6fa32ba57070aee1784365b9683de390N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6fa32ba57070aee1784365b9683de390N.exe
Size

186KB
MD5

6fa32ba57070aee1784365b9683de390
SHA1

13664874279308705e24aecf8c154af06b4d81b0
SHA256

85f6b947ef9076d31e18e654a59fb7febb2b3b6c706fdda84512ebb2ef8b2506
SHA512

a09071c1c221bb01d4aac7eea8b0868baaca917890c5f7c1c255ee1d955f165abfcf58eff6bc041d1ecfa7f875856c3c6a071c121e8f5f93f6741c65d9fb39ed
SSDEEP

3072:OoX/FkMTgZX2LakSO+Qfg1VgytsuA8BMgAmnfRR/lH1eRKuvkc:OOFZTgZvvgusu1BMgfnJ4vj

Score

1^/10

Malware Config

Signatures

Files

6fa32ba57070aee1784365b9683de390N.exe
.dll windows:4 windows x86 arch:x86

e57925219288aaf1f04dd66002592dc5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

45:9f:81:c4:54:6f:de:fc:ff:2f:1a:11:05:a6:ef:bd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

22/04/2009, 00:00

Not After

18/06/2012, 23:59

Subject

CN=Sonic Solutions,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Sonic Solutions,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:e0:f8:34:6f:97:97:1e:8b:fd:82:d7:29:bd:4b:0f:74:33:26:81
Signer

Actual PE Digest

5a:e0:f8:34:6f:97:97:1e:8b:fd:82:d7:29:bd:4b:0f:74:33:26:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Build\Securitylibstaging\Code\RoxioKey8\Main\lib\RoxioKeyLib\Release\rsl.pdb

Imports

snmpapi

SnmpUtilVarBindFree

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
GetVolumeInformationA
GetWindowsDirectoryA
GetLastError
FormatMessageA
LocalFree
InterlockedDecrement
InterlockedIncrement
SetEnvironmentVariableA
GetTickCount
IsBadWritePtr
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
HeapFree
ExitProcess
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
GetVersionExA
LCMapStringA
LCMapStringW
GetCPInfo
HeapAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetLocaleInfoW
QueryPerformanceCounter
GetCurrentProcessId
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
HeapSize
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
SetFilePointer
CloseHandle

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA

oleaut32

SysFreeString
VariantClear
SysAllocString

Exports

Exports

Action
Bag
CheckActivation
CheckTrial
DecodeKey
DecodeOldKey
DecodeTSID
Disable
GenerateKey
InitKeyless
InitPending
InitPermanent
InitTrial
ReadKey
ReturnCodeDescription
ReturnCodeSymbol
RoxioCheckActivation
RoxioCheckTrial
RoxioDecodeKey
StartOfWeekDate
UnBag
ValidateKey
WebHTTP
WebRequest
WebResponse
WebVerify

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e57925219288aaf1f04dd66002592dc5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

45:9f:81:c4:54:6f:de:fc:ff:2f:1a:11:05:a6:ef:bdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

5a:e0:f8:34:6f:97:97:1e:8b:fd:82:d7:29:bd:4b:0f:74:33:26:81Signer

Headers

File Characteristics

PDB Paths

Imports

snmpapi

kernel32

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

45:9f:81:c4:54:6f:de:fc:ff:2f:1a:11:05:a6:ef:bd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

5a:e0:f8:34:6f:97:97:1e:8b:fd:82:d7:29:bd:4b:0f:74:33:26:81
Signer

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 12KB - Virtual size: 9KB