2cf9002b46c8de0ad77cf66bfd9a073a1137b8163868925ddfb21fe0fd949814N

Sharing

Copy URL Twitter E-mail

General

Target

2cf9002b46c8de0ad77cf66bfd9a073a1137b8163868925ddfb21fe0fd949814N
Size

86KB
MD5

39b4434ad18c1c1b49871d817cfd0b70
SHA1

733c9097e4d0976d6fa9c3485486e7ff9066443c
SHA256

2cf9002b46c8de0ad77cf66bfd9a073a1137b8163868925ddfb21fe0fd949814
SHA512

dcb05d8357156e3b97b6c49201c46741a59aeb44ef9ef1de06b19e6a8f793be24e14a9b89d238cd7e6f01eb18b4e88918d785c5f32c8dc66bcaa15391b732fb4
SSDEEP

1536:at9T1z/qETdAX/3HOWgwvcw/HKMe++BuHC:AcQAv5j/HXe++N

Score

1^/10

Malware Config

Signatures

Files

2cf9002b46c8de0ad77cf66bfd9a073a1137b8163868925ddfb21fe0fd949814N
.dll windows:4 windows x64 arch:x64

51f4740b2682e8b196d884eab87293fd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:d6:7d:f3:36:1f:ff:5d:ad:9e:7a:42:d2:aa:36:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/05/2007, 00:00

Not After

23/05/2009, 23:59

Subject

CN=Oracle,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Outside In Technology,O=Oracle,L=Chicago,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b7:8d:3e:82:80:fb:62:38:31:b9:76:55:22:a1:38:1f:c6:6a:22:35
Signer

Actual PE Digest

b7:8d:3e:82:80:fb:62:38:31:b9:76:55:22:a1:38:1f:c6:6a:22:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

n:\OIT_CVOB\Win\X64\Release\pdb\sccch.pdb

Imports

kernel32

HeapFree
GetProcessHeap
HeapAlloc
HeapReAlloc
RaiseException
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetSystemTimeAsFileTime

wvcore

Win32VGetUseNewSBOHandler

sccut

UTGetGlobalOptionSet
UTGetOption
IOCreate
IOMapIOERR
UTGetUnknownCharSet
UTMultiToDoubleByte
UTwsstrcpy
UTwstrlen
UTStatCallback
UTBailOutRelease

msvcr80

memcmp
_encode_pointer
_malloc_crt
_initterm
_initterm_e
free
memset
_decode_pointer
_amsg_exit
__C_specific_handler
__CppXcptFilter
__crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
memcpy
_encoded_null

Exports

Exports

CHDeInit
CHDoFilterSpecial
CHGetFilter
CHGetItem
CHGetItemCount
CHGetItemCountById
CHGetItemId
CHGetItems
CHGetRunFromItemId
CHGetRunInfo
CHGetSectionInfo
CHInit
CHIsWithinCookie
CHLockItemRange
CHNextCookieRange
CHNextItemId
CHPackageRemoteData
CHPrevItemId
CHReadAhead
CHSetOption
CHUnlockItemRange
CHUnpackageRemoteData

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51f4740b2682e8b196d884eab87293fd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

66:d6:7d:f3:36:1f:ff:5d:ad:9e:7a:42:d2:aa:36:52Certificate

Extended Key Usages

Key Usages

b7:8d:3e:82:80:fb:62:38:31:b9:76:55:22:a1:38:1f:c6:6a:22:35Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

wvcore

sccut

msvcr80

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 64KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 472B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

66:d6:7d:f3:36:1f:ff:5d:ad:9e:7a:42:d2:aa:36:52
Certificate

b7:8d:3e:82:80:fb:62:38:31:b9:76:55:22:a1:38:1f:c6:6a:22:35
Signer

.text
Size: 65KB - Virtual size: 64KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 472B