General

Malware Config

Signatures

Files

• 18be49398c00055101d49b2e21e2eef9de38799de69a3936f9f8a086701b2220

  .exe windows x86

  15a1467d8a0414983c2bb182535c764b

  
  

  Code Sign

  03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-09-2019 00:00

  Not After

  22-09-2020 12:00

  Subject

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

  Certificate

  Issuer

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2014 00:00

  Not After

  22-10-2024 00:00

  Subject

  CN=DigiCert Timestamp Responder,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  10-11-2006 00:00

  Not After

  10-11-2021 00:00

  Subject

  CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageServerAuth

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  ExtKeyUsageEmailProtection

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  19-09-2019 00:00

  Not After

  22-09-2020 12:00

  Subject

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-10-2019 00:00

  Not After

  17-10-2030 00:00

  Subject

  CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  79:9e:da:7b:57:30:74:9a:3b:d0:1f:c8:41:3e:42:42:b7:97:88:c8:1c:0d:69:82:72:76:15:37:29:cc:95:a0

  Signer

  Actual PE Digest

  79:9e:da:7b:57:30:74:9a:3b:d0:1f:c8:41:3e:42:42:b7:97:88:c8:1c:0d:69:82:72:76:15:37:29:cc:95:a0

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  10-01-2020 10:35

  Valid: true

  Chain 1

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  ae:dc:d7:15:d6:c4:24:47:14:8f:2c:b8:ea:98:6a:27:96:fd:bf:a0

  Signer

  Actual PE Digest

  ae:dc:d7:15:d6:c4:24:47:14:8f:2c:b8:ea:98:6a:27:96:fd:bf:a0

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  10-01-2020 10:35

  Valid: true

  Chain 1

  CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetModuleFileNameA

  GetModuleHandleExW

  IsBadReadPtr

  LoadLibraryA

  ExpandEnvironmentStringsA

  ConnectNamedPipe

  DisconnectNamedPipe

  TransactNamedPipe

  SetNamedPipeHandleState

  WaitNamedPipeW

  ExitProcess

  FlushFileBuffers

  WriteFile

  lstrlenW

  ReadFile

  GetOverlappedResult

  WaitForMultipleObjects

  CreateNamedPipeW

  GetCommandLineW

  MultiByteToWideChar

  CreateEventW

  TerminateThread

  OpenProcess

  GetModuleHandleA

  TerminateProcess

  CreateProcessW

  CopyFileW

  ExpandEnvironmentStringsW

  GetLocalTime

  Sleep

  OpenMutexW

  GetFileSizeEx

  GetProcessTimes

  CreateMutexW

  GetCurrentProcess

  GetTickCount

  lstrcmpiW

  GetModuleFileNameW

  WaitForSingleObject

  SetEvent

  CreateThread

  SetFileAttributesW

  SetErrorMode

  DosDateTimeToFileTime

  SetFilePointer

  MulDiv

  WriteProcessMemory

  DeleteFileW

  CreateFileW

  CloseHandle

  LoadLibraryW

  GetModuleHandleW

  WideCharToMultiByte

  InterlockedDecrement

  DeleteCriticalSection

  RaiseException

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  DecodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  InitializeCriticalSectionAndSpinCount

  SetLastError

  GetLastError

  SetFileTime

  SystemTimeToFileTime

  GetSystemInfo

  LoadLibraryExA

  IsDebuggerPresent

  OutputDebugStringW

  EnterCriticalSection

  LeaveCriticalSection

  FormatMessageW

  CreateDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesExW

  GetFileInformationByHandle

  SetEndOfFile

  SetFilePointerEx

  AreFileApisANSI

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  LocalFree

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  lstrcpyW

  VerSetConditionMask

  VerifyVersionInfoA

  InitializeCriticalSection

  SleepEx

  FormatMessageA

  GetFileType

  GetStdHandle

  PeekNamedPipe

  FreeResource

  InterlockedIncrement

  ReleaseMutex

  GlobalAlloc

  MoveFileExW

  GetFileSize

  GetVersionExW

  GlobalLock

  GlobalUnlock

  GetCurrentThreadId

  GetCurrentProcessId

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  InitializeSListHead

  ResumeThread

  SetThreadAffinityMask

  GetVolumeInformationW

  DeviceIoControl

  GetSystemDirectoryW

  CreateFileA

  GetCurrentThread

  GetComputerNameW

  FindFirstFileW

  GetFileAttributesW

  WriteConsoleW

  RtlUnwind

  GetDriveTypeW

  GetFullPathNameW

  SetEnvironmentVariableA

  GetCurrentDirectoryW

  RemoveDirectoryW

  ExitThread

  FreeLibraryAndExitThread

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetACP

  GetConsoleMode

  ReadConsoleW

  GetConsoleCP

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetTimeZoneInformation

  SetConsoleCtrlHandler

  SetStdHandle

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WaitForSingleObjectEx

  DuplicateHandle

  user32

  DispatchMessageW

  PeekMessageW

  TranslateMessage

  PostQuitMessage

  GetClassNameW

  GetWindowTextW

  GetWindowPlacement

  SetWindowPlacement

  EnumWindows

  SetWinEventHook

  SetLayeredWindowAttributes

  SendMessageW

  SetWindowTextW

  FlashWindowEx

  LoadImageW

  GetMessageW

  TrackMouseEvent

  SetForegroundWindow

  LoadMenuW

  GetSubMenu

  SetMenuDefaultItem

  TrackPopupMenu

  DestroyMenu

  CreateWindowExW

  PtInRect

  MessageBoxW

  SetCursor

  GetSystemMetrics

  IsWindow

  IsIconic

  IsZoomed

  FindWindowExW

  GetMonitorInfoW

  MonitorFromWindow

  SetWindowPos

  PostMessageW

  GetWindowThreadProcessId

  ClientToScreen

  wsprintfW

  RegisterClassExW

  LoadCursorW

  DefWindowProcW

  GetLastInputInfo

  MoveWindow

  EnableWindow

  GetCursorPos

  DestroyWindow

  KillTimer

  WindowFromPoint

  GetWindowRect

  CallWindowProcW

  ShowWindow

  IsWindowVisible

  SetWindowLongW

  GetWindowLongW

  GetParent

  GetShellWindow

  GetDesktopWindow

  GetForegroundWindow

  UpdateWindow

  SetTimer

  RegisterWindowMessageW

  SetWindowRgn

  MapVirtualKeyExW

  GetKeyNameTextW

  GetKeyboardLayout

  IsWindowEnabled

  GetWindowTextLengthW

  GetGUIThreadInfo

  InvalidateRgn

  CreateAcceleratorTableW

  GetCaretPos

  GetWindow

  ShowCaret

  HideCaret

  SetRect

  FillRect

  DrawTextW

  CharPrevW

  InflateRect

  UnionRect

  OffsetRect

  RegisterClassW

  GetClassInfoExW

  SetFocus

  GetMenu

  SetPropW

  GetPropW

  GetClientRect

  AdjustWindowRectEx

  GetWindowRgn

  CharNextW

  GetActiveWindow

  GetFocus

  GetKeyState

  SetCapture

  ReleaseCapture

  GetDC

  ReleaseDC

  BeginPaint

  EndPaint

  GetUpdateRect

  InvalidateRect

  CreateCaret

  GetCaretBlinkTime

  SetCaretPos

  ScreenToClient

  MapWindowPoints

  GetSysColor

  IntersectRect

  IsRectEmpty

  UpdateLayeredWindow

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptAcquireContextA

  CryptReleaseContext

  CryptGenRandom

  CryptDestroyHash

  CryptDestroyKey

  CryptImportKey

  CryptEncrypt

  LookupAccountNameW

  ConvertSidToStringSidA

  EnumServicesStatusW

  OpenSCManagerW

  RegQueryInfoKeyW

  RegOpenCurrentUser

  FreeSid

  CheckTokenMembership

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  AllocateAndInitializeSid

  ole32

  CreateStreamOnHGlobal

  OleLockRunning

  CLSIDFromProgID

  CLSIDFromString

  ReleaseStgMedium

  OleDuplicateData

  DoDragDrop

  CoSetProxyBlanket

  CoInitializeEx

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  StringFromCLSID

  CoCreateGuid

  CoUninitialize

  CoInitializeSecurity

  RegisterDragDrop

  oleaut32

  SysStringByteLen

  SysAllocStringByteLen

  VariantInit

  VariantClear

  SysAllocString

  SysFreeString

  shlwapi

  StrStrW

  StrCpyW

  PathFindFileNameW

  StrStrIA

  PathAppendA

  PathFindFileNameA

  PathFileExistsA

  PathRemoveFileSpecW

  StrIsIntlEqualW

  StrStrIW

  imagehlp

  MakeSureDirectoryPathExists

  setupapi

  SetupDiGetClassDevsW

  SetupDiEnumDeviceInterfaces

  SetupDiGetDeviceInterfaceDetailW

  SetupDiDestroyDeviceInfoList

  ws2_32

  getpeername

  getsockopt

  htons

  ntohs

  setsockopt

  socket

  connect

  closesocket

  bind

  ntohl

  WSACleanup

  htonl

  WSAStartup

  send

  WSAIoctl

  getaddrinfo

  freeaddrinfo

  recvfrom

  sendto

  accept

  listen

  ioctlsocket

  gethostname

  recv

  gethostbyname

  WSASetLastError

  select

  __WSAFDIsSet

  WSAGetLastError

  getsockname

  wldap32

  ord26

  ord143

  ord27

  ord32

  ord33

  ord46

  ord211

  ord60

  ord50

  ord41

  ord301

  ord200

  ord35

  ord79

  ord30

  ord22

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  wininet

  InternetReadFile

  HttpOpenRequestA

  InternetOpenA

  InternetCloseHandle

  HttpSendRequestA

  InternetConnectA

  InternetSetOptionW

  HttpQueryInfoA

  iphlpapi

  GetAdaptersInfo

  msimg32

  AlphaBlend

  gdi32

  SelectObject

  CloseEnhMetaFile

  CreateEnhMetaFileW

  SaveDC

  PlayEnhMetaFile

  GetTextMetricsW

  GetObjectW

  SetWindowOrgEx

  CreateRectRgn

  PtInRegion

  CreateDIBSection

  CreateRoundRectRgn

  CombineRgn

  CreatePenIndirect

  CreateRectRgnIndirect

  CreateSolidBrush

  GetCharABCWidthsW

  RestoreDC

  GetStockObject

  GetDeviceCaps

  DeleteObject

  DeleteDC

  CreatePen

  CreateFontIndirectW

  CreateDIBitmap

  GetClipBox

  GetTextExtentPoint32W

  LineTo

  RoundRect

  SelectClipRgn

  ExtSelectClipRgn

  SetBkColor

  SetBkMode

  StretchBlt

  SetStretchBltMode

  SetTextColor

  CreateCompatibleDC

  CreateCompatibleBitmap

  BitBlt

  GetEnhMetaFileHeader

  GetObjectA

  MoveToEx

  TextOutW

  GdiFlush

  SetBitmapBits

  GetBitmapBits

  imm32

  ImmReleaseContext

  ImmSetCompositionWindow

  ImmGetContext

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  ord17

  gdiplus

  GdipDisposeImage

  GdipCloneImage

  GdipLoadImageFromStreamICM

  GdipLoadImageFromStream

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipCloneStringFormat

  GdipDeleteStringFormat

  GdipGetImageWidth

  GdipGetImageHeight

  GdipImageGetFrameDimensionsList

  GdipImageGetFrameCount

  GdipImageSelectActiveFrame

  GdipGetPropertyItemSize

  GdipGetPropertyItem

  GdipDrawImageRectI

  GdipImageGetFrameDimensionsCount

  GdiplusStartup

  GdiplusShutdown

  GdipAlloc

  GdipFree

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreatePen1

  GdipDeletePen

  GdipSetPenMode

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipSetSmoothingMode

  GdipSetTextRenderingHint

  GdipSetInterpolationMode

  GdipDrawRectangleI

  GdipFillRectangleI

  GdipCreateFontFromDC

  GdipCreateFontFromLogfontA

  GdipDeleteFont

  GdipDrawString

  GdipMeasureString

  GdipStringFormatGetGenericTypographic

  Exports

  Exports

  GetHandleVerifier

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 332KB - Virtual size: 332KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 172KB - Virtual size: 277KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 97KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 89KB - Virtual size: 88KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ