a27be4926e4a36a51f8397b8cb3c0bf77a8ffe6d2867a672cda8d83483d6dccdN

Sharing

Copy URL

Twitter E-mail

General

Target

a27be4926e4a36a51f8397b8cb3c0bf77a8ffe6d2867a672cda8d83483d6dccdN
Size

89KB
MD5

ada5d91d199973c38c732af95f7ec020
SHA1

55b6048e9cd54ddaed49bbb19c628581fe67c207
SHA256

a27be4926e4a36a51f8397b8cb3c0bf77a8ffe6d2867a672cda8d83483d6dccd
SHA512

6d552e7a3b5fa1ca3ada508142470b87ba99958caf92c9893001eb09c8e5542ea3ca5b17ab81436957a839d33dd9b6b304729cb2e2dabd6bb90cd2d093bc1ddd
SSDEEP

1536:qGGMgPlVifTXcJfGMEdIAtnrDo77iqTjalbBVWN9xykijHejTDB+:fTuMbMGDaunrDo77UlbyNXObIDB+

Score

1^/10

Malware Config

Signatures

Files

a27be4926e4a36a51f8397b8cb3c0bf77a8ffe6d2867a672cda8d83483d6dccdN
.cab
msjtes40.dll
.dll regsvr32 windows:4 windows x86 arch:x86

af57a2f1fef6870aad73c3cbc84fb4f7

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10-01-1997 07:00

Not After

31-12-2020 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04-04-2006 17:44

Not After

26-04-2012 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-04-2006 19:43

Not After

04-10-2007 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7c:ba:55:a5:2b:3e:4f:1d:34:cc:30:82:dc:46:8b:46:64:a2:56:cf
Signer

Actual PE Digest

7c:ba:55:a5:2b:3e:4f:1d:34:cc:30:82:dc:46:8b:46:64:a2:56:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
CompareStringA
CompareStringW
lstrcmpiA
GetLocaleInfoA
MultiByteToWideChar
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLCID
GetVersionExA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
GetModuleFileNameA
InitializeCriticalSection
DeleteCriticalSection
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetStringTypeA
GetStringTypeW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle

ole32

CoGetMalloc
CoCreateGuid
IIDFromString

oleaut32

VarR8FromStr
LoadTypeLi
RegisterTypeLi
SysStringLen
LoadRegTypeLi
CreateStdDispatch
SysAllocString
VariantClear
VariantInit
SysStringByteLen
SysReAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VarBstrFromCy
VarBstrFromR8
VarBstrFromR4
VarBstrFromI4
VarBstrFromI2
VarBstrFromDec
VarDateFromStr
VarCyFromStr
SafeArrayCreate
VarR4FromStr
VarI4FromStr
VarI2FromStr
VarDecFromStr
VarBstrFromDate
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy
SafeArrayPutElement

user32

wsprintfA
IsCharAlphaA
IsCharAlphaW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af57a2f1fef6870aad73c3cbc84fb4f7

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

7c:ba:55:a5:2b:3e:4f:1d:34:cc:30:82:dc:46:8b:46:64:a2:56:cfSigner

Headers

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

user32

version

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 167KB

.data Size: 28KB - Virtual size: 25KB

.rsrc Size: 24KB - Virtual size: 22KB

.reloc Size: 8KB - Virtual size: 5KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

7c:ba:55:a5:2b:3e:4f:1d:34:cc:30:82:dc:46:8b:46:64:a2:56:cf
Signer

.text
Size: 168KB - Virtual size: 167KB

.data
Size: 28KB - Virtual size: 25KB

.rsrc
Size: 24KB - Virtual size: 22KB

.reloc
Size: 8KB - Virtual size: 5KB