0f5f5f1a4c51f74c2045dde215c17a9be8cf6ed79ad9243759f08eb0a484eab8

Sharing

Copy URL Twitter E-mail

General

Target

0f5f5f1a4c51f74c2045dde215c17a9be8cf6ed79ad9243759f08eb0a484eab8
Size

240KB
MD5

947ca5c8f0cbd1b421e104bd0e6b2edb
SHA1

e862b1a72039c9050ff8db8c6820aa7991322cd6
SHA256

0f5f5f1a4c51f74c2045dde215c17a9be8cf6ed79ad9243759f08eb0a484eab8
SHA512

14a585ab4bfe4ed38ccd773f7f7c944784197a505752f6495e52d7ad726daf1d9078a33fdd5d6fa61ee38257f112111942ad5cf701a0395087b8eb501c2fc143
SSDEEP

3072:S0Kr1E1uZDVb7BSVqv1RBRdcGBY/YciKbw8ZwsZiw0GMJ9gJWrFRyp/dnESTnz5x:S7K4BSVo1RXdr8GzVGsgJAPShW7Tw9

Score

N/A

Malware Config

Signatures

Files

0f5f5f1a4c51f74c2045dde215c17a9be8cf6ed79ad9243759f08eb0a484eab8
.dll regsvr32 windows x86

90f2fd49deb27e6f0003f38f05bc6a7c

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushInstructionCache
WinExec
CreateProcessA
CreateProcessW
TlsSetValue
TlsGetValue
lstrcmpiA
SearchPathW
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcmpiW
IsBadWritePtr
lstrcpyA
CompareStringA
FreeLibrary
GetProcAddress
LocalAlloc
GetFileAttributesW
GetSystemDirectoryW
ReadFile
GetFileSize
CreateFileA
SetFilePointer
CreateFileW
GetSystemWindowsDirectoryA
GetEnvironmentVariableA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
TerminateProcess
GetFileAttributesExW
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
VirtualAlloc
SetUnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingA
DeleteFileA
WriteProcessMemory
VirtualProtect
GetVersion
GetFileTime
OpenFileMappingA
TlsFree
DisableThreadLibraryCalls
TlsAlloc
GetShortPathNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
lstrcatA
LoadLibraryW
GetFileAttributesExA
GetLongPathNameA
WriteFile
GetSystemTime
SystemTimeToFileTime
GetCurrentThreadId
GetModuleHandleA
GetCurrentProcess
GetLongPathNameW
GetModuleFileNameA
LoadLibraryA
CreateThread
GetExitCodeThread
lstrlenW
WideCharToMultiByte
LocalFree
MultiByteToWideChar
IsBadReadPtr
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringA
DebugBreak
InterlockedIncrement
InterlockedDecrement
GetTickCount
WaitForMultipleObjects
SetLastError
SetEvent
lstrlenA
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
Process32Next
CreateEventA

user32

CharNextA
CharLowerA
DrawFocusRect
GetSystemMetrics
DrawEdge
DrawTextW
GetClassNameA
GetWindowLongA
LoadCursorA
GetParent
GetWindowTextLengthA
GetWindowTextA
IsWindowEnabled
SetCursor
BeginPaint
LoadIconA
IsWindow
DestroyWindow
PtInRect
SetCapture
GetCapture
ReleaseCapture
InvalidateRect
UpdateWindow
DefWindowProcA
SetRectEmpty
LoadBitmapA
IsDlgButtonChecked
EndDialog
GetClientRect
SetRect
DrawTextExA
GetWindowRect
ScreenToClient
InflateRect
FrameRect
SendMessageA
SetWindowTextA
SetDlgItemTextA
GetDlgItem
CheckDlgButton
SetFocus
DestroyIcon
SetWindowLongA
FindWindowExA
EnumThreadWindows
GetActiveWindow
DialogBoxParamA
LoadStringA
wvsprintfA
SetTimer
SystemParametersInfoA
CallWindowProcA
GetDlgCtrlID
ClientToScreen
KillTimer
ReleaseDC
DrawIconEx
GetDC
CopyRect
CreateWindowExA
OffsetRect
DrawTextA
FillRect
GetFocus
GetSysColor
EndPaint
SetWindowPos
GetMenu
ShowWindow
BroadcastSystemMessageA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
FindWindowA
WaitForInputIdle
SetForegroundWindow
PostMessageA
GetCursorPos
SendMessageTimeoutA
AdjustWindowRectEx

gdi32

SetBkColor
ExtTextOutA
CreateCompatibleBitmap
SetViewportOrgEx
CreateFontA
GetStockObject
CreateFontIndirectA
GetObjectA
SelectObject
CreateCompatibleDC
StretchBlt
BitBlt
DeleteDC
SetTextColor
SetBkMode
CreateSolidBrush
DeleteObject

advapi32

RegQueryInfoKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegCloseKey
RegSetValueExA

shell32

CommandLineToArgvW
ShellExecuteExW
ShellExecuteExA
ShellExecuteW
ShellExecuteA
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
LoadTypeLi
RegisterTypeLi
DispCallFunc
LoadRegTypeLi
SafeArrayCreateVector

comctl32

ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_Draw
_TrackMouseEvent
ImageList_Add

msvcrt

??0exception@@QAE@ABV0@@Z
strlen
memcpy
free
??0exception@@QAE@XZ
realloc
_CxxThrowException
memset
__CxxFrameHandler
??2@YAPAXI@Z
_vsnprintf
_mbscmp
_ismbcspace
memmove
_mbsstr
wcslen
_ismbcdigit
atoi
_except_handler3
abs
memcmp
_vsnwprintf
malloc
time
isalnum
_mbslwr
strcmp
_mbsicmp
_beginthreadex
_purecall
??1type_info@@UAE@XZ
__dllonexit
_onexit
strcpy
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_strnicmp
strcat
??1exception@@UAE@XZ

wininet

HttpAddRequestHeadersA
InternetSetOptionA
InternetOpenA
InternetConnectA
HttpQueryInfoA
HttpEndRequestA
InternetReadFileExA
InternetSetStatusCallbackA
HttpSendRequestExA
InternetCloseHandle
InternetWriteFile
HttpOpenRequestA

psapi

GetModuleInformation

ws2_32

WSASetLastError

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

StrCmpNIA
PathIsDirectoryA
PathAppendA
UrlCanonicalizeA
SHGetValueA
UrlGetPartA
PathRemoveFileSpecW
PathIsDirectoryW
StrDupW
PathRemoveExtensionW
PathFileExistsW
PathCombineA
PathFileExistsA
PathCombineW
StrStrIW
StrChrW
PathFindFileNameA
PathFindExtensionW
StrStrIA
SHDeleteKeyA
SHSetValueA
StrToIntA
StrCpyNW
StrRChrW
StrCmpIW
PathFindFileNameW
PathIsPrefixW
PathRemoveBackslashW
StrCmpNIW
PathIsRootW

urlmon

URLDownloadToCacheFileA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Start
Stop
Update

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.share
Size: 4KB - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90f2fd49deb27e6f0003f38f05bc6a7c

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msvcrt

wininet

psapi

ws2_32

version

shlwapi

urlmon

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 6KB

.share Size: 4KB - Virtual size: 28B

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 12KB - Virtual size: 9KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 6KB

.share
Size: 4KB - Virtual size: 28B

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 12KB - Virtual size: 9KB