8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99

Sharing

Copy URL

Twitter E-mail

General

Target

8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99
Size

77KB
MD5

524881210eb3b0921c27f84e72481020
SHA1

024f047fa0709b4242c5e35471eb479d310b5484
SHA256

8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99
SHA512

5383bef5b546ff3ae02988e7a42cadd958f7486ea84e79faefcb7c632d501ac0b517518b4d371eb360a1540f7c7985501b7ce710479f1bbbe2f8667bf6a9d164
SSDEEP

1536:dwM7e0mhT/5CmELRaOCuPpY8KluHutu8sx+BkR2I+hd:mX08T/AmELRaOCpula5

Score

N/A

Malware Config

Signatures

Files

8fe386bf8d5693983c31be155bb43017fbe29dab2dade97d276df25b3758be99
.exe windows x86

5e6fdf300ac00607213cf695821e7712

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:fa
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02-02-2012 00:00

Not After

01-02-2015 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:f3:b0:04:fc:f5:06:7b:91:a0:17:f5:af:be:00:4a:d6:f3:6e:34
Signer

Actual PE Digest

4d:f3:b0:04:fc:f5:06:7b:91:a0:17:f5:af:be:00:4a:d6:f3:6e:34

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

12-07-2012 04:28
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcpyA
GetEnvironmentVariableA
ResumeThread
GetLocalTime
lstrlenA
GetLastError
RaiseException
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
GetTickCount
ExitThread
WaitForSingleObject
CloseHandle
CreateThread
GetModuleFileNameA
SetFileAttributesA
GetVersionExA
GlobalMemoryStatus
GetShortPathNameA
GetStartupInfoA
LocalAlloc
InterlockedExchange
GetModuleHandleA

user32

wsprintfA

advapi32

SetServiceStatus
CreateServiceA
StartServiceA
RegOpenKeyA
RegSetValueExA
CloseServiceHandle
RegCloseKey
RegOpenKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
OpenSCManagerA
OpenServiceA
DeleteService

mfc42

ord6877
ord939
ord2818
ord4278
ord860
ord6663
ord858
ord535
ord540
ord924
ord926
ord2846
ord2764
ord800
ord537

msvcrt

atoi
strncmp
_except_handler3
??3@YAXPAX@Z
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
time
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
srand
printf
rand
_XcptFilter
strstr
free
exit
_CxxThrowException
__CxxFrameHandler
_itoa

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e6fdf300ac00607213cf695821e7712

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:faCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

4d:f3:b0:04:fc:f5:06:7b:91:a0:17:f5:af:be:00:4a:d6:f3:6e:34Signer

Signature Validations

Verification

12-07-2012 04:28 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

mfc42

msvcrt

msvcp60

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 48KB - Virtual size: 48KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:fa
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4d:f3:b0:04:fc:f5:06:7b:91:a0:17:f5:af:be:00:4a:d6:f3:6e:34
Signer

12-07-2012 04:28
Valid: false

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 48KB - Virtual size: 48KB