af01f53675ec81de06a7d0801c4c83d9a379247dce418c204091f5d81b41fb83

Sharing

Copy URL Twitter E-mail

General

Target

af01f53675ec81de06a7d0801c4c83d9a379247dce418c204091f5d81b41fb83
Size

375KB
MD5

fa8a9829b121e0726649a0b498f1e833
SHA1

c80f13337008fd1cd9bd913532a3b0a3467ae897
SHA256

af01f53675ec81de06a7d0801c4c83d9a379247dce418c204091f5d81b41fb83
SHA512

2df9a93a2210fed35d9f1b4c998f8181be84f5d8c3f53ec11688df658d9f99ee85736a3f209a2ed50cca17e26cf9f8d01905a3d996236609e3b591a95366d306
SSDEEP

6144:zv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:z4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score

N/A

Malware Config

Signatures

Files

af01f53675ec81de06a7d0801c4c83d9a379247dce418c204091f5d81b41fb83
.exe windows x86

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/12/2014, 00:00

Not After

28/01/2016, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:b1:2d:0b:6e:1f:ff:02:03:15:9c:55:67:fb:10:c8:1e:78:6b:d6
Signer

Actual PE Digest

2d:b1:2d:0b:6e:1f:ff:02:03:15:9c:55:67:fb:10:c8:1e:78:6b:d6

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

06/08/2015, 07:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc42

ord5261

msvcrt

free

user32

IsIconic

gdi32

BitBlt

shell32

SHGetMalloc

comctl32

ImageList_Draw

Sections

.MPRESS1
Size: 352KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2d:b1:2d:0b:6e:1f:ff:02:03:15:9c:55:67:fb:10:c8:1e:78:6b:d6Signer

Signature Validations

Verification

06/08/2015, 07:38 Valid: false

Headers

File Characteristics

Imports

kernel32

mfc42

msvcrt

user32

gdi32

shell32

comctl32

Sections

.MPRESS1 Size: 352KB - Virtual size: 396KB

.MPRESS2 Size: 1KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2d:b1:2d:0b:6e:1f:ff:02:03:15:9c:55:67:fb:10:c8:1e:78:6b:d6
Signer

06/08/2015, 07:38
Valid: false

.MPRESS1
Size: 352KB - Virtual size: 396KB

.MPRESS2
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB