General

Malware Config

Signatures

Files

• a6d42ce9c848da1be899cdc96a33c7378d3b6563f616ac4e6c32b5cb1e5ccfe8

  .exe windows x86

  
  

  Code Sign

  46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2f:10:b9:7b:e7:9d:fe:3f:a7:cd:42:c9:fc:23:1c:c2

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Not Before

  30-03-2015 05:01

  Not After

  30-03-2016 06:01

  Subject

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  01-03-2011 01:00

  Not After

  01-03-2016 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  36:ef:f5:78:f9:8e:49:d1:80:f5:73:7d:17:c3:42:7a:58:63:2a:e8

  Signer

  Actual PE Digest

  36:ef:f5:78:f9:8e:49:d1:80:f5:73:7d:17:c3:42:7a:58:63:2a:e8

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  04-11-2022 15:41

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 326KB - Virtual size: 326KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 7KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ