b452ad3d3d469b7fa8ce6a819e1c6cc0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b452ad3d3d469b7fa8ce6a819e1c6cc0N.exe
Size

613KB
MD5

b452ad3d3d469b7fa8ce6a819e1c6cc0
SHA1

12c5acafb2b1f7cdae9ee23156265b3c430053c6
SHA256

c596aa9890d702b6bf67bb34b01a6fe8d3e9dc195eb67b924ce009b1813d187a
SHA512

c4298c128c99c59d33d646c3e99973136d1bd62ca46afd0b11847bcdfadb1413b32758ece9618eacccba4d619909c46150e897281b5af6cff2efba64543d912b
SSDEEP

6144:NOk0nfbKbSCDayMpyy0Jb6Rk7vZiKpM0MjEPeSTH2NBxhT0:w9KJblEKpd/72NBxhT0

Score

1^/10

Malware Config

Signatures

Files

b452ad3d3d469b7fa8ce6a819e1c6cc0N.exe
.dll windows:6 windows x86 arch:x86

700d08c297ef0b655125b725574e3e3a

Code Sign

f3:75:f9:1d:3d:e5:d0:e2
Certificate

Issuer

CN=Mozilla Fake CA

Not Before

25/09/2015, 14:02

Not After

12/06/2035, 14:02

Subject

CN=Mozilla Fake SPC

25:3d:cd:25:3c:4b:f8:99:c0:f9:29:6a:7a:a4:62:85:a1:52:9a:fa
Signer

Actual PE Digest

25:3d:cd:25:3c:4b:f8:99:c0:f9:29:6a:7a:a4:62:85:a1:52:9a:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\builds\moz2_slave\m-in-w32-d-0000000000000000000\build\src\obj-firefox\security\nss\lib\ckfw\builtins\nssckbi.pdb

Imports

nss3

PL_strcasecmp
PR_CallOnceWithArg
PL_strlen
PR_CallOnce
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PL_ArenaRelease
PL_ArenaAllocate
PL_FinishArenaPool
PL_InitArenaPool
PR_Free
PR_Calloc
PR_GetCurrentThread
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PL_CompareValues
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable
PR_Assert

msvcr120

__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
memmove
memset
memcmp
memcpy

mozglue

frex

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

700d08c297ef0b655125b725574e3e3a

Code Sign

f3:75:f9:1d:3d:e5:d0:e2Certificate

25:3d:cd:25:3c:4b:f8:99:c0:f9:29:6a:7a:a4:62:85:a1:52:9a:faSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

msvcr120

mozglue

kernel32

Exports

Exports

Sections

.text Size: 109KB - Virtual size: 108KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 409KB - Virtual size: 409KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

f3:75:f9:1d:3d:e5:d0:e2
Certificate

25:3d:cd:25:3c:4b:f8:99:c0:f9:29:6a:7a:a4:62:85:a1:52:9a:fa
Signer

.text
Size: 109KB - Virtual size: 108KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 409KB - Virtual size: 409KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB