49736f92b490af172fe948a657ccce80b7ec53c88c2b2c2a670e89fed20a790a

Sharing

Copy URL

Twitter E-mail

General

Target

49736f92b490af172fe948a657ccce80b7ec53c88c2b2c2a670e89fed20a790a
Size

656.1MB
MD5

0abfdf56ba9ffad0f0b5acf452fffc21
SHA1

faa5193485942b082977501af0387fc0044f1408
SHA256

49736f92b490af172fe948a657ccce80b7ec53c88c2b2c2a670e89fed20a790a
SHA512

44de0815c12ea392f0bcd8e3ddb080976ea4ab0f871731a0a72b8253ca25f4f758c9deb7a8bfe3c886e8f764ffcec2765fb2925a0fd09959e37266eb83470c7d
SSDEEP

12582912:tQyQyQyQyQyQyQyQDQyQyQyQyQyQyQyQDQyQyQyQyQyQyQyQDQyQyQyQyQyQyQyJ:tnnnnnnn+nnnnnnn+nnnnnnn+nnnnnnJ

Score

1^/10

Malware Config

Signatures

Files

49736f92b490af172fe948a657ccce80b7ec53c88c2b2c2a670e89fed20a790a
.exe windows:5 windows x86 arch:x86

e4a080fe3824aa611c56562a3d9167ed

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07
Certificate

Issuer

CN=America Online Root Certification Authority 1,O=America Online Inc.,C=US

Not Before

04-06-2004 17:26

Not After

04-06-2029 17:26

Subject

CN=AOL Member CA,O=America Online Inc.,L=Dulles,ST=Virginia,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:a8:c9:c3:87:71:9f:49:a1:6a:f2:40:65:56:55:50
Certificate

Issuer

CN=AOL Member CA,O=America Online Inc.,L=Dulles,ST=Virginia,C=US

Not Before

15-03-2011 18:25

Not After

14-03-2016 18:25

Subject

CN=Nullsoft Inc.,OU=Winamp,O=Nullsoft Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4a:4b:01:c9:eb:08:1f:07:fb:61:c0:33:26:f8:65:29:20:ea:79:f6
Signer

Actual PE Digest

4a:4b:01:c9:eb:08:1f:07:fb:61:c0:33:26:f8:65:29:20:ea:79:f6

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

CoCreateInstance

oleaut32

VariantInit

crypt32

CryptStringToBinaryA

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..zip0
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

..zip1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..zip2
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4a080fe3824aa611c56562a3d9167ed

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

5a:a8:c9:c3:87:71:9f:49:a1:6a:f2:40:65:56:55:50Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

4a:4b:01:c9:eb:08:1f:07:fb:61:c0:33:26:f8:65:29:20:ea:79:f6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

crypt32

user32

Sections

.text Size: - Virtual size: 282KB

.rdata Size: - Virtual size: 63KB

.data Size: - Virtual size: 265KB

..zip0 Size: - Virtual size: 3.9MB

..zip1 Size: 1KB - Virtual size: 1KB

..zip2 Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 187KB - Virtual size: 186KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

07
Certificate

5a:a8:c9:c3:87:71:9f:49:a1:6a:f2:40:65:56:55:50
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

4a:4b:01:c9:eb:08:1f:07:fb:61:c0:33:26:f8:65:29:20:ea:79:f6
Signer

.text
Size: - Virtual size: 282KB

.rdata
Size: - Virtual size: 63KB

.data
Size: - Virtual size: 265KB

..zip0
Size: - Virtual size: 3.9MB

..zip1
Size: 1KB - Virtual size: 1KB

..zip2
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 187KB - Virtual size: 186KB