2b74c279f2a8a8a33b387050c394561acd20c0e0e9c04e74165994585363456e

Sharing

Copy URL Twitter E-mail

General

Target

2b74c279f2a8a8a33b387050c394561acd20c0e0e9c04e74165994585363456e
Size

134KB
MD5

0d8108cd5c1b508817bc9b6c74646dd0
SHA1

3e6c73b2ff280258d9fc4bda776bbc4ea446deb0
SHA256

2b74c279f2a8a8a33b387050c394561acd20c0e0e9c04e74165994585363456e
SHA512

b70c51292eb9fdf1424ea792f9085cdb5b7c42724d7c65b51e6774c41cf8594066695c51b1b2e73ab5027f0c16746b0e106fc209cb4d592584965d06650a5adb
SSDEEP

3072:8V640Xc/zLzMY4yR4/iDQlyljO2XnzLbuQRyJ8LYmlJ0Lw8lo9RADsX9yRqTjSO9:0648Lkly2XnzLbuQRLJlJQwKoZKO5sri

Score

N/A

Malware Config

Signatures

Files

2b74c279f2a8a8a33b387050c394561acd20c0e0e9c04e74165994585363456e
.exe windows x86

b417375ded3165c50e57862b62d5f69c

Code Sign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:fa
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/02/2012, 00:00

Not After

01/02/2015, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fe:5d:dc:c5:a7:da:9b:8d:b8:4d:b1:39:d0:7b:62:5d:b7:e5:66:db
Signer

Actual PE Digest

fe:5d:dc:c5:a7:da:9b:8d:b8:4d:b1:39:d0:7b:62:5d:b7:e5:66:db

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

06/04/2012, 08:45
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcscpy
_beginthreadex
calloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
strcat
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
atoi
__dllonexit
_onexit
strncat
vsprintf
exit
fopen
fwrite
fclose
strcpy
strcmp
strrchr
_except_handler3
malloc
free
memcmp
??2@YAPAXI@Z
memset
wcstombs
wcslen
mbstowcs
_access
rand
_controlfp
strstr
_CxxThrowException
__CxxFrameHandler
strlen
_ftol
memmove
_initterm
??3@YAXPAX@Z

kernel32

RaiseException
LocalAlloc
FreeLibrary
LocalFree
WideCharToMultiByte
GetStartupInfoA
GetModuleHandleA
lstrlenA
MultiByteToWideChar
GetLastError
Sleep
GetModuleFileNameA
InterlockedDecrement
lstrcatA
LoadLibraryA
GetProcAddress
InterlockedExchange

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b417375ded3165c50e57862b62d5f69c

Code Sign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:faCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fe:5d:dc:c5:a7:da:9b:8d:b8:4d:b1:39:d0:7b:62:5d:b7:e5:66:dbSigner

Signature Validations

Verification

06/04/2012, 08:45 Valid: false

Headers

File Characteristics

Imports

msvcrt

kernel32

msvcp60

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 9KB - Virtual size: 14KB

.rsrc Size: 22KB - Virtual size: 22KB

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

26:cf:6f:8a:41:9c:ad:3b:3b:de:ca:09:2b:cb:a3:fa
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fe:5d:dc:c5:a7:da:9b:8d:b8:4d:b1:39:d0:7b:62:5d:b7:e5:66:db
Signer

06/04/2012, 08:45
Valid: false

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 9KB - Virtual size: 14KB

.rsrc
Size: 22KB - Virtual size: 22KB