General

Malware Config

Signatures

Files

• 0a1f04771223986d439d65efba254de290db0593bca3c3f45cc8e628e57c4b2c

  .exe windows x86

  2616e70af703ecf8cc6fed7bcadf4577

  
  

  Code Sign

  33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

  Certificate

  Issuer

  CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

  Not Before

  17-11-2006 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  59:f8:78:9c:c3:ef:1c:02:a2:37:a9:cf:17:cb:7b:e3

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  23-04-2018 00:00

  Not After

  23-05-2019 23:59

  Subject

  CN=重庆华博科技中心,OU=技术研发部,O=重庆华博科技中心,L=重庆,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

  Certificate

  Issuer

  CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

  Not Before

  17-11-2006 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  53:e9:93:a4:37:d9:45:73:71:32:91:58:d8:42:f1:b5

  Certificate

  Issuer

  CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

  Not Before

  08-05-2018 00:00

  Not After

  27-05-2019 23:59

  Subject

  CN=重庆华博科技中心,OU=技术研发部,O=重庆华博科技中心,L=重庆,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47

  Certificate

  Issuer

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Not Before

  15-08-2017 07:55

  Not After

  15-08-2028 07:55

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-04-2015 00:58

  Not After

  08-04-2025 00:58

  Subject

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2039 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  45:e9:06:c6:aa:f2:fa:f7:ec:3e:8c:ce:1e:ff:34:f7:ec:cf:d8:fe:c5:b6:b8:03:c0:66:fc:e5:a8:03:36:58

  Signer

  Actual PE Digest

  45:e9:06:c6:aa:f2:fa:f7:ec:3e:8c:ce:1e:ff:34:f7:ec:cf:d8:fe:c5:b6:b8:03:c0:66:fc:e5:a8:03:36:58

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=重庆华博科技中心,OU=技术研发部,O=重庆华博科技中心,L=重庆,C=CN

  09-08-2018 06:14

  Valid: false

  e3:79:66:45:9c:f7:a6:94:ca:e3:ab:36:dd:1a:b9:06:72:39:f5:8b

  Signer

  Actual PE Digest

  e3:79:66:45:9c:f7:a6:94:ca:e3:ab:36:dd:1a:b9:06:72:39:f5:8b

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=重庆华博科技中心,OU=技术研发部,O=重庆华博科技中心,L=重庆,C=CN

  09-08-2018 06:14

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  lstrcmpA

  MulDiv

  lstrlenA

  InterlockedIncrement

  InterlockedDecrement

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  lstrcmpiA

  IsDBCSLeadByte

  FreeLibrary

  SizeofResource

  LoadResource

  FindResourceA

  LoadLibraryExA

  WinExec

  lstrcmpW

  GetVersionExA

  OutputDebugStringW

  LocalFree

  LocalAlloc

  TerminateProcess

  WritePrivateProfileStringA

  GetPrivateProfileIntA

  GetPrivateProfileStringA

  WaitForSingleObject

  CreateProcessA

  InitializeCriticalSection

  DeleteFileA

  TerminateThread

  MoveFileA

  CreateThread

  CreateMutexA

  ExitProcess

  ReleaseMutex

  InterlockedPopEntrySList

  VirtualFree

  InterlockedPushEntrySList

  SetEnvironmentVariableA

  CompareStringW

  GetProcessHeap

  SetEndOfFile

  CreateFileW

  CreateFileA

  SetStdHandle

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetStringTypeW

  GetTickCount

  EnterCriticalSection

  InitializeCriticalSectionAndSpinCount

  FreeEnvironmentStringsW

  GetTimeZoneInformation

  GetLocaleInfoW

  IsValidCodePage

  GetOEMCP

  GetACP

  HeapReAlloc

  SetFilePointer

  ReadFile

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  WriteFile

  SetHandleCount

  HeapCreate

  IsProcessorFeaturePresent

  HeapSize

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetCPInfo

  LCMapStringW

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineA

  GetDateFormatA

  GetTimeFormatA

  VirtualQuery

  GetSystemInfo

  GetModuleHandleW

  VirtualAlloc

  VirtualProtect

  GetModuleFileNameW

  GetStdHandle

  GetFileType

  WriteConsoleW

  HeapAlloc

  GetSystemTimeAsFileTime

  HeapFree

  RtlUnwind

  InterlockedCompareExchange

  DecodePointer

  EncodePointer

  InterlockedExchange

  lstrlenW

  LoadLibraryW

  WideCharToMultiByte

  RaiseException

  Sleep

  GetCurrentProcessId

  GetModuleFileNameA

  CreateToolhelp32Snapshot

  Process32First

  CloseHandle

  Process32Next

  SetLastError

  GetCurrentThreadId

  GetCurrentProcess

  FlushInstructionCache

  GetEnvironmentStringsW

  LeaveCriticalSection

  GetLastError

  FindNextFileA

  MultiByteToWideChar

  GetModuleHandleA

  GetProcAddress

  OpenProcess

  FindClose

  GetTempPathA

  GetTempFileNameA

  FindFirstFileA

  QueryPerformanceCounter

  user32

  ReleaseDC

  CreateWindowExA

  DefWindowProcA

  GetDC

  SetWindowLongA

  GetCursorPos

  DestroyWindow

  ShowWindow

  IsWindowVisible

  SetTimer

  KillTimer

  GetClassInfoExA

  SetWindowPos

  GetWindowThreadProcessId

  RegisterClassExA

  PostQuitMessage

  GetWindowLongA

  CallWindowProcA

  MoveWindow

  IsWindow

  LoadImageA

  GetSysColor

  CharNextA

  GetClientRect

  ClientToScreen

  ScreenToClient

  InvalidateRect

  InvalidateRgn

  RedrawWindow

  SetCapture

  IsChild

  GetParent

  GetDlgItem

  GetClassNameA

  ReleaseCapture

  FillRect

  EndPaint

  BeginPaint

  DestroyAcceleratorTable

  SendMessageA

  GetShellWindow

  SystemParametersInfoA

  GetForegroundWindow

  GetWindowRect

  LoadCursorA

  GetWindow

  GetFocus

  SetFocus

  GetDesktopWindow

  CreateAcceleratorTableA

  SetWindowTextA

  AttachThreadInput

  SetForegroundWindow

  wsprintfW

  GetMessageA

  DispatchMessageA

  TranslateMessage

  SetActiveWindow

  PostMessageA

  RegisterWindowMessageA

  GetWindowTextLengthA

  GetWindowTextA

  UnregisterClassA

  gdi32

  GetDeviceCaps

  BitBlt

  CreateCompatibleBitmap

  CreateSolidBrush

  DeleteObject

  SelectObject

  CreateCompatibleDC

  GetObjectA

  DeleteDC

  GetStockObject

  advapi32

  LookupPrivilegeValueA

  OpenProcessToken

  AdjustTokenPrivileges

  RegEnumKeyExA

  RegSetValueExA

  RegDeleteValueA

  RegCreateKeyExA

  RegOpenKeyA

  RegOpenKeyExA

  RegQueryValueExA

  RegCloseKey

  RegQueryInfoKeyW

  RegDeleteKeyA

  shell32

  SHGetPathFromIDListA

  ShellExecuteA

  SHGetSpecialFolderPathA

  SHGetSpecialFolderLocation

  ole32

  StgCreateDocfile

  OleCreate

  CoTaskMemRealloc

  OleUninitialize

  OleInitialize

  CreateStreamOnHGlobal

  CLSIDFromString

  CoGetClassObject

  CoTaskMemAlloc

  OleLockRunning

  StringFromGUID2

  CoCreateInstance

  CoInitialize

  CoTaskMemFree

  CoUninitialize

  CLSIDFromProgID

  oleaut32

  SysStringLen

  VariantInit

  VarUI4FromStr

  LoadTypeLi

  LoadRegTypeLi

  OleCreateFontIndirect

  SysAllocString

  SysAllocStringLen

  VariantClear

  SysFreeString

  wininet

  InternetCrackUrlA

  InternetOpenA

  HttpOpenRequestA

  InternetConnectA

  HttpSendRequestA

  HttpQueryInfoA

  InternetReadFileExA

  InternetCloseHandle

  shlwapi

  PathFileExistsA

  StrStrIA

  netapi32

  Netbios

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  imagehlp

  MakeSureDirectoryPathExists

  Sections

  .text

  Size: 336KB - Virtual size: 335KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 63KB - Virtual size: 63KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 17KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ