ea79518734dad57e975f640246dc8a5a28fe96890e6443c7382299062290d198

Sharing

Copy URL Twitter E-mail

General

Target

ea79518734dad57e975f640246dc8a5a28fe96890e6443c7382299062290d198
Size

318KB
MD5

9b781da63ca281a3c9d6727d5efc3d7f
SHA1

f7700eda290879560218f147b38b0797110f7a0c
SHA256

ea79518734dad57e975f640246dc8a5a28fe96890e6443c7382299062290d198
SHA512

6abf00f2af891dea730b0ed9fb056be73dc6407f6383c5db5952da3a49b7839bce8c22249a133ae157fcc25de7f3d878a2b1531a91450efcf2aa824501e334a5
SSDEEP

6144:PM6EUshWCUR+LPh87FLximVEUBrJVu1br7kTL7tCgRzKKV+wki5rv:PM69shWR+LPSB9Sp7ufTl+wki5D

Score

N/A

Malware Config

Signatures

Files

ea79518734dad57e975f640246dc8a5a28fe96890e6443c7382299062290d198
.zip
模擬器-免安裝.zip
.zip
模擬器-免安裝.exe
.exe windows x86

d01827212726e3502549e8968b7084a8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7b:48:44:8f:76:33:1b:9d:5b:ca:10:77:f5:5f:d7:10
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

11/11/2019, 00:00

Not After

09/02/2022, 23:59

Subject

CN=Ventis Media\, Inc.,OU=Application Development,O=Ventis Media\, Inc.,L=Cote Saint-Luc,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

66:4a:d8:a0:41:a5:17:35:d4:e6:8f:d5:ee:6f:38:e3:48:33:5d:52
Signer

Actual PE Digest

66:4a:d8:a0:41:a5:17:35:d4:e6:8f:d5:ee:6f:38:e3:48:33:5d:52

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ventis Media\, Inc.,OU=Application Development,O=Ventis Media\, Inc.,L=Cote Saint-Luc,ST=Quebec,C=CA

25/06/2020, 10:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleHandleA
FoldStringA
InterlockedCompareExchange
OpenWaitableTimerA
CreateEventA
ReadConsoleInputW
WaitNamedPipeA
SetVolumeMountPointA
SetSystemTimeAdjustment
FindNextFileW
EnumResourceTypesA
GetModuleFileNameA
IsBadHugeWritePtr
LoadLibraryW
DeleteFileW
SearchPathA
VirtualAlloc
WriteConsoleOutputCharacterW
GetConsoleAliasW
GetShortPathNameW
GetPrivateProfileStringW
PeekConsoleInputW
GlobalGetAtomNameA
GetProcAddress
GetUserDefaultLangID
FindFirstChangeNotificationW
GetFileType
SetFileShortNameA
AddAtomW
SetConsoleCtrlHandler
CreateMutexA
GetLongPathNameW
ResetEvent
GlobalWire
GetComputerNameA
GetVersionExW
GetSystemDefaultLCID
GetProcessHandleCount
GetLastError
VirtualProtect
GlobalAlloc
SetFileShortNameW
SetCalendarInfoW
SetComputerNameW
GetFileAttributesA
GetVolumePathNameA
CloseHandle
CreateFileA
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
DeleteCriticalSection
Sleep
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
ReadFile
InitializeCriticalSectionAndSpinCount
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers

ole32

OleQueryCreateFromData

winhttp

WinHttpCloseHandle

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d01827212726e3502549e8968b7084a8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7b:48:44:8f:76:33:1b:9d:5b:ca:10:77:f5:5f:d7:10Certificate

Extended Key Usages

Key Usages

66:4a:d8:a0:41:a5:17:35:d4:e6:8f:d5:ee:6f:38:e3:48:33:5d:52Signer

Signature Validations

Verification

25/06/2020, 10:16 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

winhttp

Sections

.text Size: 88KB - Virtual size: 87KB

.data Size: 212KB - Virtual size: 222KB

.rsrc Size: 105KB - Virtual size: 104KB

.reloc Size: 8KB - Virtual size: 7KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7b:48:44:8f:76:33:1b:9d:5b:ca:10:77:f5:5f:d7:10
Certificate

66:4a:d8:a0:41:a5:17:35:d4:e6:8f:d5:ee:6f:38:e3:48:33:5d:52
Signer

25/06/2020, 10:16
Valid: false

.text
Size: 88KB - Virtual size: 87KB

.data
Size: 212KB - Virtual size: 222KB

.rsrc
Size: 105KB - Virtual size: 104KB

.reloc
Size: 8KB - Virtual size: 7KB