ea11b9f765c2b360ca63f03dc99dcf3754a141ae83fd62bec431531d7a87d5d7

Sharing

Copy URL Twitter E-mail

General

Target

ea11b9f765c2b360ca63f03dc99dcf3754a141ae83fd62bec431531d7a87d5d7
Size

384KB
MD5

6eebfdfc00d3f22f5d4e6e08595ace20
SHA1

f3fc24402e0b1d42da1aa398d537abc270e7e776
SHA256

ea11b9f765c2b360ca63f03dc99dcf3754a141ae83fd62bec431531d7a87d5d7
SHA512

5b6e9d4998d97a7496f9b6fa5ed2215f1a51c707643a4102d6a4bd9c04a5f9679e0c76a6e4396fb8eb7dfb17016f3f48b2b3f57439a0439cc13894dcf7705c85
SSDEEP

6144:pYohynMaRHjJDxigeRlnN78y3qnL8JOfNIerzBX55wqQHLsy:5yn/RHjlstnNNqnwJKVsHLs

Score

N/A

Malware Config

Signatures

Files

ea11b9f765c2b360ca63f03dc99dcf3754a141ae83fd62bec431531d7a87d5d7
.exe windows x86

d0d2579501c5cd4f227f93f5f07a2b8a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1c:1d:bd:42:0a:b2:8e:58:bc:b3:a8:b3:71:64:05
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

26/09/2011, 00:00

Not After

24/11/2013, 23:59

Subject

CN=指点通（北京）科技有限公司,O=指点通（北京）科技有限公司,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f1:fb:38:75:7d:28:cc:1e:68:d8:5b:34:7f:f6:18:79:36:5f:3e:02
Signer

Actual PE Digest

f1:fb:38:75:7d:28:cc:1e:68:d8:5b:34:7f:f6:18:79:36:5f:3e:02

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=指点通（北京）科技有限公司,O=指点通（北京）科技有限公司,L=Beijing,ST=Beijing,C=CN

02/05/2013, 07:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromFile
GdipBitmapUnlockBits
GdipImageRotateFlip
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipGetImagePixelFormat
GdipGetImageWidth

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

oleacc

AccessibleChildren
AccessibleObjectFromWindow

kernel32

DeleteFileW
CreateProcessW
WaitForSingleObject
GetModuleFileNameW
MoveFileExW
GetCurrentProcess
FlushInstructionCache
SetLastError
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
GetPrivateProfileIntW
GetPrivateProfileStringW
GlobalAlloc
GlobalFree
GetLastError
CreateThread
VirtualAlloc
LoadLibraryA
GetProcAddress
VirtualFree
VirtualProtect
GetCommandLineW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetTickCount
SetEvent
WriteFile
CreateEventW
GetLocalTime
CreateDirectoryW
CreateFileW
SetFilePointer
SetEndOfFile
GetProcessId
Module32FirstW
Module32NextW
GetModuleHandleW
LoadLibraryW
SearchPathW
GetTempPathW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
RtlUnwind
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapSize
HeapDestroy
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapReAlloc
CopyFileA
lstrcatA
GetSystemDirectoryA
lstrcpyA
DeviceIoControl
CreateFileA
LocalFree
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc
FreeLibrary
lstrlenA
UnmapViewOfFile
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
QueryPerformanceCounter
MapViewOfFile
InterlockedExchange
GetVersionExW
ReadFile
GetFileSize
RemoveDirectoryW
FindNextFileW
FindClose
FindFirstFileW
WideCharToMultiByte
MultiByteToWideChar
Sleep
Process32NextW
CloseHandle
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetTimeZoneInformation
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetModuleHandleA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers

user32

SendNotifyMessageW
GetDC
DrawTextW
IsCharAlphaNumericW
PostMessageW
GetActiveWindow
DialogBoxParamW
wsprintfA
FindWindowW
CreateWindowExW
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowTextW
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
SetTimer
DispatchMessageW
TranslateMessage
GetMessageW
DestroyMenu
AppendMenuW
CreatePopupMenu
DestroyWindow
GetClassNameW
SetForegroundWindow
BringWindowToTop
UpdateLayeredWindow
GetDesktopWindow
ReleaseDC
IsWindow
SetCursor
IsWindowVisible
SetActiveWindow
TrackMouseEvent
TrackPopupMenu
GetCursorPos
ShowWindow
KillTimer
EnumWindows
FindWindowExW
GetParent
CopyRect
SendMessageW
wsprintfW
PostThreadMessageW
GetWindowThreadProcessId
MessageBoxW
EndDialog
GetSysColorBrush
InvalidateRect
GetDlgItem
MoveWindow
GetClientRect
SetWindowPos
OffsetRect
SetRect
GetWindowRect
LoadIconW
GetIconInfo
DestroyIcon
PrivateExtractIconsW
EndPaint
BeginPaint
PeekMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
PostQuitMessage
UnregisterClassA

gdi32

SaveDC
CreatePen
Rectangle
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
DPtoLP
SetWindowOrgEx
GetBitmapBits
RestoreDC
GetClipBox
CreateFontW
SetBkMode
DeleteDC
SetBkColor
ExtTextOutW
SelectObject
DeleteObject
GetObjectW
SetTextColor
GetCurrentObject
CreateDIBSection
BitBlt

advapi32

SaferComputeTokenFromLevel
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
CheckTokenMembership
RegDeleteKeyW
RegCreateKeyW
RegSetValueExW
RegEnumKeyW
RegQueryInfoKeyW
SaferCloseLevel
FreeSid
SaferCreateLevel
CreateProcessAsUserW
SetTokenInformation
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
AllocateAndInitializeSid

shell32

CommandLineToArgvW
SHAppBarMessage
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFileInfoW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

SysFreeString
SysStringLen

ws2_32

WSAStartup

shlwapi

PathFileExistsW
PathFindExtensionW

comctl32

DrawShadowText

msimg32

AlphaBlend

Sections

.text
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d0d2579501c5cd4f227f93f5f07a2b8a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

53:1c:1d:bd:42:0a:b2:8e:58:bc:b3:a8:b3:71:64:05Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

f1:fb:38:75:7d:28:cc:1e:68:d8:5b:34:7f:f6:18:79:36:5f:3e:02Signer

Signature Validations

Verification

02/05/2013, 07:08 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

wininet

oleacc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

comctl32

msimg32

Sections

.text Size: 237KB - Virtual size: 236KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 9KB - Virtual size: 20KB

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 55KB - Virtual size: 55KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

53:1c:1d:bd:42:0a:b2:8e:58:bc:b3:a8:b3:71:64:05
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

f1:fb:38:75:7d:28:cc:1e:68:d8:5b:34:7f:f6:18:79:36:5f:3e:02
Signer

02/05/2013, 07:08
Valid: false

.text
Size: 237KB - Virtual size: 236KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 9KB - Virtual size: 20KB

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 55KB - Virtual size: 55KB