8b94dd19c9043c35485f207275ff899d63341cc3fe86ab86548aef65714ae99a

Sharing

Copy URL Twitter E-mail

General

Target

8b94dd19c9043c35485f207275ff899d63341cc3fe86ab86548aef65714ae99a
Size

175KB
MD5

9fd07d805b8fa202e962aa4fb8c01dcc
SHA1

91901dbdb595fa8f50e2b5fe9a8396cc68d02c5f
SHA256

8b94dd19c9043c35485f207275ff899d63341cc3fe86ab86548aef65714ae99a
SHA512

cbf42352e0b8bec4b0fa5174eb0d42eab35454a45cb7216d69cf129758901a89c848228a9dae7bd922e2395ddb8cde9b646fc4a8a548262085bcf5a7570a3b93
SSDEEP

1536:Pkv3PiBObnVMSk+atgcGck4ydiGLl+kJ+11HY/1a3nY6QzTrLdt5DcVqIaioVvCT:c1o+aqxjC4sXot5gVqJnvvWZpR

Score

N/A

Malware Config

Signatures

Files

8b94dd19c9043c35485f207275ff899d63341cc3fe86ab86548aef65714ae99a
.exe windows x86

03eb0f0f53e7770a195f8d14652ba665

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:35:1d:87:4f:76:c3:cb:bc:ad:c1:58:35:bf:18:51
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

21/12/2016, 07:25

Not After

21/12/2017, 07:25

Subject

CN=Chongqing Weishang Yinghua Media Co\,. Ltd.,O=Chongqing Weishang Yinghua Media Co\,. Ltd.,L=Chongqing,ST=Chongqing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:52:90:89:60:a1:0f:0f:81:22:e4:bb:8e:f4:3d:54:5a:44:56:40
Signer

Actual PE Digest

ec:52:90:89:60:a1:0f:0f:81:22:e4:bb:8e:f4:3d:54:5a:44:56:40

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Chongqing Weishang Yinghua Media Co\,. Ltd.,O=Chongqing Weishang Yinghua Media Co\,. Ltd.,L=Chongqing,ST=Chongqing,C=CN

26/01/2017, 12:47
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
CloseHandle
WideCharToMultiByte
SetEndOfFile
CreateFileW
GetModuleHandleW
GetCurrentProcess
GetLastError
Sleep
DeleteFileW
GetTempPathW
MultiByteToWideChar
CreateProcessW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
HeapReAlloc
GetStringTypeW
IsValidLocale
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
GetProcessHeap

wininet

HttpOpenRequestA
InternetOpenA
InternetReadFileExA
InternetConnectA
HttpQueryInfoA
InternetCloseHandle
InternetCrackUrlA
HttpSendRequestA

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03eb0f0f53e7770a195f8d14652ba665

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

42:35:1d:87:4f:76:c3:cb:bc:ad:c1:58:35:bf:18:51Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

ec:52:90:89:60:a1:0f:0f:81:22:e4:bb:8e:f4:3d:54:5a:44:56:40Signer

Signature Validations

Verification

26/01/2017, 12:47 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

wininet

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 8KB - Virtual size: 7KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

42:35:1d:87:4f:76:c3:cb:bc:ad:c1:58:35:bf:18:51
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

ec:52:90:89:60:a1:0f:0f:81:22:e4:bb:8e:f4:3d:54:5a:44:56:40
Signer

26/01/2017, 12:47
Valid: false

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 8KB - Virtual size: 7KB