f0ac38e3927bdb136aa43788184e26fe5783d11420e64993dc2b6cc480b34b5aN

Sharing

Copy URL

Twitter E-mail

General

Target

f0ac38e3927bdb136aa43788184e26fe5783d11420e64993dc2b6cc480b34b5aN
Size

42KB
MD5

f987f944d2b9a9d5d7886061b0d87120
SHA1

efe5422b14d24fef4ccb8154886b3c6e8398527c
SHA256

f0ac38e3927bdb136aa43788184e26fe5783d11420e64993dc2b6cc480b34b5a
SHA512

9c15a4cb0f6bf59a4cbc14feaab017e4e5f583cb185e7e599fec1a923cd5351fa1b05e965cb10ca427326c474f44aaea8910736ec05aedd54560e4a5c33941e3
SSDEEP

768:7WQD3EnTdErEPBScZVxUrKlgBAZ17OKTEvoMin2EBhrmjoT4:7X+TVjlgGj7OKTEvoMFEBhrmjoT4

Score

1^/10

Malware Config

Signatures

Files

f0ac38e3927bdb136aa43788184e26fe5783d11420e64993dc2b6cc480b34b5aN
.dll windows:6 windows x86 arch:x86

8daa594d00e5879b2ab43c25c5d9f2fe

Code Sign

33:00:00:00:98:04:58:cb:7f:23:09:b0:9e:00:00:00:00:00:98
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30-03-2016 19:21

Not After

30-06-2017 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28-10-2015 20:31

Not After

28-01-2017 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:34:06:fb:96:5e:af:42:07:88:70:18:8b:2c:85:a3:27:4d:41:e3:1e:d0:2b:7e:e6:55:f4:66:2d:97:94:8d
Signer

Actual PE Digest

f6:34:06:fb:96:5e:af:42:07:88:70:18:8b:2c:85:a3:27:4d:41:e3:1e:d0:2b:7e:e6:55:f4:66:2d:97:94:8d

Digest Algorithm

sha256

PE Digest Matches

true

19:f1:78:7d:c0:a4:55:c8:3a:36:67:b4:5d:4a:eb:6c:97:cd:be:40
Signer

Actual PE Digest

19:f1:78:7d:c0:a4:55:c8:3a:36:67:b4:5d:4a:eb:6c:97:cd:be:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

P:\Target\x86\ship\lync\x-none\npmeetingjoinpluginoc.pdb

Imports

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
TraceMessage
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionEx
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
WerRegisterMemoryBlock
VirtualProtect
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
HeapSetInformation
QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep

oleaut32

SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
SysReAllocStringLen

msvcr100

_onexit
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
memset
vswprintf_s
free
calloc
_vsnprintf
__CxxFrameHandler3
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_recalloc

ole32

CoCreateInstance

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8daa594d00e5879b2ab43c25c5d9f2fe

Code Sign

33:00:00:00:98:04:58:cb:7f:23:09:b0:9e:00:00:00:00:00:98Certificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

f6:34:06:fb:96:5e:af:42:07:88:70:18:8b:2c:85:a3:27:4d:41:e3:1e:d0:2b:7e:e6:55:f4:66:2d:97:94:8dSigner

19:f1:78:7d:c0:a4:55:c8:3a:36:67:b4:5d:4a:eb:6c:97:cd:be:40Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp100

advapi32

kernel32

oleaut32

msvcr100

ole32

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:00:98:04:58:cb:7f:23:09:b0:9e:00:00:00:00:00:98
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

f6:34:06:fb:96:5e:af:42:07:88:70:18:8b:2c:85:a3:27:4d:41:e3:1e:d0:2b:7e:e6:55:f4:66:2d:97:94:8d
Signer

19:f1:78:7d:c0:a4:55:c8:3a:36:67:b4:5d:4a:eb:6c:97:cd:be:40
Signer

.text
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB