e31205a17d02b013e1443ef055c5b3d09f4017600b71128a1406c87135ddfb40

Sharing

Copy URL Twitter E-mail

General

Target

e31205a17d02b013e1443ef055c5b3d09f4017600b71128a1406c87135ddfb40
Size

375KB
MD5

a374a1983ee738e8b655a39f786a000d
SHA1

04ead2fcf08b81fdedd2e00ea6a11d39a271889f
SHA256

e31205a17d02b013e1443ef055c5b3d09f4017600b71128a1406c87135ddfb40
SHA512

f688f98261d3b23c80cea4c0443579c1c9566b37c03fc53c52ace2d9df78849429ee920bb873d51f00037c4c14ddbe20a3fec473fa955cf785ad823729f3bbc9
SSDEEP

6144:Sv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:S4VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score

N/A

Malware Config

Signatures

Files

e31205a17d02b013e1443ef055c5b3d09f4017600b71128a1406c87135ddfb40
.exe windows x86

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/12/2014, 00:00

Not After

28/01/2016, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

81:5b:82:f3:66:a4:07:5d:9d:c2:8b:6a:0e:7c:e1:84:75:c7:bb:37
Signer

Actual PE Digest

81:5b:82:f3:66:a4:07:5d:9d:c2:8b:6a:0e:7c:e1:84:75:c7:bb:37

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

06/08/2015, 07:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc42

ord5261

msvcrt

free

user32

IsIconic

gdi32

BitBlt

shell32

SHGetMalloc

comctl32

ImageList_Draw

Sections

.MPRESS1
Size: 352KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

81:5b:82:f3:66:a4:07:5d:9d:c2:8b:6a:0e:7c:e1:84:75:c7:bb:37Signer

Signature Validations

Verification

06/08/2015, 07:38 Valid: false

Headers

File Characteristics

Imports

kernel32

mfc42

msvcrt

user32

gdi32

shell32

comctl32

Sections

.MPRESS1 Size: 352KB - Virtual size: 396KB

.MPRESS2 Size: 1KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

81:5b:82:f3:66:a4:07:5d:9d:c2:8b:6a:0e:7c:e1:84:75:c7:bb:37
Signer

06/08/2015, 07:38
Valid: false

.MPRESS1
Size: 352KB - Virtual size: 396KB

.MPRESS2
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB