5d2e799d54fc5ac9bab443e45b11453c5849e35f40394188b29ef77c25fad300

Sharing

Copy URL Twitter E-mail

General

Target

5d2e799d54fc5ac9bab443e45b11453c5849e35f40394188b29ef77c25fad300
Size

664KB
MD5

f35385ce6d00298bc99cebab907d86d5
SHA1

2646a610333e403af5e4a1fef65ed93d600bfc12
SHA256

5d2e799d54fc5ac9bab443e45b11453c5849e35f40394188b29ef77c25fad300
SHA512

214f2b64fe7929485e092acd117f9d15ed47fe890f041df1fd09a9eed1fd2c8e9959a1cc456f1de3a4b897367ecf3ea7c3243cbbaa7e2e1bf88f5b7d587d8dd4
SSDEEP

12288:kHG5Sgzz3pqdupqduvuVqpyduVqpySIoyV7KZhSdRNjGSHfloflKlolkjSl/9O:kmXpqdupqduvuVqpyduVqpySIoyV7KZe

Score

1^/10

Malware Config

Signatures

Files

5d2e799d54fc5ac9bab443e45b11453c5849e35f40394188b29ef77c25fad300
.dll regsvr32 windows:6 windows x86 arch:x86

fac00d100a846637db30b905f339a8fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0b:2c:88:00:00:00:00:00:05
Certificate

Issuer

CN=CMedia

Not Before

25/02/2013, 02:25

Not After

25/02/2014, 02:35

Subject

CN=C-MEDIA ELECTRONICS INC.

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:06:69:1d:00:03:00:00:00:31
Certificate

Issuer

CN=Microsoft Digital Media Authority 2005

Not Before

06/01/2013, 17:20

Not After

06/01/2015, 17:30

Subject

CN=CMedia

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:cd:78:b5:2f:00:c4:fa:f6:3d:39:f1:73:53:65:3a:83:5b:fe:72
Signer

Actual PE Digest

e7:cd:78:b5:2f:00:c4:fa:f6:3d:39:f1:73:53:65:3a:83:5b:fe:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\users\tachun.cmedia\projects\cmeffectapo\effectlib\cmapomain\objfre_win7_x86\i386\CMAPOMain.pdb

Imports

msvcrt

wcsncpy_s
wcscat_s
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memset
memcpy
wcscpy_s
_ftol2_sse
??2@YAPAXI@Z
wcsstr
_wcsupr
_vsnwprintf
cos
swprintf_s
_purecall
memcpy_s
sqrt
calloc
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
_ftol2
memmove
system
free
malloc
sin
??3@YAXPAX@Z

kernel32

GlobalFree
OutputDebugStringA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
SetThreadLocale
GetThreadLocale
InterlockedExchange
Sleep
CloseHandle
SetEvent
WaitForSingleObject
OutputDebugStringW
FlushInstructionCache
GetCurrentProcess
GlobalAlloc
GetCurrentThreadId
lstrcmpW
MulDiv
SetLastError
GlobalUnlock
GlobalLock
lstrlenA
LockResource
HeapFree
GlobalHandle
GetVersionExA

ole32

OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
PropVariantClear
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetClassObject

oleaut32

SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
SysStringByteLen
VarBstrCmp
VariantInit
VariantClear
OleCreateFontIndirect

advapi32

RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW

user32

SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
IsDlgButtonChecked
MapDialogRect
EndDialog
SetWindowContextHelpId
SendDlgItemMessageW
CreateWindowExW
RegisterClassExW
LoadCursorW
RegisterWindowMessageW
DialogBoxIndirectParamW
GetActiveWindow
GetDlgCtrlID
CheckRadioButton
CheckDlgButton
EnableWindow
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextW
UnregisterClassA
GetClassInfoExW
IsWindow
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CharNextW
SetWindowLongW
GetWindowLongW
SendMessageW
PostMessageW
MessageBoxW
DefWindowProcW
GetSysColor
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
DestroyWindow
CallWindowProcW

gdi32

DeleteDC
SelectObject
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
CreateSolidBrush
GetObjectW
GetStockObject
DeleteObject

winmm

timeGetTime

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fac00d100a846637db30b905f339a8fa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

61:0b:2c:88:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

61:06:69:1d:00:03:00:00:00:31Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

e7:cd:78:b5:2f:00:c4:fa:f6:3d:39:f1:73:53:65:3a:83:5b:fe:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

ole32

oleaut32

advapi32

user32

gdi32

winmm

Exports

Exports

Sections

.text Size: 568KB - Virtual size: 567KB

.data Size: 33KB - Virtual size: 33KB

.rsrc Size: 37KB - Virtual size: 37KB

.reloc Size: 15KB - Virtual size: 15KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

61:0b:2c:88:00:00:00:00:00:05
Certificate

61:06:69:1d:00:03:00:00:00:31
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

e7:cd:78:b5:2f:00:c4:fa:f6:3d:39:f1:73:53:65:3a:83:5b:fe:72
Signer

.text
Size: 568KB - Virtual size: 567KB

.data
Size: 33KB - Virtual size: 33KB

.rsrc
Size: 37KB - Virtual size: 37KB

.reloc
Size: 15KB - Virtual size: 15KB