General

Malware Config

Signatures

Files

• 877d44c06794eeae040dc0650f8eb6c75295c9fae71e2c4595cf9e17e5ce99d0

  .exe windows x86

  
  

  Code Sign

  46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2f:10:b9:7b:e7:9d:fe:3f:a7:cd:42:c9:fc:23:1c:c2

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Not Before

  30-03-2015 05:01

  Not After

  30-03-2016 06:01

  Subject

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  01-03-2011 01:00

  Not After

  01-03-2016 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  8d:40:6b:ad:32:10:04:49:17:e5:68:6e:7c:34:a3:b1:e4:69:ce:28

  Signer

  Actual PE Digest

  8d:40:6b:ad:32:10:04:49:17:e5:68:6e:7c:34:a3:b1:e4:69:ce:28

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  28-10-2022 15:02

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 326KB - Virtual size: 326KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 7KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ