a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49

Sharing

Copy URL

Twitter E-mail

General

Target

a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49
Size

1.6MB
MD5

5b305ebf70fa30b9fa99dfb27ff07f60
SHA1

54711aca678363e5af1674a158edb7fffc26a985
SHA256

a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49
SHA512

643ccb1d5ef37c4acb0cf658a457a0c2b9a0697dd744c1c94ece6ba6008c5487b831d55ad6f50c6801f42d8c358b7ef39ef51e0e32472e1144c92fedff5ffcce
SSDEEP

49152:1pjR8r8r8GJUakG2QPUD2LbXEy6khz9yiUMBjL:3F8r8rrJUakG/PUSnEOhz9yiUMBjL

Score

N/A

Malware Config

Signatures

Files

a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49
.exe windows x86

83cfcd8439a1cb185c23ac380f5bba41

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-02-2020 00:00

Not After

20-03-2023 12:00

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-02-2020 00:00

Not After

20-03-2023 12:00

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

da:7b:51:d9:c2:aa:b1:d7:54:ad:7d:2f:45:d3:50:e7:89:eb:7c:19:37:bc:18:e5:c7:72:59:f8:3d:81:a9:e8
Signer

Actual PE Digest

da:7b:51:d9:c2:aa:b1:d7:54:ad:7d:2f:45:d3:50:e7:89:eb:7c:19:37:bc:18:e5:c7:72:59:f8:3d:81:a9:e8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

07-07-2020 11:00
Valid: true

Chain 1

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

ab:b4:dd:e8:95:6d:ba:ff:7b:64:cc:0e:f0:71:28:8c:1d:c9:46:fb
Signer

Actual PE Digest

ab:b4:dd:e8:95:6d:ba:ff:7b:64:cc:0e:f0:71:28:8c:1d:c9:46:fb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

07-07-2020 10:59
Valid: true

Chain 1

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ProcessIdToSessionId
GetSystemInfo
InterlockedCompareExchange
MoveFileW
GetLogicalDriveStringsW
QueryDosDeviceW
GetTempPathW
CopyFileW
GetTempFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
FlushFileBuffers
FileTimeToSystemTime
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetUserDefaultLangID
GetComputerNameA
GetStdHandle
WaitForMultipleObjects
VirtualFree
VirtualAlloc
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
SetEvent
lstrcpyW
lstrcatW
SetFileAttributesW
DeviceIoControl
CreateFileA
LoadLibraryA
OpenMutexW
OpenEventW
OpenSemaphoreW
GetCurrentProcessId
ExpandEnvironmentStringsW
CreateProcessW
GetSystemTime
SetUnhandledExceptionFilter
FormatMessageA
ExpandEnvironmentStringsA
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetFullPathNameA
GetDriveTypeA
GetCurrentDirectoryA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
VirtualQuery
GetModuleHandleA
VirtualProtect
GetFileType
SetStdHandle
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
LocalAlloc
OpenProcess
GetSystemDirectoryW
RemoveDirectoryW
FindClose
GetTickCount
SetEndOfFile
WriteFile
CreateDirectoryW
GetFileAttributesW
SetFilePointer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
MapViewOfFileEx
lstrcmpiW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryExW
DeleteCriticalSection
MapViewOfFile
CreateFileMappingW
CreateThread
UnmapViewOfFile
WaitForSingleObject
Sleep
TerminateThread
GetDiskFreeSpaceExW
GetDriveTypeW
MoveFileExW
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindResourceW
FlushInstructionCache
CreateFileW
FreeLibrary
GetFileSize
LoadLibraryW
WideCharToMultiByte
ReadFile
lstrlenW
GetModuleFileNameW
GetLastError
InterlockedExchange
OutputDebugStringW
GetLocalTime
RaiseException
GetPrivateProfileStringW
CloseHandle
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
SetLastError
FreeResource
InitializeCriticalSection
lstrlenA
GetModuleHandleW
FindResourceExW
MultiByteToWideChar
GetProcAddress
LoadResource
GetVersionExW
GetPrivateProfileIntW
LockResource
GetWindowsDirectoryW
GetCurrentThreadId
SizeofResource
SleepEx
FindFirstFileA

user32

LoadBitmapW
CharNextW
FindWindowExW
UpdateWindow
AttachThreadInput
CharUpperW
CharLowerW
EndPaint
GetDlgItem
SetActiveWindow
IsRectEmpty
EqualRect
CallWindowProcW
SetWindowTextW
UnregisterClassA
BringWindowToTop
DestroyWindow
SetCursor
GetParent
GetForegroundWindow
PostThreadMessageW
GetWindowTextW
GetNextDlgTabItem
RegisterClassExW
ClientToScreen
GetWindow
DrawIconEx
PeekMessageW
GetWindowRect
SystemParametersInfoW
SetWindowPos
MonitorFromWindow
OffsetRect
GetWindowLongW
TranslateMessage
GetMonitorInfoW
IntersectRect
GetClientRect
UpdateLayeredWindow
SetWindowLongW
DispatchMessageW
MapWindowPoints
FindWindowW
DrawFrameControl
RegisterWindowMessageW
GetKeyState
WindowFromPoint
GetClassInfoExW
GetScrollPos
CopyRect
SetCapture
DestroyIcon
ReleaseCapture
SetRect
GetCursorPos
ScreenToClient
IsWindow
DefWindowProcW
IsWindowVisible
LoadImageW
PtInRect
SetForegroundWindow
LoadIconW
InvalidateRect
MoveWindow
InflateRect
CreateWindowExW
GetActiveWindow
GetDC
DrawTextW
GetDesktopWindow
ReleaseDC
GetDlgCtrlID
IsWindowEnabled
EnableWindow
GetFocus
SetRectEmpty
PostMessageW
IsChild
SendMessageW
GetWindowThreadProcessId
SetFocus
BeginPaint
LoadCursorW
GetMessageW
ShowWindow
IsDialogMessageW
SetTimer
GetWindowTextLengthW
SetWindowRgn
KillTimer

gdi32

LineTo
CombineRgn
DeleteDC
BitBlt
Rectangle
RectInRegion
CreateCompatibleBitmap
GetViewportOrgEx
DeleteObject
CreateBitmap
SetViewportOrgEx
StretchBlt
SelectObject
SetTextColor
SaveDC
CreateCompatibleDC
MoveToEx
ExtSelectClipRgn
CreateDIBSection
GetStockObject
OffsetRgn
CreatePen
GetObjectW
SetBkColor
RestoreDC
SetBkMode
ExtTextOutW
GetTextColor
SelectClipRgn
TextOutW
CreateRoundRectRgn
CreateRectRgnIndirect
GetDeviceCaps
GetClipRgn
CreateFontIndirectW
RoundRect
GetCurrentObject
SetStretchBltMode
GetTextMetricsW
CreateFontW
CreateRectRgn
GetTextExtentPoint32W

advapi32

RegSetValueExW
RegOpenKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegDeleteValueW

shell32

SHGetFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW
ShellExecuteW

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
VarUI4FromStr
SysStringLen
VariantInit
VariantCopy
VariantClear
SysAllocString

shlwapi

PathAppendW
PathFindExtensionW
PathFindFileNameW
StrToIntW
StrToIntA
PathAddBackslashW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipLoadImageFromStream
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipImageRotateFlip
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipGetFontCollectionFamilyList
GdipCreateLineBrushI
GdipCloneFontFamily
GdipDrawImagePointsRectI
GdipCloneImage
GdiplusStartup
GdipCreateBitmapFromScan0
GdipTranslateWorldTransform
GdipDrawLine
GdiplusShutdown
GdipDeleteFontFamily
GdipFillRectangleI
GdipDrawRectangleI
GdipSetStringFormatTrimming
GdipFree
GdipLoadImageFromFile
GdipRotateWorldTransform
GdipGetImageGraphicsContext
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipDrawLinesI
GdipDisposeImage
GdipDeleteFont
GdipSetPenMode
GdipSetPixelOffsetMode
GdipGetImageHeight
GdipGetFamily
GdipSetPenStartCap
GdipGetImageWidth
GdipSetPenEndCap
GdipCreateSolidFill
GdipSetInterpolationMode
GdipDrawString
GdipDeletePen
GdipDeleteGraphics
GdipAddPathStringI
GdipDrawImageRectI
GdipCreatePen1
GdipCreateFromHDC
GdipGetFontSize
GdipFillPath
GdipAddPathPieI
GdipCloneBrush
GdipCreateStringFormat
GdipGraphicsClear
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipDrawImageI
GdipAddPathRectangleI
GdipDeleteBrush
GdipSetStringFormatAlign
GdipCreateImageAttributes
GdipCreateFont
GdipNewPrivateFontCollection
GdipDisposeImageAttributes
GdipDrawPath
GdipMeasureString
GdipDeletePrivateFontCollection
GdipSetCompositingQuality
GdipSetClipPath
GdipClosePathFigure
GdipCreateFontFromLogfontW
GdipDrawImageRectRectI
GdipAddPathArcI
GdipPrivateAddFontFile
GdipSetImageAttributesColorMatrix
GdipSetPenDashStyle
GdipSetStringFormatLineAlign
GdipDeletePath
GdipGetFontCollectionFamilyCount
GdipFillRectangle
GdipSetStringFormatFlags
GdipCreatePath
GdipAlloc
GdipResetWorldTransform

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

rasapi32

RasEnumConnectionsW

iphlpapi

IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
GetAdaptersInfo

Sections

.text
Size: 732KB - Virtual size: 728KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 548KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83cfcd8439a1cb185c23ac380f5bba41

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

da:7b:51:d9:c2:aa:b1:d7:54:ad:7d:2f:45:d3:50:e7:89:eb:7c:19:37:bc:18:e5:c7:72:59:f8:3d:81:a9:e8Signer

Signature Validations

Verification

07-07-2020 11:00 Valid: true

Chain 1

ab:b4:dd:e8:95:6d:ba:ff:7b:64:cc:0e:f0:71:28:8c:1d:c9:46:fbSigner

Signature Validations

Verification

07-07-2020 10:59 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wtsapi32

psapi

rasapi32

iphlpapi

Sections

.text Size: 732KB - Virtual size: 728KB

.rdata Size: 156KB - Virtual size: 152KB

.data Size: 28KB - Virtual size: 46KB

.rsrc Size: 548KB - Virtual size: 547KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

da:7b:51:d9:c2:aa:b1:d7:54:ad:7d:2f:45:d3:50:e7:89:eb:7c:19:37:bc:18:e5:c7:72:59:f8:3d:81:a9:e8
Signer

07-07-2020 11:00
Valid: true

ab:b4:dd:e8:95:6d:ba:ff:7b:64:cc:0e:f0:71:28:8c:1d:c9:46:fb
Signer

07-07-2020 10:59
Valid: true

.text
Size: 732KB - Virtual size: 728KB

.rdata
Size: 156KB - Virtual size: 152KB

.data
Size: 28KB - Virtual size: 46KB

.rsrc
Size: 548KB - Virtual size: 547KB