9b7609ef80f2fa07d91bc14c4af2542b7648141dd0fde3dd00d7816cda47c3f6

Sharing

Copy URL Twitter E-mail

General

Target

9b7609ef80f2fa07d91bc14c4af2542b7648141dd0fde3dd00d7816cda47c3f6
Size

40KB
MD5

e9cb9b5965e4dc0cadec62bd201c791d
SHA1

7b765de4762b6835b378bd08c6d1d0ccc941d52f
SHA256

9b7609ef80f2fa07d91bc14c4af2542b7648141dd0fde3dd00d7816cda47c3f6
SHA512

7e5f812758b4bcb0300194d900e975061abdcbc120753912b4bf51b2a408852d32b2b7f63a3cb15e3bde884e8b3b3ec5c6fd1a3561573be55af427b6ba81df2b
SSDEEP

768:Gsxb+qOHgi85uLoQnHcrpLiZyrr0NX2XVdQv9c0b:Gs0q+gRzeo0NX2XD09ce

Score

1^/10

Malware Config

Signatures

Files

9b7609ef80f2fa07d91bc14c4af2542b7648141dd0fde3dd00d7816cda47c3f6
.dll windows:5 windows x64 arch:x64

7be627879b94a3f19074f3836e550c61

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:45:0e:d6:d9:b0:fa:f5:a4:7d:51:2b:64:40:d2:3e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/12/2014, 00:00

Not After

07/02/2016, 23:59

Subject

CN=Crypto-Pro,O=Crypto-Pro,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:0b:a2:7e:bc:bc:4a:36:34:5f:d6:cf:ec:1d:f3:85:5e:4b:8a:1b
Signer

Actual PE Digest

a9:0b:a2:7e:bc:bc:4a:36:34:5f:d6:cf:ec:1d:f3:85:5e:4b:8a:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\trunk\trunk_1\CSP\out\x64\release\snet.pdb

Imports

msvcrt

_amsg_exit
_initterm
_XcptFilter
__C_specific_handler
memset
memcpy
wcsrchr
_wtoi
wcschr
wcsncpy
_snwprintf
strncpy
free
malloc

kernel32

LocalFree
LocalAlloc
GetProcAddress
SetLastError
GetLongPathNameW
GetLastError
DeactivateActCtx
GetModuleFileNameW
LoadLibraryW
ActivateActCtx
CreateActCtxW
QueryActCtxW
GetModuleHandleExW
SetErrorMode
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OutputDebugStringA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
MultiByteToWideChar
GetSystemDefaultLangID
IsBadReadPtr
DisableThreadLibraryCalls
IsBadWritePtr
Sleep
FindActCtxSectionStringW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

snet_reader_get_handle
snet_reader_group_handle

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7be627879b94a3f19074f3836e550c61

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

46:45:0e:d6:d9:b0:fa:f5:a4:7d:51:2b:64:40:d2:3eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

a9:0b:a2:7e:bc:bc:4a:36:34:5f:d6:cf:ec:1d:f3:85:5e:4b:8a:1bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 900B

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 512B - Virtual size: 204B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

46:45:0e:d6:d9:b0:fa:f5:a4:7d:51:2b:64:40:d2:3e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

a9:0b:a2:7e:bc:bc:4a:36:34:5f:d6:cf:ec:1d:f3:85:5e:4b:8a:1b
Signer

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 900B

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 512B - Virtual size: 204B