ce1ba2d5e02b8f2bc406e5932e1a714563608a20bd1c687c0cf3fa038106f765

Sharing

Copy URL Twitter E-mail

General

Target

ce1ba2d5e02b8f2bc406e5932e1a714563608a20bd1c687c0cf3fa038106f765
Size

400KB
MD5

69c5e97edc4a67a9145b5b4bdf2cd53b
SHA1

24a7525217f4b6d434a9033fb853c5fef1dbbe4d
SHA256

ce1ba2d5e02b8f2bc406e5932e1a714563608a20bd1c687c0cf3fa038106f765
SHA512

007e1e54a1ebe4c8ece9aa32d412fa8b224744f5765557fc1abbf6cb8f8b897cda604843d383e8c78655ddae5155b401a178c344fa427162204c4498804e844f
SSDEEP

6144:AwMP949nXr7YViWrizKsqWnUxsTsPFM69ioJV7BkWSTy:A7P9E769tin3T0L9vJV7Bd

Score

N/A

Malware Config

Signatures

Files

ce1ba2d5e02b8f2bc406e5932e1a714563608a20bd1c687c0cf3fa038106f765
.exe windows x86

fc2d096dd98b3884b09eacd96a596389

Code Sign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:6d:e0:36:50:01:4a:ba:8f:f5:6f:74:da:1c:4f:15:2e
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

01/03/2012, 14:48

Not After

02/03/2013, 14:48

Subject

CN=Shenzhen Sunlike Technology Co\,.LTD,O=Shenzhen Sunlike Technology Co\,.LTD,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c0f617070734073756e6c696b652e636e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d1:c2:e5:46:f3:27:08:30:2c:59:f8:71:58:a8:a7:ce:88:02:f3:85
Signer

Actual PE Digest

d1:c2:e5:46:f3:27:08:30:2c:59:f8:71:58:a8:a7:ce:88:02:f3:85

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shenzhen Sunlike Technology Co\,.LTD,O=Shenzhen Sunlike Technology Co\,.LTD,L=Shenzhen,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c0f617070734073756e6c696b652e636e

20/06/2012, 10:24
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
VirtualProtect
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetStartupInfoA
GetCommandLineA
HeapSize
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
IsBadWritePtr
GetStringTypeA
GetStringTypeW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetUnhandledExceptionFilter
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
InterlockedExchange
GetTickCount
GetOEMCP
GetCPInfo
GetFileTime
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
GlobalFlags
InterlockedIncrement
FreeResource
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
InterlockedDecrement
ResumeThread
GlobalAddAtomA
SetLastError
GlobalFree
MulDiv
FormatMessageA
lstrcpynA
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
GetModuleFileNameA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
TerminateThread
QueryDosDeviceA
VirtualAlloc
VirtualFree
GetCurrentProcessId
DuplicateHandle
CompareStringW
CompareStringA
lstrcmpiA
GetVersion
MultiByteToWideChar
LocalAlloc
LocalFree
GetModuleHandleA
GetProcessId
lstrcatA
TerminateProcess
GetExitCodeProcess
WritePrivateProfileStringA
CreateMutexA
CopyFileA
MoveFileA
GetFileAttributesA
WideCharToMultiByte
CreateFileA
DeviceIoControl
DeleteFileA
OpenProcess
LoadLibraryA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
FreeLibrary
GetCurrentProcess
GetLastError
CloseHandle
GlobalUnlock
lstrlenA
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
UnhandledExceptionFilter

user32

RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
SetRect
IsRectEmpty
CharNextA
DestroyMenu
GetSysColorBrush
ReleaseCapture
LoadCursorA
SetCapture
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
IsChild
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
UnregisterClassA
RegisterClassA
GetClassInfoA
DrawIcon
SendMessageA
IsIconic
GetClientRect
LoadIconA
EnableWindow
GetSystemMetrics
CharUpperA
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
PostThreadMessageA
GetDlgItem
wsprintfA
UnhookWindowsHookEx
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetWindowTextA
PostMessageA
PostQuitMessage
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
SetCursor
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
MessageBoxA
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CallNextHookEx
SetWindowsHookExA
MapDialogRect

gdi32

GetMapMode
GetRgnBox
CreateRectRgnIndirect
GetTextColor
GetBkColor
GetStockObject
DeleteDC
SetViewportExtEx
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
GetDeviceCaps
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
ScaleViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
QueryServiceStatus

shell32

SHGetSpecialFolderPathA

comctl32

ord17

shlwapi

PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgOpenStorageOnILockBytes
CoTaskMemFree
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayDestroy
SystemTimeToVariantTime
SysAllocString
OleCreateFontIndirect

psapi

EnumProcesses
GetModuleFileNameExA
EnumProcessModules

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc2d096dd98b3884b09eacd96a596389

Code Sign

04:7a:55Certificate

Extended Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:6d:e0:36:50:01:4a:ba:8f:f5:6f:74:da:1c:4f:15:2eCertificate

Extended Key Usages

Key Usages

d1:c2:e5:46:f3:27:08:30:2c:59:f8:71:58:a8:a7:ce:88:02:f3:85Signer

Signature Validations

Verification

20/06/2012, 10:24 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

psapi

Sections

.text Size: 164KB - Virtual size: 163KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 168KB - Virtual size: 164KB

04:7a:55
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:6d:e0:36:50:01:4a:ba:8f:f5:6f:74:da:1c:4f:15:2e
Certificate

d1:c2:e5:46:f3:27:08:30:2c:59:f8:71:58:a8:a7:ce:88:02:f3:85
Signer

20/06/2012, 10:24
Valid: false

.text
Size: 164KB - Virtual size: 163KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 168KB - Virtual size: 164KB