3ec4861c692ee17a638ce4d61325fdab9776bd0755ce9665c4896b7f668a77a5

Sharing

Copy URL Twitter E-mail

General

Target

3ec4861c692ee17a638ce4d61325fdab9776bd0755ce9665c4896b7f668a77a5
Size

152KB
MD5

12b7635cf1080d800218205e9bff4c53
SHA1

041a1d96344f7177e3c51233fe30626e4a0d8adf
SHA256

3ec4861c692ee17a638ce4d61325fdab9776bd0755ce9665c4896b7f668a77a5
SHA512

c5a3e20b770dd65371597d06fc744ef020ae339141924223f31fa9a6fcbc730aaac74c70e660e1678825dea4b316a5788c575356bd80e1522b7c9dc247f03297
SSDEEP

3072:mgAuVjm2Hs5+JdYhZfov6VAI6h8vkoDxezBT9tZzKCSjPyh+DvY6FLfkPb:HjZHs5+8hZa6iIfvkoUzRjN87ycDg6h8

Score

N/A

Malware Config

Signatures

Files

3ec4861c692ee17a638ce4d61325fdab9776bd0755ce9665c4896b7f668a77a5
.rar
!)安装.cmd
.cmd .vbs
-)卸载.cmd
MSAEXP30.DLL
.dll windows x86

7fe6f713afe7ad088dc2ea80c3f65f55

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:ce:53:0b:49:53:ae:99:3a:3f:6d:f1:27:24:e8:2a:91:5d:f1:2e
Signer

Actual PE Digest

c6:ce:53:0b:49:53:ae:99:3a:3f:6d:f1:27:24:e8:2a:91:5d:f1:2e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

26/02/2009, 13:05
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetActiveWindow
GetActiveWindow
IsWindowEnabled
GetKeyState
SetCursor
LoadCursorA
IsCharAlphaA
DefWindowProcA
CallWindowProcW
CallWindowProcA
GetWindowLongW
BeginDeferWindowPos
SetWindowLongA
IsWindow
IsWindowUnicode
GetWindowLongA
SetWindowLongW
SendMessageW
GetSystemMetrics
EnableWindow
GetCaretPos
SendMessageA
DrawFocusRect
SetRect
DeferWindowPos
EndDeferWindowPos
EnableScrollBar
KillTimer
SetTimer
RedrawWindow
UpdateWindow
ReleaseDC
GetDC
PostMessageA
OffsetRect
GetParent
GetSysColor
InvalidateRect
GetWindowRect
DefWindowProcW

gdi32

ExtTextOutW
DeleteObject
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
GetDeviceCaps
SetDIBitsToDevice

msaccess.exe

ord86
ord4
ord51
ord39
ord93
ord3
ord38
ord15
ord45
ord14
ord7
ord5
ord13
ord2
ord1
ord9
ord6
ord17
ord12
ord8
ord11

kernel32

GetVersionExA
lstrlenA
lstrcmpiW
lstrcmpiA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
LockResource
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LocalAlloc
LocalFree
InterlockedExchange
WideCharToMultiByte
MultiByteToWideChar
LoadResource
FindResourceA
GetProcAddress
LoadLibraryA
MulDiv
GetSystemDefaultLangID
GetCurrentProcessId

mfc80

ord5185
ord1063
ord4735
ord2372
ord1631
ord5142
ord3401
ord1074
ord6090
ord1091
ord1153
ord444
ord1001
ord5434
ord677
ord4692
ord2657
ord2164
ord2168
ord4118
ord5613
ord6065
ord4580
ord356
ord5182
ord3641
ord3255
ord3256
ord5677
ord1186
ord266
ord581
ord1209
ord1177
ord1175
ord1201
ord1120
ord1167
ord1917
ord371
ord1098
ord1208
ord1206
ord1092
ord1037
ord315
ord4888
ord764
ord1187
ord1185
ord1191
ord1198
ord1903
ord572
ord3195
ord4261
ord4486
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2862
ord2714
ord4307
ord2835
ord2731
ord2537
ord5200
ord1599
ord1655
ord1656
ord1964
ord5175
ord1362
ord4967
ord3345
ord6277
ord3802
ord6279
ord1522
ord2172
ord2178
ord2405
ord2387
ord2385
ord2403
ord2415
ord2392
ord2408
ord2413
ord2396
ord2398
ord2400
ord2394
ord2410
ord2390
ord934
ord930
ord932
ord928
ord923
ord5233
ord5235
ord5960
ord1600
ord4282
ord4722
ord3403
ord5214
ord4185
ord6275
ord5073
ord1908
ord5152
ord4244
ord1402
ord3946
ord1617
ord1620
ord5915
ord6725
ord620
ord758
ord265
ord313
ord6067
ord567
ord765
ord3760
ord6119
ord3684
ord762
ord1084
ord1934
ord3210
ord3229
ord4237
ord1570
ord1484
ord1933
ord6266
ord1397
ord657
ord968
ord4001
ord4123
ord326
ord2367
ord4951
ord6754
ord760
ord1979
ord3834
ord1290
ord314
ord566
ord3333
ord4481
ord2990
ord2838
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord757
ord2248
ord3204
ord1280
ord605
ord3182
ord4262
ord5203
ord1401
ord5912
ord6724
ord1551
ord1670
ord1671
ord4890
ord4212

msvcr80

_lock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_stricmp
_decode_pointer
_onexit
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
memmove
wcsncmp
iswalnum
iswdigit
iswalpha
wcschr
_vsnwprintf
_CxxThrowException
memcpy
memset
_wcsicmp
malloc
free
_resetstkoflw
__CxxFrameHandler3

Exports

Exports

LaunchExpBuilder

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.mdw

Sharing

General

Malware Config

Signatures

Files

7fe6f713afe7ad088dc2ea80c3f65f55

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

c6:ce:53:0b:49:53:ae:99:3a:3f:6d:f1:27:24:e8:2a:91:5d:f1:2eSigner

Signature Validations

Verification

26/02/2009, 13:05 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

user32

gdi32

msaccess.exe

kernel32

mfc80

msvcr80

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 49KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 3KB - Virtual size: 3KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

c6:ce:53:0b:49:53:ae:99:3a:3f:6d:f1:27:24:e8:2a:91:5d:f1:2e
Signer

26/02/2009, 13:05
Valid: false

.text
Size: 49KB - Virtual size: 49KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 3KB - Virtual size: 3KB