7029f8b3e43b1b00f711436c5875620283d0f08ea493105bd9b666d78fe6ada1

Sharing

Copy URL Twitter E-mail

General

Target

7029f8b3e43b1b00f711436c5875620283d0f08ea493105bd9b666d78fe6ada1
Size

375KB
MD5

98c4c70d03323830b3eb6b371e60bac7
SHA1

ebda387d6bda2c3d253b88904156aef468e6f2f0
SHA256

7029f8b3e43b1b00f711436c5875620283d0f08ea493105bd9b666d78fe6ada1
SHA512

df8f5aa06178ead36aa23b3d48a69dd9608bbe22a90c09502438c1e244161c1348b095469dddc254fee5c2544954d0d44eb350be1dad1719c109d90514b30b52
SSDEEP

6144:1v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:14VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score

N/A

Malware Config

Signatures

Files

7029f8b3e43b1b00f711436c5875620283d0f08ea493105bd9b666d78fe6ada1
.exe windows x86

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/12/2014, 00:00

Not After

28/01/2016, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

95:0e:78:24:85:96:f9:1c:d1:62:76:c9:4b:4d:db:c6:df:87:41:bd
Signer

Actual PE Digest

95:0e:78:24:85:96:f9:1c:d1:62:76:c9:4b:4d:db:c6:df:87:41:bd

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

06/08/2015, 07:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc42

ord5261

msvcrt

free

user32

IsIconic

gdi32

BitBlt

shell32

SHGetMalloc

comctl32

ImageList_Draw

Sections

.MPRESS1
Size: 352KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

95:0e:78:24:85:96:f9:1c:d1:62:76:c9:4b:4d:db:c6:df:87:41:bdSigner

Signature Validations

Verification

06/08/2015, 07:38 Valid: false

Headers

File Characteristics

Imports

kernel32

mfc42

msvcrt

user32

gdi32

shell32

comctl32

Sections

.MPRESS1 Size: 352KB - Virtual size: 396KB

.MPRESS2 Size: 1KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

95:0e:78:24:85:96:f9:1c:d1:62:76:c9:4b:4d:db:c6:df:87:41:bd
Signer

06/08/2015, 07:38
Valid: false

.MPRESS1
Size: 352KB - Virtual size: 396KB

.MPRESS2
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB