374789ac8d04a93fdfbd412ed3d353c6cd756639ae080016e4cb6176c2bc9c02

Sharing

Copy URL Twitter E-mail

General

Target

374789ac8d04a93fdfbd412ed3d353c6cd756639ae080016e4cb6176c2bc9c02
Size

375KB
MD5

daf3da88b2a60f7584d4cbb8945c58a2
SHA1

4c2e3dc58933548a57ea199835e65e48d9ada9d1
SHA256

374789ac8d04a93fdfbd412ed3d353c6cd756639ae080016e4cb6176c2bc9c02
SHA512

0fd2ed9f4fbe86fe162b155000b4c92aaa272cbf2b05f1d2f190db60eb80dee8201b781f466e5ee23754d42527a2f11a264822deed52688597654a7ed9997f5e
SSDEEP

6144:8v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:84VOiF1WD7kE1dTYOi8V5u23zmWFy4

Score

N/A

Malware Config

Signatures

Files

374789ac8d04a93fdfbd412ed3d353c6cd756639ae080016e4cb6176c2bc9c02
.exe windows x86

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/12/2014, 00:00

Not After

28/01/2016, 23:59

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:72:30:7b:54:2a:74:d8:72:40:0e:45:41:af:e6:70:2e:b3:4c:bc
Signer

Actual PE Digest

8c:72:30:7b:54:2a:74:d8:72:40:0e:45:41:af:e6:70:2e:b3:4c:bc

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN

06/08/2015, 07:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc42

ord5261

msvcrt

free

user32

IsIconic

gdi32

BitBlt

shell32

SHGetMalloc

comctl32

ImageList_Draw

Sections

.MPRESS1
Size: 352KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f197229d03f2fb47bd50b959b5bc269c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8c:72:30:7b:54:2a:74:d8:72:40:0e:45:41:af:e6:70:2e:b3:4c:bcSigner

Signature Validations

Verification

06/08/2015, 07:38 Valid: false

Headers

File Characteristics

Imports

kernel32

mfc42

msvcrt

user32

gdi32

shell32

comctl32

Sections

.MPRESS1 Size: 352KB - Virtual size: 396KB

.MPRESS2 Size: 1KB - Virtual size: 1KB

.rsrc Size: 15KB - Virtual size: 15KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

7a:1f:e7:67:6a:48:49:da:ee:2b:ff:c4:a4:ff:4b:d3
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8c:72:30:7b:54:2a:74:d8:72:40:0e:45:41:af:e6:70:2e:b3:4c:bc
Signer

06/08/2015, 07:38
Valid: false

.MPRESS1
Size: 352KB - Virtual size: 396KB

.MPRESS2
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 15KB - Virtual size: 15KB