68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N

Sharing

Copy URL

Twitter E-mail

General

Target

68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N
Size

230KB
MD5

63ae4c2bc1cda3d043d3238877f63c90
SHA1

c53ec3b49387e80a035698e394837139e66db68a
SHA256

68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938
SHA512

0b6f9aea541abae61292dd043c389aae902f6deedcc15a26f79753c6ce6f3580bed2d32c62289d7e880d00ee85cef1de3177c4f7eaa9be8396a4f0d9960a288b
SSDEEP

3072:qIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:3DAWw5NV4EBXWAIT/nw08xTm3E

Score

1^/10

Malware Config

Signatures

Files

68af2a0381ddb077ee70c03dfe3d88685fae08121f22a6e63710ddb4e86ec938N
.exe windows:4 windows x86 arch:x86

534f6f46b9ce5161143aa5f7bb8313fe

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-07-2010 22:53

Not After

19-10-2011 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:12

Not After

25-07-2011 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25-01-2006 23:22

Not After

25-01-2017 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

e8:e4:d8:0c:37:75:8b:14:fa:c7:3c:89:3d:83:10:ae:1b:10:7a:c7
Signer

Actual PE Digest

e8:e4:d8:0c:37:75:8b:14:fa:c7:3c:89:3d:83:10:ae:1b:10:7a:c7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoW
EndUpdateResourceA
IsBadStringPtrW
OpenMutexW
GetLogicalDriveStringsW
GetStringTypeW
SetErrorMode
SetCurrentDirectoryW
GetExitCodeProcess
RemoveDirectoryA
GetSystemDefaultLCID
GetSystemDirectoryA
EnumDateFormatsW
WinExec
lstrcpynA
GetStringTypeA
GetEnvironmentVariableA
IsBadCodePtr
CreateSemaphoreW
GetFullPathNameW
GetComputerNameA
FindAtomA
lstrcmp
BeginUpdateResourceA
DeleteAtom
GetThreadPriority
lstrcmpW
LoadLibraryA
GetExpandedNameA
GetWindowsDirectoryA
GetCurrentDirectoryW
CopyFileA
lstrcmpi
LocalFree
EnumCalendarInfoA
SetCalendarInfoA
GetUserDefaultLCID
GetProcAddress
GetSystemDirectoryW
GetModuleHandleW
GetUserDefaultLangID
MoveFileW
GetCPInfo

user32

GetWindowTextLengthA
CreateWindowExW
LoadImageA
wvsprintfA
GetCursorPos
RegisterClassW
GetDlgItemTextA
PostMessageW
CheckRadioButton
SendMessageA
DefDlgProcA
GetSysColor
CharUpperA
SetDlgItemInt
RegisterClassExA
RegisterClassA
DefDlgProcW
IsWindowEnabled
SetForegroundWindow
DefWindowProcW
CharPrevW
GetTopWindow
CreateDialogParamW
DefWindowProcA
wsprintfW
DrawTextA
wvsprintfW
LoadMenuW
CascadeWindows
MessageBeep
PostMessageA
GetWindowLongA
SetParent
GetAsyncKeyState

gdi32

GetTextCharsetInfo
OffsetRgn
BitBlt
GetMetaRgn
CreateDCA
PlayEnhMetaFile
EnumFontFamiliesExW
EnumFontsW
GetEnhMetaFileDescriptionW

advapi32

RegOpenKeyA
RegRestoreKeyW
RegRestoreKeyA
RegDeleteValueW
RegSaveKeyW
RegOpenKeyA
RegDeleteKeyW

shlwapi

PathIsFileSpecW
UrlEscapeA
StrRChrA
StrChrNIW
StrCmpLogicalW
UrlCompareA
StrFormatByteSize64A
SHCreateThread
PathIsSameRootW
PathSkipRootW

version

VerLanguageNameA
VerQueryValueA

inetcomm

MimeOleGetFileInfoW
MimeOleParseMhtmlUrl
HrFreeAttachData
HrGetAttachIconByFile
MimeOleCreateHashTable
EssSignCertificateEncodeEx

crypt32

CryptDecryptAndVerifyMessageSignature
CertCreateContext
CryptUnregisterOIDInfo
CertCloseStore
CertAddCRLContextToStore
CryptEnumKeyIdentifierProperties

Sections

.Pv
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.EX
Size: 2KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.KjVM
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UWzeb
Size: 3KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.J
Size: 1KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.X
Size: 2KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 171KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.W
Size: 4KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

534f6f46b9ce5161143aa5f7bb8313fe

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

e8:e4:d8:0c:37:75:8b:14:fa:c7:3c:89:3d:83:10:ae:1b:10:7a:c7Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

version

inetcomm

crypt32

Sections

.Pv Size: 8KB - Virtual size: 8KB

.EX Size: 2KB - Virtual size: 121KB

.KjVM Size: 12KB - Virtual size: 12KB

.UWzeb Size: 3KB - Virtual size: 44KB

.J Size: 1KB - Virtual size: 51KB

.X Size: 2KB - Virtual size: 243KB

.data Size: 171KB - Virtual size: 247KB

.W Size: 4KB - Virtual size: 246KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 1024B - Virtual size: 944B

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

e8:e4:d8:0c:37:75:8b:14:fa:c7:3c:89:3d:83:10:ae:1b:10:7a:c7
Signer

.Pv
Size: 8KB - Virtual size: 8KB

.EX
Size: 2KB - Virtual size: 121KB

.KjVM
Size: 12KB - Virtual size: 12KB

.UWzeb
Size: 3KB - Virtual size: 44KB

.J
Size: 1KB - Virtual size: 51KB

.X
Size: 2KB - Virtual size: 243KB

.data
Size: 171KB - Virtual size: 247KB

.W
Size: 4KB - Virtual size: 246KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 1024B - Virtual size: 944B