77ce8b5218de140046432ba04b82a2e3003b6cdd9b33fbcd73739e4f685d8abc

Sharing

Copy URL Twitter E-mail

General

Target

77ce8b5218de140046432ba04b82a2e3003b6cdd9b33fbcd73739e4f685d8abc
Size

679KB
MD5

f70150a6c746c22f662c43144dfb6f62
SHA1

a872c5bab1a2d440670d19ba1bca306d3ca935a0
SHA256

77ce8b5218de140046432ba04b82a2e3003b6cdd9b33fbcd73739e4f685d8abc
SHA512

f6eb90499fa74676a487ceabde56410e110870eb70fc8af870cc76e1026a13cf56347de9f957903376b48e0995f5737208e83a6e99c0ae0b6f76fb49db29dad5
SSDEEP

12288:KR3BKje//yIsJGX9ZPQL9JNqWCt5Ae7ENim77Yayx2VSGL6:KrKjeyISI34EcH7ZVJL6

Score

N/A

Malware Config

Signatures

Files

77ce8b5218de140046432ba04b82a2e3003b6cdd9b33fbcd73739e4f685d8abc
.zip
AddinVipLc.dll
.dll windows x86

7015e83606b72bbade9dccf7f1b1d254

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/02/2021, 00:00

Not After

30/04/2024, 23:59

Subject

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cd:cd:65:78:d9:7d:a9:4b:ca:1f:1a:e8:ed:7d:80:c5:0b:5d:bd:11
Signer

Actual PE Digest

cd:cd:65:78:d9:7d:a9:4b:ca:1f:1a:e8:ed:7d:80:c5:0b:5d:bd:11

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

23/08/2021, 12:12
Valid: true

Chain 1

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3708
ord6741
ord3742
ord6055
ord4078
ord1776
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3402
ord4627
ord3610
ord781
ord6508
ord656
ord641
ord326
ord6640
ord2289
ord2370
ord2358
ord2302
ord4234
ord2642
ord3092
ord6334
ord6215
ord6911
ord551
ord3811
ord3061
ord6199
ord858
ord3337
ord5981
ord4277
ord5683
ord4202
ord2086
ord2575
ord4396
ord3574
ord609
ord324
ord941
ord2820
ord1768
ord3499
ord2515
ord355
ord6283
ord6282
ord5710
ord4129
ord3874
ord6880
ord665
ord1979
ord6385
ord5186
ord354
ord3619
ord3626
ord3663
ord2414
ord2243
ord3908
ord4133
ord4297
ord5875
ord4160
ord2537
ord763
ord640
ord5678
ord5736
ord1199
ord2450
ord1640
ord323
ord3506
ord483
ord3719
ord793
ord2294
ord2362
ord2645
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord3597
ord3639
ord3721
ord692
ord795
ord554
ord807
ord3437
ord5655
ord4163
ord6625
ord1146
ord4299
ord955
ord6662
ord755
ord2754
ord470
ord3573
ord3693
ord3571
ord6128
ord1641
ord613
ord2405
ord5785
ord289
ord5148
ord5768
ord3752
ord4694
ord4476
ord4224
ord939
ord550
ord4187
ord1844
ord4275
ord4400
ord682
ord2567
ord2753
ord5788
ord3089
ord6172
ord5873
ord5789
ord472
ord6021
ord2862
ord2393
ord5053
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord5794
ord5579
ord5571
ord6061
ord5864
ord3596
ord6194
ord1233
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord5440
ord6383
ord5450
ord6394
ord4243
ord2841
ord6242
ord6696
ord2859
ord6762
ord3286
ord3910
ord6007
ord6453
ord6905
ord1997
ord6407
ord924
ord926
ord798
ord5194
ord533
ord2463
ord4425
ord1775
ord6052
ord2514
ord4998
ord5265
ord3361
ord5280
ord4710
ord4853
ord4376
ord6423
ord1175
ord2864
ord3815
ord1134
ord3953
ord2725
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord815
ord803
ord1168
ord2867
ord4401
ord1105
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord6883
ord2764
ord543
ord3584
ord535
ord5860
ord541
ord6143
ord5630
ord801
ord911
ord860
ord6467
ord1651
ord5592
ord3937
ord540
ord2818
ord537
ord800
ord5606
ord825
ord500
ord567
ord396
ord823
ord772
ord818
ord2379
ord698

msvcrt

free
sprintf
strncpy
rand
srand
time
atoi
strstr
malloc
memmove
atol
_mbscmp
_ftol
atof
__CxxFrameHandler
_mbschr
strncmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strnicmp
_purecall
_atoi64
wcslen
_fileno
_filelength
_stricmp
_vsnprintf
fread
fclose
fopen
fwrite
strchr

kernel32

FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
InterlockedDecrement
MulDiv
DeleteFileA
CreateDirectoryA
Sleep
GetProfileStringA
GetVersion
GlobalFree
GlobalLock
lstrlenA
GlobalAlloc
lstrcpynA
GetTickCount
LocalAlloc
LocalFree
GetLocalTime
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryA
LoadLibraryA

user32

IsWindow
GetCursorPos
LoadIconA
SetWindowLongA
GetClientRect
SetWindowPos
GetDlgCtrlID
DrawIcon
GetSystemMetrics
IsIconic
CallWindowProcA
GetFocus
GetKeyboardLayoutList
wsprintfA
ActivateKeyboardLayout
MessageBoxA
SetRect
GetWindowRect
InvalidateRect
EnableWindow
SendMessageA
GetSysColor
GetKeyState
LoadCursorA
SetCursor
GetParent
PostMessageA
PtInRect
LoadBitmapA
SystemParametersInfoA
ReleaseDC
LoadKeyboardLayoutA
PeekMessageA
GetDC
GetDesktopWindow
UpdateWindow
InflateRect
ClientToScreen
GetSubMenu
LoadMenuA
TabbedTextOutA
DrawTextA
GrayStringA
ModifyMenuA
DeleteMenu
EnableMenuItem
DestroyWindow
GetWindowTextA
GetWindowLongA
IsRectEmpty
ScreenToClient
GetDlgItem
LoadStringA

gdi32

StartDocA
SetAbortProc
DPtoLP
GetDeviceCaps
CreatePen
CreatePatternBrush
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
StartPage
CreateDCA
ResetDCA
CreateFontA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextExtentPoint32A
Rectangle
AbortDoc
SetWindowOrgEx
EndPage
EndDoc

winspool.drv

DocumentPropertiesA

advapi32

RegOpenKeyA
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA

comctl32

ImageList_GetImageInfo

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

Exports

Exports

Addin_GetObject

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AddinYzzz.dll
.dll windows x86

6a272ea1a3b68506f28a117e58bc0faf

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/02/2021, 00:00

Not After

30/04/2024, 23:59

Subject

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:75:75:3e:84:6f:bf:5d:8a:d5:29:a9:bb:2d:6f:c7:30:0e:59:ee
Signer

Actual PE Digest

c5:75:75:3e:84:6f:bf:5d:8a:d5:29:a9:bb:2d:6f:c7:30:0e:59:ee

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

08/07/2021, 06:28
Valid: true

Chain 1

CN=Shenzhen Fortune Trend technology Co.\, Ltd,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=guangdong province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3811
ord6877
ord2763
ord802
ord2765
ord1085
ord542
ord2867
ord1168
ord815
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5714
ord3401
ord4622
ord3738
ord561
ord2725
ord3953
ord1134
ord3815
ord1175
ord6423
ord2623
ord5495
ord3005
ord2135
ord3874
ord6442
ord1233
ord6880
ord3092
ord4224
ord858
ord539
ord1601
ord465
ord466
ord2241
ord1238
ord4275
ord6197
ord3797
ord2379
ord6453
ord4160
ord3237
ord3258
ord2486
ord2688
ord6027
ord3495
ord610
ord6289
ord6139
ord968
ord3470
ord455
ord287
ord6283
ord6282
ord5710
ord4226
ord4009
ord3337
ord2764
ord6741
ord4710
ord3361
ord5265
ord4376
ord4853
ord4998
ord6052
ord1775
ord4425
ord3597
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord6508
ord559
ord326
ord812
ord2298
ord2370
ord2302
ord4234
ord6334
ord2642
ord6215
ord6921
ord6767
ord5953
ord4123
ord5981
ord5280
ord4299
ord6605
ord2915
ord6199
ord2086
ord3610
ord656
ord2301
ord6640
ord2289
ord3317
ord2820
ord6911
ord3619
ord3626
ord3663
ord755
ord2414
ord5789
ord5875
ord6172
ord5873
ord1641
ord470
ord324
ord1768
ord941
ord939
ord4278
ord6663
ord4476
ord3708
ord613
ord289
ord2860
ord6639
ord3055
ord936
ord5933
ord3880
ord3425
ord3054
ord6910
ord928
ord5934
ord1146
ord6380
ord6134
ord3763
ord6919
ord6766
ord919
ord2463
ord6467
ord1651
ord5606
ord825
ord500
ord567
ord3810
ord3227
ord3408
ord535
ord2864
ord354
ord5186
ord3318
ord5442
ord1979
ord2514
ord665
ord781
ord641
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord2818
ord860
ord537
ord540
ord4129
ord800
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord823
ord5860
ord772
ord818
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269

msvcrt

_strnicmp
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
sprintf
memmove
_vsnprintf
atof
atol
_mbscmp
malloc
_purecall
__CxxFrameHandler
free
strncpy
atoi
strstr
fclose
fopen
fwrite
strncmp
strchr
_stricmp
_CxxThrowException

kernel32

InitializeCriticalSection
LCMapStringA
GetCurrentThreadId
LocalAlloc
GetACP
Sleep
LocalFree
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
lstrlenW
WideCharToMultiByte
LoadLibraryA
FreeLibrary
MultiByteToWideChar
lstrlenA
GlobalAlloc
lstrcpyA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection

user32

LoadMenuA
GetSubMenu
SetMenuItemInfoA
DeleteMenu
TrackPopupMenu
SendMessageA
IsWindow
AdjustWindowRectEx
CopyRect
GetClientRect
LoadCursorA
SetCursor
GetParent
EnableWindow
PostMessageA
GetWindowRect
InvalidateRect
GetNextDlgTabItem
GetFocus
DestroyMenu
IsWindowVisible
GetWindow
SetTimer
ClientToScreen
KillTimer
MessageBoxA
LoadIconA
SetWindowPos
LoadStringA
SetWindowLongA
GetWindowLongA
DestroyWindow
GetWindowTextA
IsRectEmpty
ScreenToClient
GetDlgItem
ShowScrollBar

gdi32

GetTextExtentPoint32A
CreateFontIndirectA
CreateFontA
GetObjectA

shell32

ShellExecuteA

ole32

CreateStreamOnHGlobal

oleaut32

VariantClear
SysFreeString

Exports

Exports

Addin_GetObject

Sections

.text
Size: 372KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GetMachineInfo.dll
.dll windows x86

857201d2a3ea01979715932b8e81ab4b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2f:4d:84:4b:39:3f:35:f7:a2:50:7a:bb:dc:9e:76:d5
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/01/2015, 00:00

Not After

11/02/2018, 23:59

Subject

CN=Shenzhen Fortune Trend technology Co.\, Ltd,OU=Technical Support,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:f9:e2:a1:44:0e:59:fb:9e:eb:bb:7a:ba:67:d3:54:28:ea:af:75
Signer

Actual PE Digest

34:f9:e2:a1:44:0e:59:fb:9e:eb:bb:7a:ba:67:d3:54:28:ea:af:75

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shenzhen Fortune Trend technology Co.\, Ltd,OU=Technical Support,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

19/10/2017, 07:25
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
GetOEMCP
GetCommandLineA
RtlUnwind
HeapFree
HeapAlloc
RaiseException
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetACP
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
Sleep
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
GetProcessVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetLastError
InterlockedExchange
SetLastError
WritePrivateProfileStringA
GlobalFlags
GetVersion
lstrcpynA
lstrcpyA
lstrcatA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
GlobalUnlock
GlobalFree
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
LocalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameA
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
GetModuleHandleA
lstrlenA
CreateFileA
DeviceIoControl
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress
GetSystemInfo
GetVersionExA
GetFileType

user32

GetForegroundWindow
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
DestroyMenu
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetMenuItemCount
wsprintfA
GetWindowTextA
SetWindowTextA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetClassNameA
UnregisterClassA
LoadStringA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
UnhookWindowsHookEx

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetTextColor
GetDeviceCaps
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetObjectA
DeleteDC
SetBkColor
GetStockObject
SelectObject
RestoreDC
CreateBitmap
DeleteObject
SaveDC

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

comctl32

ord17

Exports

Exports

GetMachineinfo

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ePass2001API.dll
.dll windows x86

bd6a30a5705c0655508afc58b78fb120

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2f:4d:84:4b:39:3f:35:f7:a2:50:7a:bb:dc:9e:76:d5
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13/01/2015, 00:00

Not After

11/02/2018, 23:59

Subject

CN=Shenzhen Fortune Trend technology Co.\, Ltd,OU=Technical Support,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b8:54:14:41:53:83:c5:6b:f1:ef:b1:67:f6:42:b4:23:7a:a7:c8:bd
Signer

Actual PE Digest

b8:54:14:41:53:83:c5:6b:f1:ef:b1:67:f6:42:b4:23:7a:a7:c8:bd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shenzhen Fortune Trend technology Co.\, Ltd,OU=Technical Support,O=Shenzhen Fortune Trend technology Co.\, Ltd,L=Shenzhen,ST=Guangdong,C=CN

19/10/2017, 07:25
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
QueryPerformanceCounter
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
GetModuleFileNameA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
GetVersionExA
VirtualFree
WriteFile
GetModuleHandleA
InitializeCriticalSection
VirtualAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
ReadFile
FlushFileBuffers
SetStdHandle
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
InterlockedDecrement
InterlockedIncrement
CreateFileA
LCMapStringA
LCMapStringW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
CloseHandle
GetLastError
GetCurrentThreadId
OutputDebugStringA
GetProcAddress
HeapCreate
LoadLibraryA

Exports

Exports

ChangePin
DeletePublicData
GetPinTime
GetPrivateDataName
GetPublicDataName
GetTokenInfo
ListDataNum
ListTokenNum
OpenSpecToken
ReadPrivateData
ReadPublicData
SignData
VerifySignature
VerifyUserpin

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7015e83606b72bbade9dccf7f1b1d254

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8Certificate

Extended Key Usages

Key Usages

cd:cd:65:78:d9:7d:a9:4b:ca:1f:1a:e8:ed:7d:80:c5:0b:5d:bd:11Signer

Signature Validations

Verification

23/08/2021, 12:12 Valid: true

Chain 1

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

msvcp60

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 159KB

.rdata Size: 116KB - Virtual size: 113KB

.data Size: 60KB - Virtual size: 68KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 20KB - Virtual size: 19KB

6a272ea1a3b68506f28a117e58bc0faf

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8Certificate

Extended Key Usages

Key Usages

c5:75:75:3e:84:6f:bf:5d:8a:d5:29:a9:bb:2d:6f:c7:30:0e:59:eeSigner

Signature Validations

Verification

08/07/2021, 06:28 Valid: true

Chain 1

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 372KB - Virtual size: 370KB

.rdata Size: 132KB - Virtual size: 129KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

cd:cd:65:78:d9:7d:a9:4b:ca:1f:1a:e8:ed:7d:80:c5:0b:5d:bd:11
Signer

23/08/2021, 12:12
Valid: true

.text
Size: 160KB - Virtual size: 159KB

.rdata
Size: 116KB - Virtual size: 113KB

.data
Size: 60KB - Virtual size: 68KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 20KB - Virtual size: 19KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0d:ba:6d:5e:8a:52:ef:25:09:b1:a9:54:c2:7e:ac:e8
Certificate

c5:75:75:3e:84:6f:bf:5d:8a:d5:29:a9:bb:2d:6f:c7:30:0e:59:ee
Signer

08/07/2021, 06:28
Valid: true

.text
Size: 372KB - Virtual size: 370KB

.rdata
Size: 132KB - Virtual size: 129KB

.data
Size: 60KB - Virtual size: 161KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 32KB - Virtual size: 31KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2f:4d:84:4b:39:3f:35:f7:a2:50:7a:bb:dc:9e:76:d5
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

34:f9:e2:a1:44:0e:59:fb:9e:eb:bb:7a:ba:67:d3:54:28:ea:af:75
Signer

19/10/2017, 07:25
Valid: false

.text
Size: 96KB - Virtual size: 92KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 16KB - Virtual size: 35KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 16KB - Virtual size: 14KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2f:4d:84:4b:39:3f:35:f7:a2:50:7a:bb:dc:9e:76:d5
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b8:54:14:41:53:83:c5:6b:f1:ef:b1:67:f6:42:b4:23:7a:a7:c8:bd
Signer

19/10/2017, 07:25
Valid: false

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 24KB - Virtual size: 42KB

.reloc
Size: 12KB - Virtual size: 11KB