e53482486c4c45391797a51889755f42799c7eafb439052706c2d6adb3f20fb2

Sharing

Copy URL

Twitter E-mail

General

Target

e53482486c4c45391797a51889755f42799c7eafb439052706c2d6adb3f20fb2
Size

105KB
MD5

079d603b42728929588e8153e430b5fd
SHA1

4e4dad96657d084f38a56b79d1d7e1ca303b1bef
SHA256

e53482486c4c45391797a51889755f42799c7eafb439052706c2d6adb3f20fb2
SHA512

df99493c34c7dbd901ec4647213bcb0291d373298d2b9d4d4d0729529831f88f87d79a677702de909e27ee92997be2f69e048ee741e82793dd920cd486eee954
SSDEEP

1536:ZGTW0Z70QBoF8oGyd6mOUFud8nrrnOdaQCzg26isKldR:a70QCs/UFud8rnOo4aV

Score

N/A

Malware Config

Signatures

Files

e53482486c4c45391797a51889755f42799c7eafb439052706c2d6adb3f20fb2
.exe windows x64

3b7acec9564cdb16c942f5e0deb1211a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:35:9a:c4:45:14:d7:81:76:9f:d6:43:66:6b:45:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31-03-2010 00:00

Not After

31-03-2011 23:59

Subject

CN=Chengdu Qiying Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Chengdu Qiying Technology Co.\,Ltd.,L=Chengdu,ST=Sichuan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

58:7b:03:e8:12:70:0b:ac:4c:98:98:04:8b:0a:e4:30:b9:6d:41:2d
Signer

Actual PE Digest

58:7b:03:e8:12:70:0b:ac:4c:98:98:04:8b:0a:e4:30:b9:6d:41:2d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Chengdu Qiying Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Chengdu Qiying Technology Co.\,Ltd.,L=Chengdu,ST=Sichuan,C=CN

02-08-2010 09:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenEventW
WaitForMultipleObjects
SetEvent
OpenFileMappingW
MapViewOfFile
FreeLibrary
VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
LoadLibraryA
GetProcAddress
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
Sleep
GetModuleFileNameW
OpenFileMappingA
GetCurrentThread
CreateFileMappingA
GetSystemInfo
UnmapViewOfFile
VirtualAlloc
lstrlenA
MultiByteToWideChar
GetLastError
OutputDebugStringW
OutputDebugStringA
OpenEventA
RaiseException
GetCurrentProcessId
CloseHandle
ResetEvent

ole32

CoInitialize
CoUninitialize
CoCreateInstance

msvcr90d

exit
__winitenv
_CrtSetCheckCount
_cexit
_initterm_e
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
_exit
_XcptFilter
__wgetmainargs
_amsg_exit
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_CRT_RTC_INITW
wcslen
memmove_s
_wcsicmp
memcmp
__C_specific_handler
_recalloc
calloc
memset
strcpy_s
wcsncpy_s
wcscpy_s
??2@YAPEAX_K@Z
_snwprintf_s
_vsnwprintf_s
_vsnprintf_s
wcscpy
strcpy
free
_CrtDbgReport
_CxxThrowException
_errno
_snprintf_s
_CrtDbgReportW
__CxxFrameHandler3
??3@YAXPEAX@Z
_initterm

advapi32

RevertToSelf
OpenThreadToken
SetThreadToken

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

%D
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b7acec9564cdb16c942f5e0deb1211a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:35:9a:c4:45:14:d7:81:76:9f:d6:43:66:6b:45:72Certificate

Extended Key Usages

Key Usages

58:7b:03:e8:12:70:0b:ac:4c:98:98:04:8b:0a:e4:30:b9:6d:41:2dSigner

Signature Validations

Verification

02-08-2010 09:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcr90d

advapi32

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

%D Size: 1024B - Virtual size: 584B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:35:9a:c4:45:14:d7:81:76:9f:d6:43:66:6b:45:72
Certificate

58:7b:03:e8:12:70:0b:ac:4c:98:98:04:8b:0a:e4:30:b9:6d:41:2d
Signer

02-08-2010 09:20
Valid: false

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

%D
Size: 1024B - Virtual size: 584B