c5214904e68f52092288f6864ab4082739adba56bb9f73a362839af5317b70e3

Sharing

Copy URL Twitter E-mail

General

Target

c5214904e68f52092288f6864ab4082739adba56bb9f73a362839af5317b70e3
Size

754KB
MD5

f7be0dd96e98048c0d286394c6d6629f
SHA1

fab712b6a88eb7fbc3f149058829fe11dd923e7d
SHA256

c5214904e68f52092288f6864ab4082739adba56bb9f73a362839af5317b70e3
SHA512

51804968705636c78b7ced410948ef0732e1da3fa4884e7132014deaf3b529d6b40440aae054ef8656845f3cb2a3eb16bc3fdb3d9b89172ed10f2b3872ff66ed
SSDEEP

12288:PIM3VP7HyrzEBf8V/eaC8W4ah2Ig4COeVgiTaRavoDBQ5iel:PvVLyrzEBf8deaC8o2Ig4CzhTaRavOO

Score

1^/10

Malware Config

Signatures

Files

c5214904e68f52092288f6864ab4082739adba56bb9f73a362839af5317b70e3
.dll regsvr32 windows:5 windows x86 arch:x86

4e37e2ffbd35d63c4d78bd455882d145

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:3a:4c:a0:48:20:79:30:05:d1:02:6f:85:00:56:00:c2:95:01:ef
Signer

Actual PE Digest

21:3a:4c:a0:48:20:79:30:05:d1:02:6f:85:00:56:00:c2:95:01:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
GetCurrentProcess
WaitForSingleObject
OutputDebugStringW
WriteFile
DeleteFileW
GetCurrentThreadId
SetLastError
FlushInstructionCache
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
CreateDirectoryW
GetShortPathNameW
GetTempPathW
SetFilePointer
GetTickCount
CreateEventW
SetEvent
CreateProcessW
MoveFileExW
LoadLibraryExW
GlobalUnlock
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetFileAttributesA
CreateProcessA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GlobalLock
GlobalAlloc
GetCurrentDirectoryA
GetFullPathNameA
Process32NextW
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesW
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
FileTimeToSystemTime
GetVersion
GetSystemInfo
GetVersionExW
GetTempFileNameW
GlobalFree
ReleaseSemaphore
ResumeThread
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetErrorMode
lstrlenA
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
FindResourceExW
WideCharToMultiByte
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetThreadLocale
GetLastError
SetThreadLocale
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
GetStartupInfoA
InterlockedIncrement
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
FlushFileBuffers
CreateThread

psapi

EnumProcesses
GetProcessImageFileNameW

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
socket
gethostname
ioctlsocket
getaddrinfo
freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

IsWindow
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetCursor
ReleaseCapture
TrackPopupMenu
GetCursorPos
PostMessageW
PostQuitMessage
KillTimer
SetTimer
UnregisterClassA
BeginPaint
DestroyMenu
NotifyWinEvent
FindWindowW
GetParent
GetAncestor
SetFocus
CreateDialogParamW
LoadImageW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SystemParametersInfoW
SetWindowsHookExW
DrawTextW
ScreenToClient
SetMenuItemInfoW
IsWindowVisible
SetForegroundWindow
SetCursor
ClientToScreen
GetWindowRect
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
SetDlgItemTextW
MessageBoxW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetDesktopWindow
CharNextW
FillRect
InvalidateRect
GetAsyncKeyState
EndPaint
DrawFocusRect
GetForegroundWindow
ReleaseDC
GetDC
GetSysColorBrush
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos
MoveWindow
GetClientRect
SetWindowTextW
SendMessageW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
ShowWindow
EnumWindows
EnumChildWindows
GetWindowTextW
GetWindowTextLengthW

gdi32

CreateSolidBrush
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
SelectObject
CreateDIBSection
SetBkMode
SetTextColor
CreateFontIndirectW
GetObjectW
DeleteObject
DeleteDC
GetDeviceCaps
GetStockObject
GdiFlush

advapi32

RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
RegDeleteValueA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
DuplicateTokenEx
GetUserNameW
RegEnumKeyW

shell32

Shell_NotifyIconW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CLSIDFromProgID
CoInitialize
CoCreateGuid
StringFromGUID2
CoTaskMemRealloc
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
LoadRegTypeLi
SysFreeString
SysAllocStringLen
VariantInit
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD544CanLeaveOfferPage
OCPRD544CleanupProduct
OCPRD544Detach
OCPRD544FindGuidAndRunDialog
OCPRD544FindGuidAndRunDialogA
OCPRD544GetAsyncOfferStatus
OCPRD544GetBannerInfo
OCPRD544GetBannerInfoW
OCPRD544GetMsg
OCPRD544GetNoCandy
OCPRD544GetOfferState
OCPRD544GetOfferType
OCPRD544Init2A
OCPRD544Init2W
OCPRD544InnoAdjust
OCPRD544InnoRestore
OCPRD544InstallShieldAdjust
OCPRD544LoadOpenCandyDLL
OCPRD544LogDevModeMessage
OCPRD544LogDevModeMessageW
OCPRD544NSISAdjust
OCPRD544PreInit
OCPRD544PrepareDownload
OCPRD544RunDialog
OCPRD544SetClientAdvancedOptions
OCPRD544SetClientAdvancedOptionsW
OCPRD544SetCmdLineValues
OCPRD544SetCmdLineValuesW
OCPRD544SetCustomBrushColor
OCPRD544SetCustomBrushColorW
OCPRD544SetNoCandy
OCPRD544SetOCOfferEnabled
OCPRD544SetOfferData
OCPRD544SetOfferLocation
OCPRD544SetUseDefaultColorBkGrnd
OCPRD544Shutdown
OCPRD544SignalProductFailed
OCPRD544SignalProductInstalled
OCPRD544StartDLMgr2Download
OCPRD544StartDLMgr2DownloadRunasAdmin
_OCPRD544DLMgr2Check@16
_OCPRD544Display@16
_OCPRD544DownloadMgr2RecycleOffer@12
_OCPRD544MgrCheck@16
_OCPRD544MgrExec@16
_OCPRD544RestartDll@16
_OCPRD544RestartDllAsAdmin@16
_OCPRD544RunOpenCandyDLL@16

Sections

.text
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e37e2ffbd35d63c4d78bd455882d145

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

21:3a:4c:a0:48:20:79:30:05:d1:02:6f:85:00:56:00:c2:95:01:efSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

psapi

ws2_32

msimg32

shlwapi

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

version

urlmon

wininet

Exports

Exports

Sections

.text Size: 508KB - Virtual size: 508KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 9KB - Virtual size: 19KB

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 31KB - Virtual size: 30KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

21:3a:4c:a0:48:20:79:30:05:d1:02:6f:85:00:56:00:c2:95:01:ef
Signer

.text
Size: 508KB - Virtual size: 508KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 31KB - Virtual size: 30KB