c6bf62d9c1e542f7a31ae5c166ea39b1a2683b026058581d336eedae2d3206af

Sharing

Copy URL Twitter E-mail

General

Target

c6bf62d9c1e542f7a31ae5c166ea39b1a2683b026058581d336eedae2d3206af
Size

681KB
MD5

c01e2475f87ce9e46ece945c6272c4df
SHA1

a35eb60e59ea924bc7431f593fa94d05cbc01f5a
SHA256

c6bf62d9c1e542f7a31ae5c166ea39b1a2683b026058581d336eedae2d3206af
SHA512

25cc93eb42150c552d777b0f93bd4fd2f079b733e37be32262f56801b2e34fbfa0d0fa36fa3e948a686c6bd2f2437682194babab82a22d4dce88f9ee9e41fb28
SSDEEP

12288:B7xnXHpK5soEC7IdG1TyVnu2lfzL79EKIoNDfVIl:RJXHpGs7CTCnu2hzL7OlCc

Score

N/A

Malware Config

Signatures

Files

c6bf62d9c1e542f7a31ae5c166ea39b1a2683b026058581d336eedae2d3206af
.exe windows x86

786e0801d83dd0bf6f4f8a807130ab2e

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:07:80:c3:8c:55:f2:1c:74:bf:b0:91:35:c1:3c:da
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

16/03/2016, 00:00

Not After

15/05/2019, 23:59

Subject

CN=Beijing Superred Technology CO.\,LTD.,O=Beijing Superred Technology CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

54:74:71:f0:33:8b:ef:eb:0c:1b:78:f5:6e:08:f4:25:0d:d9:82:8a
Signer

Actual PE Digest

54:74:71:f0:33:8b:ef:eb:0c:1b:78:f5:6e:08:f4:25:0d:d9:82:8a

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Superred Technology CO.\,LTD.,O=Beijing Superred Technology CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

21/09/2022, 12:15
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameA
GetVersionExA
GetLogicalDriveStringsA
GetCurrentProcess
GetModuleHandleA
GetLocalTime
GetFileSize
CreateFileW
InterlockedDecrement
CreateProcessA
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
GetVersion
GetExitCodeProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
CreateDirectoryW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
TerminateProcess
OpenProcess
GetDriveTypeA
GetTempPathA
SetFileAttributesA
CopyFileA
lstrlenW
HeapFree
GetProcessHeap
FindResourceA
SizeofResource
LockResource
LoadResource
FindResourceExA
lstrlenA
HeapReAlloc
HeapAlloc
SetConsoleMode
ReadConsoleInputA
CreateDirectoryA
GetModuleFileNameW
LoadLibraryW
DeviceIoControl
FreeLibrary
lstrcmpA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LoadLibraryA
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcAddress
MultiByteToWideChar
CreateMutexW
ReleaseMutex
Sleep
WideCharToMultiByte
FormatMessageA
GetLastError
SetFilePointer
ReadFile
CreateFileA
WriteFile
InitializeCriticalSectionAndSpinCount
VirtualQuery
SetStdHandle
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
VirtualAlloc
VirtualFree
HeapCreate
GetConsoleMode
GetConsoleCP
ExitProcess
IsValidCodePage
GetOEMCP
GetACP
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
SetConsoleCtrlHandler
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
UnhandledExceptionFilter
CreateThread
ExitThread
RtlUnwind
QueryPerformanceCounter
GlobalMemoryStatus
CloseHandle
DeleteFileA
GetStdHandle
FlushConsoleInputBuffer
GetTickCount
GetSystemTimeAsFileTime
GetLogicalDrives
OutputDebugStringA
RaiseException
HeapSize
HeapDestroy
InterlockedIncrement

user32

GetWindowRect
SystemParametersInfoA
GetParent
GetWindowLongA
GetDlgItemTextA
EndDialog
SendMessageA
SetFocus
GetDlgItem
SetForegroundWindow
KillTimer
SetTimer
LoadIconA
wsprintfW
BroadcastSystemMessageA
MessageBoxA
GetWindow
wsprintfA
SetWindowPos
GetClientRect
MapWindowPoints
DialogBoxParamA

advapi32

RegCreateKeyExA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegSetValueExA
RegQueryValueExA
RegCloseKey

shell32

SHFileOperationA
ShellExecuteExA

ole32

OleRun
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitialize

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString
VariantInit
VariantClear

ws2_32

WSACleanup
inet_ntoa
gethostbyname
gethostname
WSAStartup
closesocket
WSACloseEvent
WSAGetLastError
WSASend
WSAResetEvent
freeaddrinfo
WSASetLastError
getaddrinfo
WSASocketA
WSAEnumNetworkEvents
WSAConnect
WSAEventSelect
WSASetEvent
WSACreateEvent
WSARecv
inet_addr
WSAGetOverlappedResult

shlwapi

PathFileExistsA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
CM_Get_Child
CM_Get_Device_IDA
CM_Get_Sibling

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

dbghelp

MiniDumpWriteDump

psapi

GetModuleFileNameExW

wininet

DeleteUrlCacheEntry
InternetReadFile
HttpQueryInfoA
HttpSendRequestA

Sections

.text
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

786e0801d83dd0bf6f4f8a807130ab2e

Code Sign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

02:07:80:c3:8c:55:f2:1c:74:bf:b0:91:35:c1:3c:daCertificate

Extended Key Usages

Key Usages

54:74:71:f0:33:8b:ef:eb:0c:1b:78:f5:6e:08:f4:25:0d:d9:82:8aSigner

Signature Validations

Verification

21/09/2022, 12:15 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

setupapi

iphlpapi

version

dbghelp

psapi

wininet

Sections

.text Size: 530KB - Virtual size: 529KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 9KB - Virtual size: 9KB

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

02:07:80:c3:8c:55:f2:1c:74:bf:b0:91:35:c1:3c:da
Certificate

54:74:71:f0:33:8b:ef:eb:0c:1b:78:f5:6e:08:f4:25:0d:d9:82:8a
Signer

21/09/2022, 12:15
Valid: false

.text
Size: 530KB - Virtual size: 529KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 9KB - Virtual size: 9KB