General

Malware Config

Signatures

Files

• b4721a41dd1792abc66ac149fa1a4aa3c8bfc464428773467a6850b206b8f97b

  .exe windows x86

  0afadeb7020d7fe32c3bdbe471fc1e52

  
  

  Code Sign

  08:61:da:72:75:70:70:9f:f2:19:68:c8:2e:21:62:e9

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-11-2019 00:00

  Not After

  02-11-2020 12:00

  Subject

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:fd:bd:27:4c:8b:ed:1c:b4:3e:7f:92:fb:02:9f:f8

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-10-2019 00:00

  Not After

  02-11-2020 12:00

  Subject

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-10-2019 00:00

  Not After

  17-10-2030 00:00

  Subject

  CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  24:87:cb:f0:c2:7e:2b:02:45:88:0a:fe:f2:43:14:40:ef:62:c4:23:1e:f2:49:0a:c0:e6:33:b9:23:ee:ad:4e

  Signer

  Actual PE Digest

  24:87:cb:f0:c2:7e:2b:02:45:88:0a:fe:f2:43:14:40:ef:62:c4:23:1e:f2:49:0a:c0:e6:33:b9:23:ee:ad:4e

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  21-02-2020 03:00

  Valid: true

  Chain 1

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  69:99:ab:19:a1:49:8f:21:31:83:a3:37:03:aa:9b:cb:e3:1d:b9:f2

  Signer

  Actual PE Digest

  69:99:ab:19:a1:49:8f:21:31:83:a3:37:03:aa:9b:cb:e3:1d:b9:f2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  21-02-2020 03:00

  Valid: true

  Chain 1

  CN=武汉巨博优科技有限公司,OU=综合支持部,O=武汉巨博优科技有限公司,L=武汉市,ST=湖北省,C=CN

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetModuleFileNameA

  GetModuleHandleExW

  IsBadReadPtr

  LoadLibraryA

  ExpandEnvironmentStringsA

  ConnectNamedPipe

  DisconnectNamedPipe

  TransactNamedPipe

  SetNamedPipeHandleState

  WaitNamedPipeW

  ExitProcess

  FlushFileBuffers

  WriteFile

  lstrlenW

  ReadFile

  GetOverlappedResult

  WaitForMultipleObjects

  CreateNamedPipeW

  GetCommandLineW

  WriteProcessMemory

  CreateEventW

  TerminateThread

  MultiByteToWideChar

  GetModuleHandleA

  TerminateProcess

  CreateProcessW

  CopyFileW

  ExpandEnvironmentStringsW

  GetLocalTime

  Sleep

  OpenMutexW

  GetFileSizeEx

  GetProcessTimes

  CreateMutexW

  GetCurrentProcess

  GetTickCount

  lstrcmpiW

  GetModuleFileNameW

  WaitForSingleObject

  SetEvent

  CreateThread

  SetFileAttributesW

  DeleteFileW

  CreateFileW

  SetErrorMode

  DosDateTimeToFileTime

  SystemTimeToFileTime

  DuplicateHandle

  SetFileTime

  SetFilePointer

  MulDiv

  OpenProcess

  CloseHandle

  LoadLibraryW

  GetModuleHandleW

  WideCharToMultiByte

  InterlockedDecrement

  DeleteCriticalSection

  RaiseException

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  DecodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  InitializeCriticalSectionAndSpinCount

  SetLastError

  GetLastError

  WaitForSingleObjectEx

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  SetStdHandle

  SetConsoleCtrlHandler

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetSystemInfo

  LoadLibraryExA

  IsDebuggerPresent

  OutputDebugStringW

  EnterCriticalSection

  LeaveCriticalSection

  FormatMessageW

  CreateDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  GetFileInformationByHandle

  SetEndOfFile

  SetFilePointerEx

  AreFileApisANSI

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  LocalFree

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  lstrcpyW

  VerSetConditionMask

  VerifyVersionInfoA

  InitializeCriticalSection

  SleepEx

  FormatMessageA

  GetFileType

  GetStdHandle

  PeekNamedPipe

  FreeResource

  InterlockedIncrement

  ReleaseMutex

  GlobalAlloc

  MoveFileExW

  GetFileSize

  GetVersionExW

  GlobalLock

  GlobalUnlock

  GetCurrentThreadId

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  ResumeThread

  SetThreadAffinityMask

  GetVolumeInformationW

  DeviceIoControl

  GetSystemDirectoryW

  CreateFileA

  GetCurrentThread

  GetComputerNameW

  FindFirstFileW

  GetFileAttributesW

  WriteConsoleW

  RtlUnwind

  GetDriveTypeW

  GetFullPathNameW

  SetEnvironmentVariableA

  GetCurrentDirectoryW

  RemoveDirectoryW

  ExitThread

  FreeLibraryAndExitThread

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetACP

  GetConsoleMode

  ReadConsoleW

  GetConsoleCP

  user32

  GetWindowPlacement

  SetWindowPlacement

  EnumWindows

  SetWinEventHook

  SetLayeredWindowAttributes

  SendMessageW

  SetWindowTextW

  FlashWindowEx

  LoadImageW

  GetMessageW

  TrackMouseEvent

  SetForegroundWindow

  LoadMenuW

  GetSubMenu

  SetMenuDefaultItem

  TrackPopupMenu

  DestroyMenu

  PtInRect

  RegisterClassExW

  GetWindowTextW

  CreateWindowExW

  UpdateWindow

  IsWindow

  IsIconic

  IsZoomed

  FindWindowExW

  GetMonitorInfoW

  MonitorFromWindow

  SetWindowPos

  PostMessageW

  GetWindowThreadProcessId

  ClientToScreen

  wsprintfW

  LoadCursorW

  DefWindowProcW

  GetLastInputInfo

  GetClassNameW

  GetWindowRect

  PostQuitMessage

  CallWindowProcW

  ShowWindow

  IsWindowVisible

  SetWindowLongW

  GetWindowLongW

  SetTimer

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  SetCursor

  MoveWindow

  EnableWindow

  GetCursorPos

  DestroyWindow

  KillTimer

  GetParent

  WindowFromPoint

  GetShellWindow

  GetDesktopWindow

  GetSystemMetrics

  GetForegroundWindow

  MapVirtualKeyExW

  GetKeyNameTextW

  GetKeyboardLayout

  IsWindowEnabled

  GetWindowTextLengthW

  GetGUIThreadInfo

  InvalidateRgn

  CreateAcceleratorTableW

  GetCaretPos

  ShowCaret

  HideCaret

  SetRect

  FillRect

  DrawTextW

  CharPrevW

  InflateRect

  UnionRect

  OffsetRect

  RegisterClassW

  GetClassInfoExW

  SetFocus

  GetMenu

  SetPropW

  GetPropW

  GetClientRect

  AdjustWindowRectEx

  GetWindow

  CharNextW

  GetActiveWindow

  GetFocus

  GetKeyState

  SetCapture

  ReleaseCapture

  GetDC

  ReleaseDC

  BeginPaint

  EndPaint

  GetUpdateRect

  InvalidateRect

  CreateCaret

  GetCaretBlinkTime

  SetCaretPos

  ScreenToClient

  MapWindowPoints

  GetSysColor

  IntersectRect

  IsRectEmpty

  UpdateLayeredWindow

  GetWindowRgn

  RegisterWindowMessageW

  SetWindowRgn

  MessageBoxW

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptAcquireContextA

  CryptReleaseContext

  CryptGenRandom

  CryptDestroyHash

  CryptDestroyKey

  CryptImportKey

  CryptEncrypt

  LookupAccountNameW

  ConvertSidToStringSidA

  EnumServicesStatusW

  OpenSCManagerW

  RegQueryInfoKeyW

  RegOpenCurrentUser

  FreeSid

  CheckTokenMembership

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  AllocateAndInitializeSid

  ole32

  CreateStreamOnHGlobal

  OleLockRunning

  CLSIDFromProgID

  CLSIDFromString

  ReleaseStgMedium

  OleDuplicateData

  DoDragDrop

  CoSetProxyBlanket

  CoInitializeEx

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  StringFromCLSID

  CoCreateGuid

  CoUninitialize

  CoInitializeSecurity

  RegisterDragDrop

  oleaut32

  SysStringByteLen

  SysAllocString

  VariantClear

  VariantInit

  SysAllocStringByteLen

  SysFreeString

  shlwapi

  PathAppendA

  PathFindFileNameA

  PathFileExistsA

  StrStrIW

  StrStrW

  StrCpyW

  PathFindFileNameW

  StrStrIA

  PathRemoveFileSpecW

  StrIsIntlEqualW

  imagehlp

  MakeSureDirectoryPathExists

  setupapi

  SetupDiGetDeviceInterfaceDetailW

  SetupDiEnumDeviceInterfaces

  SetupDiGetClassDevsW

  SetupDiDestroyDeviceInfoList

  ws2_32

  getpeername

  getsockopt

  htons

  ntohs

  setsockopt

  socket

  ntohl

  htonl

  WSAStartup

  connect

  WSACleanup

  gethostbyname

  closesocket

  bind

  WSAIoctl

  getaddrinfo

  freeaddrinfo

  recvfrom

  sendto

  accept

  listen

  ioctlsocket

  gethostname

  send

  recv

  WSASetLastError

  select

  __WSAFDIsSet

  WSAGetLastError

  getsockname

  wldap32

  ord32

  ord27

  ord35

  ord79

  ord30

  ord22

  ord26

  ord143

  ord46

  ord211

  ord301

  ord200

  ord60

  ord50

  ord41

  ord33

  wininet

  InternetSetOptionW

  HttpSendRequestA

  HttpOpenRequestA

  InternetCloseHandle

  InternetOpenA

  InternetReadFile

  InternetConnectA

  HttpQueryInfoA

  iphlpapi

  GetAdaptersInfo

  msimg32

  AlphaBlend

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  gdi32

  SelectObject

  CloseEnhMetaFile

  CreateEnhMetaFileW

  GetEnhMetaFileHeader

  PlayEnhMetaFile

  SaveDC

  GetObjectW

  SetWindowOrgEx

  CreateRectRgn

  PtInRegion

  CreateDIBSection

  CreateRoundRectRgn

  CombineRgn

  CreatePenIndirect

  CreateRectRgnIndirect

  CreateSolidBrush

  GetCharABCWidthsW

  RestoreDC

  GetStockObject

  GetDeviceCaps

  DeleteObject

  DeleteDC

  CreatePen

  CreateFontIndirectW

  CreateDIBitmap

  GetClipBox

  GetTextExtentPoint32W

  LineTo

  RoundRect

  SelectClipRgn

  ExtSelectClipRgn

  SetBkColor

  SetBkMode

  StretchBlt

  SetStretchBltMode

  SetTextColor

  GetObjectA

  MoveToEx

  CreateCompatibleDC

  CreateCompatibleBitmap

  BitBlt

  GetTextMetricsW

  TextOutW

  GdiFlush

  GetBitmapBits

  SetBitmapBits

  imm32

  ImmReleaseContext

  ImmSetCompositionWindow

  ImmGetContext

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  ord17

  gdiplus

  GdipDisposeImage

  GdipCloneImage

  GdipLoadImageFromStreamICM

  GdipLoadImageFromStream

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipCloneStringFormat

  GdipDeleteStringFormat

  GdipGetImageWidth

  GdipGetImageHeight

  GdipImageGetFrameDimensionsList

  GdipImageGetFrameCount

  GdipImageSelectActiveFrame

  GdipGetPropertyItemSize

  GdipGetPropertyItem

  GdipDrawImageRectI

  GdipImageGetFrameDimensionsCount

  GdiplusStartup

  GdiplusShutdown

  GdipAlloc

  GdipFree

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreatePen1

  GdipDeletePen

  GdipSetPenMode

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipSetSmoothingMode

  GdipSetTextRenderingHint

  GdipSetInterpolationMode

  GdipDrawRectangleI

  GdipFillRectangleI

  GdipCreateFontFromDC

  GdipCreateFontFromLogfontA

  GdipDeleteFont

  GdipDrawString

  GdipMeasureString

  GdipStringFormatGetGenericTypographic

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 327KB - Virtual size: 327KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 172KB - Virtual size: 273KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 85KB - Virtual size: 84KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 88KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ