDiv
CloseHandle
TlsSetValue
CreateFileW
InterlockedIncrement
InterlockedDecrement
RaiseException
IsBadWritePtr
TlsGetValue
GetFileTime

user32

FillRect
CopyRect
SystemParametersInfoW
MessageBoxW
CharNextW
EnableWindow
SendMessageW
OffsetRect
RegisterClipboardFormatW
GetKeyState
IntersectRect
IsRectEmpty
GetDC
ReleaseDC
GetSystemMetrics

gdi32

SetDIBits
GetDIBits
CreateDIBSection
GdiFlush
GetDIBColorTable
SelectObject
SetDIBColorTable
RealizePalette
GetObjectW
GetPaletteEntries
CreatePalette
PatBlt
CreateCompatibleDC
CreateBitmap
GetDeviceCaps
BitBlt
GetROP2
SetROP2
CreatePolygonRgn
FillRgn
DeleteObject

advapi32

RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW

ole32

OleUninitialize
OleInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysFreeString
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?max@?$numeric_limits@G@std@@SAGXZ
?max@?$numeric_limits@E@std@@SAEXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??0_Container_base12@std@@QAE@XZ
?max@?$numeric_limits@I@std@@SAIXZ

msvfw32

DrawDibRealize
DrawDibDraw
DrawDibOpen
DrawDibClose
DrawDibSetPalette

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e767057712ed8c69d064966957ffddac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

09:05:00:e2:58:ae:12:dd:99:fa:7b:d3:18:b6:7a:1dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c7:8a:42:1d:59:78:08:4a:ed:1b:d3:5b:35:0a:bf:e4:f8:a8:f5:2aSigner

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

mfc100u

msvcr100

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp100

msvfw32

Exports

Exports

Sections

.text Size: 245KB - Virtual size: 245KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 6KB - Virtual size: 78KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 26KB - Virtual size: 25KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

09:05:00:e2:58:ae:12:dd:99:fa:7b:d3:18:b6:7a:1d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c7:8a:42:1d:59:78:08:4a:ed:1b:d3:5b:35:0a:bf:e4:f8:a8:f5:2a
Signer

.text
Size: 245KB - Virtual size: 245KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 6KB - Virtual size: 78KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 26KB - Virtual size: 25KB