527f1fa4cfec04ee31ec93960dc7ed50

Sharing

Copy URL

Twitter E-mail

General

Target

527f1fa4cfec04ee31ec93960dc7ed50
Size

7.5MB
MD5

527f1fa4cfec04ee31ec93960dc7ed50
SHA1

03dd789dda5b17469af784df146256552b7a0535
SHA256

1985acbf54aade2b89a64da25490a8ddaeb5db6af3d4f64034cdbd6193d6830b
SHA512

bf906b984c18cbd491f38d4e9a53be0299afa21b01d61ef99f15453f45a32bdf2d6413439e4beed2fd02e6f0be142c70fe218e58d8f2905163507c8d9dd1e4f9
SSDEEP

196608:LtbqGpfawaDA8j+Y5XdFvDy+DQ3Xdj/JCI4ipuFIT2ZajbqGpfawaDA83Q:LtbfI5XLvDtQXh/JP4mib0jbfT

Score

N/A

Malware Config

Signatures

Files

527f1fa4cfec04ee31ec93960dc7ed50
.exe windows x86

6bb7797dae9f1d55ae8c9d1629ca0df9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26-12-2016 00:00

Not After

26-12-2019 23:59

Subject

CN=盛趣信息技术（上海）有限公司,OU=安全实验室,O=盛趣信息技术（上海）有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

26-12-2016 00:00

Not After

26-12-2019 23:59

Subject

CN=盛趣信息技术（上海）有限公司,OU=安全实验室,O=盛趣信息技术（上海）有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

59:c5:10:59:5e:fb:84:b6:8e:65:3e:a0:ce:fe:44:58:94:7e:18:f0:fd:ca:55:f5:a9:b7:00:96:1d:d7:d9:bd
Signer

Actual PE Digest

59:c5:10:59:5e:fb:84:b6:8e:65:3e:a0:ce:fe:44:58:94:7e:18:f0:fd:ca:55:f5:a9:b7:00:96:1d:d7:d9:bd

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=盛趣信息技术（上海）有限公司,OU=安全实验室,O=盛趣信息技术（上海）有限公司,L=上海市,ST=上海市,C=CN

22-03-2019 08:52
Valid: false

82:73:19:19:3e:ca:fb:f2:f8:da:fe:0a:57:bf:27:b2:a3:d4:f1:30
Signer

Actual PE Digest

82:73:19:19:3e:ca:fb:f2:f8:da:fe:0a:57:bf:27:b2:a3:d4:f1:30

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=盛趣信息技术（上海）有限公司,OU=安全实验室,O=盛趣信息技术（上海）有限公司,L=上海市,ST=上海市,C=CN

22-03-2019 08:52
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
MethCallEngine
EVENT_SINK_Invoke
ord621
ord516
ord517
ord518
ord626
ord660
Zombie_GetTypeInfo
ord591
ord593
ord594
ord595
ord598
ord520
ord631
ord709
ord525
ord632
ord526
EVENT_SINK_AddRef
ord527
ord528
ord529
ord560
ord561
DllFunctionCall
Zombie_GetTypeInfoCount
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord606
ord607
ord530
ord608
ord531
ord716
ord717
ord319
ord533
ProcCallEngine
ord535
ord644
ord537
ord645
ord648
ord570
ord572
ord681
ord576
ord578
ord685
ord100
ord579
ord320
ord612
ord321
ord613
ord616
ord617
ord618
ord619
ord546
ord580
ord581

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

kernel32

GetModuleFileNameW

user32

GetWindow

advapi32

RegDeleteKeyA

shell32

SHGetFolderPathW

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp
Size: 760KB - Virtual size: 760KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bb7797dae9f1d55ae8c9d1629ca0df9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

59:c5:10:59:5e:fb:84:b6:8e:65:3e:a0:ce:fe:44:58:94:7e:18:f0:fd:ca:55:f5:a9:b7:00:96:1d:d7:d9:bdSigner

Signature Validations

Verification

22-03-2019 08:52 Valid: false

82:73:19:19:3e:ca:fb:f2:f8:da:fe:0a:57:bf:27:b2:a3:d4:f1:30Signer

Signature Validations

Verification

22-03-2019 08:52 Valid: false

Headers

File Characteristics

Imports

msvbvm60

msvcrt

iphlpapi

psapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.vmp Size: 760KB - Virtual size: 760KB

.idata Size: 4KB - Virtual size: 4KB

.vmp Size: 4KB - Virtual size: 4KB

.rsrc Size: 4.0MB - Virtual size: 4.0MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

37:1a:05:c3:5e:52:07:79:08:ed:09:20:fd:90:70:d3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

59:c5:10:59:5e:fb:84:b6:8e:65:3e:a0:ce:fe:44:58:94:7e:18:f0:fd:ca:55:f5:a9:b7:00:96:1d:d7:d9:bd
Signer

22-03-2019 08:52
Valid: false

82:73:19:19:3e:ca:fb:f2:f8:da:fe:0a:57:bf:27:b2:a3:d4:f1:30
Signer

22-03-2019 08:52
Valid: false

.text
Size: 2.8MB - Virtual size: 2.8MB

.vmp
Size: 760KB - Virtual size: 760KB

.idata
Size: 4KB - Virtual size: 4KB

.vmp
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4.0MB - Virtual size: 4.0MB