416851f18496bef20f4de2a085b6bb1eece635fd2266b2f95de0618f19fc497b

Sharing

Copy URL Twitter E-mail

General

Target

416851f18496bef20f4de2a085b6bb1eece635fd2266b2f95de0618f19fc497b
Size

570KB
MD5

80052f9ff214798bf4967b46cab057e0
SHA1

a21a177b69d6c514bfd6aebd092a87a3e64c85bc
SHA256

416851f18496bef20f4de2a085b6bb1eece635fd2266b2f95de0618f19fc497b
SHA512

d9779e6595657858fc119c1d06c177c99ae37c76b2df39e43ed2c8d6c115063f2c6af51631d4605df8b180ef2419b92caa5d98baa69f8ee213390c00a7dc1888
SSDEEP

12288:YZt1yoaEYopC6GtMcsKAvJIZ4v4ZEHYNOx2GxqtOOKkd7cG+4jfTVX:Y3c0ck4OTxoOjkdAG+4jfJX

Score

N/A

Malware Config

Signatures

Files

416851f18496bef20f4de2a085b6bb1eece635fd2266b2f95de0618f19fc497b
.dll regsvr32 windows x86

e52d43c0b7cd273fc50861657d43fa60

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:c3:89:61:1c:65:6a:f0:d3:ab:84:78:6e:c9:51:79:46
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

27/06/2011, 03:56

Not After

27/06/2014, 03:56

Subject

CN=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntW
PathFileExistsW
StrStrIW

wininet

HttpQueryInfoW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
HttpSendRequestW
InternetCrackUrlW
InternetOpenW
InternetConnectW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

kernel32

CreateEventW
CreateThread
lstrcpynW
GlobalLock
GlobalAlloc
WideCharToMultiByte
GetVersionExW
GlobalUnlock
IsBadWritePtr
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
OpenFileMappingW
WriteFile
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
SystemTimeToFileTime
CreateDirectoryW
GetSystemTime
GetFileSize
SetFilePointer
GetTickCount
ReadFile
GlobalFindAtomW
OutputDebugStringA
GlobalAddAtomW
lstrcpyW
LoadLibraryA
DeleteFileW
ExpandEnvironmentStringsW
HeapDestroy
HeapAlloc
LockResource
HeapReAlloc
HeapSize
GetProcessHeap
IsProcessorFeaturePresent
SetLastError
WaitForSingleObject
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
GetModuleHandleA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
GetCommandLineA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
FlushInstructionCache
EnterCriticalSection
SetEvent
WriteConsoleA
GetConsoleOutputCP
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
DisableThreadLibraryCalls
GetLastError
RaiseException
lstrlenW
CreateFileW
GetModuleFileNameW
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
WriteConsoleW
DeleteCriticalSection
VirtualAlloc
lstrcmpiW
LeaveCriticalSection
SizeofResource
InitializeCriticalSection
OutputDebugStringW
LoadResource
FindResourceW
FindResourceExW
VirtualFree
FlushFileBuffers
CreateFileA
GetStringTypeExA
LocalAlloc
HeapFree
IsValidLocale

user32

LoadStringA
SetWindowTextW
SendMessageW
CharNextW
DispatchMessageW
MoveWindow
UnregisterClassA
GetWindowModuleFileNameW
GetAsyncKeyState
RedrawWindow
FillRect
DrawTextW
SetRectEmpty
GetClassLongW
GetScrollInfo
SetScrollInfo
CopyRect
WindowFromPoint
LoadImageW
DestroyIcon
ScreenToClient
RegisterWindowMessageW
SendMessageTimeoutW
CloseClipboard
MonitorFromPoint
TrackPopupMenu
GetMenuItemID
GetSubMenu
SetForegroundWindow
GetMenuStringW
SetFocus
ModifyMenuW
EnumThreadWindows
GetWindow
GetWindowThreadProcessId
CallWindowProcW
LoadMenuW
EmptyClipboard
GetActiveWindow
GetMenuItemCount
UpdateWindow
IsWindowVisible
UnhookWindowsHookEx
SetWindowsHookExW
CreateWindowExW
FindWindowExW
IsWindow
ShowWindow
SetWindowPos
GetDesktopWindow
SetWindowLongW
GetClassNameW
PeekMessageW
GetWindowTextW
OpenClipboard
SetClipboardData
DestroyMenu
GetMonitorInfoW
KillTimer
LoadIconW
FindWindowW
PtInRect
GetCursorPos
GetComboBoxInfo
MapWindowPoints
EndPaint
GetClientRect
BeginPaint
InvalidateRect
DefWindowProcW
DestroyWindow
GetWindowTextLengthW
SetTimer
GetWindowRect
GetMessageW
PostMessageW
GetFocus
GetParent
LoadCursorW
CallNextHookEx
GetClassInfoExW
TranslateMessage
GetForegroundWindow
RegisterClassExW
GetWindowLongW

advapi32

RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegDeleteValueW

ole32

RevokeDragDrop
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
RegisterDragDrop

oleaut32

SafeArrayAccessData
VariantChangeType
SafeArrayUnaccessData
SafeArrayGetUBound
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear
SysStringLen
VarUI4FromStr
SysFreeString
SafeArrayGetLBound
SysAllocString

comctl32

ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Remove
ImageList_Draw
ImageList_Destroy

gdi32

DeleteDC
MoveToEx
CreateSolidBrush
GetStockObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
CreateFontIndirectW
SetTextColor
SetViewportOrgEx
GetTextExtentPoint32W
BitBlt
LineTo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

imm32

ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext

ws2_32

htons
htonl
ntohl
socket
WSACleanup
inet_addr
WSAStartup
gethostbyname
ntohs

iphlpapi

GetAdaptersInfo
GetPerAdapterInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 437KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e52d43c0b7cd273fc50861657d43fa60

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:c3:89:61:1c:65:6a:f0:d3:ab:84:78:6e:c9:51:79:46Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wininet

comdlg32

kernel32

user32

advapi32

ole32

oleaut32

comctl32

gdi32

version

imm32

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 437KB - Virtual size: 437KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 13KB - Virtual size: 24KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 31KB - Virtual size: 31KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:c3:89:61:1c:65:6a:f0:d3:ab:84:78:6e:c9:51:79:46
Certificate

.text
Size: 437KB - Virtual size: 437KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 13KB - Virtual size: 24KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 31KB - Virtual size: 31KB