General

Malware Config

Signatures

Files

• cfd379f4cd6f30427f085a20aa96aa404f7a9745dba47625126503f2aec9008a

  .exe windows x86

  
  

  Code Sign

  25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2f:10:b9:7b:e7:9d:fe:3f:a7:cd:42:c9:fc:23:1c:c2

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Not Before

  30-03-2015 05:01

  Not After

  30-03-2016 06:01

  Subject

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  01-03-2011 01:00

  Not After

  01-03-2016 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  e4:55:11:94:54:e2:8a:34:d1:5c:d7:3b:f2:a1:f5:25:3f:26:f7:5a

  Signer

  Actual PE Digest

  e4:55:11:94:54:e2:8a:34:d1:5c:d7:3b:f2:a1:f5:25:3f:26:f7:5a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  13-07-2015 02:58

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 326KB - Virtual size: 326KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 7KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ