051bbb9a2e11a5bcbcf17ae7dd1349efd66e31367a2befeaede58ca933129cabN

Sharing

Copy URL

Twitter E-mail

General

Target

051bbb9a2e11a5bcbcf17ae7dd1349efd66e31367a2befeaede58ca933129cabN
Size

295KB
MD5

b6c753b29306469f27570c1c95026350
SHA1

4d0414e0b3d70eafe916e7866b69a0ece0cb3ebb
SHA256

051bbb9a2e11a5bcbcf17ae7dd1349efd66e31367a2befeaede58ca933129cab
SHA512

3dbbff66ed8acd4df58397aa00745fed474dc8e24d8bef0c85623bedcb0ed5c8f8812cdef9db5320951bb19d1dbe478412c15c289f1a071dc9bcd8d6d1808fff
SSDEEP

6144:X90oBH59BGOJU2piYHQm01XV3BV+UdvrEFp7hKxJ:X90MZ/rvHQvV3BjvrEH7wJ

Score

1^/10

Malware Config

Signatures

Files

051bbb9a2e11a5bcbcf17ae7dd1349efd66e31367a2befeaede58ca933129cabN
.dll windows:4 windows x86 arch:x86

30e9f95bce4b132f921df6ed3196ebda

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:d1:a0:ac:1a:81:a2:01:bf:c4:30:91:ff:be:99:a0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

01-12-2011 00:00

Not After

30-11-2013 23:59

Subject

CN=ESTsoft Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:e4:02:4f:76:6e:b0:ae:0c:cb:fe:9a:61:83:61:cb:91:37:70:7a
Signer

Actual PE Digest

e7:e4:02:4f:76:6e:b0:ae:0c:cb:fe:9a:61:83:61:cb:91:37:70:7a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\svn\trunk\altools_svn\common\ALCM\branch\bin\Release\DebugInfo\ALCMProxy.pdb

Imports

kernel32

GetVersionExA
ReleaseMutex
GetCurrentProcess
LocalFree
GetLocalTime
CreateFileA
GetFileSize
SetFilePointer
ReadFile
GetLastError
SetLastError
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetProcAddress
GetVersionExW
RemoveDirectoryA
CreateMutexA
DeleteFileA
CopyFileA
GetFileAttributesA
lstrlenW
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
LoadLibraryW
CloseHandle
LoadLibraryA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetProcessHeap
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
HeapSize

user32

wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
CreateProcessAsUserA
GetLengthSid
SetTokenInformation
ConvertStringSidToSidA
DuplicateTokenEx
OpenProcessToken
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA
SHFileOperationA

ole32

CoTaskMemFree

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

FreeUpdateLibrary
LoadUpdateLibraryA
LoadUpdateLibraryW

Sections

.text
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30e9f95bce4b132f921df6ed3196ebda

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

70:d1:a0:ac:1a:81:a2:01:bf:c4:30:91:ff:be:99:a0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e7:e4:02:4f:76:6e:b0:ae:0c:cb:fe:9a:61:83:61:cb:91:37:70:7aSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

version

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 141KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

70:d1:a0:ac:1a:81:a2:01:bf:c4:30:91:ff:be:99:a0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e7:e4:02:4f:76:6e:b0:ae:0c:cb:fe:9a:61:83:61:cb:91:37:70:7a
Signer

.text
Size: 144KB - Virtual size: 141KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 9KB