1fc49c70e834845ce46259a14beddc501e75e449c79d0aa65bdc5efd0b919fef

Sharing

Copy URL Twitter E-mail

General

Target

1fc49c70e834845ce46259a14beddc501e75e449c79d0aa65bdc5efd0b919fef
Size

147KB
MD5

b063e837586a6ffa186d3c78aefc2d42
SHA1

ff0fe091b82eb281c49afcd1cdfe397f564ac365
SHA256

1fc49c70e834845ce46259a14beddc501e75e449c79d0aa65bdc5efd0b919fef
SHA512

6f5842cd4a8ee253430fcd51cbaf0ccf3490fb43b0b1146c2cdf78cea9fe9bc0ae238dd672a8166ea47b5ff00012a76cf2c6e4d971926051ba9f940bfc1d35f8
SSDEEP

3072:0EbdSQASNKd1HNl3+39Smuw38RP9tW5JZVvvYj7nD:0AdSQA6+HO3VuwsRVYHu3

Score

N/A

Malware Config

Signatures

Files

1fc49c70e834845ce46259a14beddc501e75e449c79d0aa65bdc5efd0b919fef
.exe windows x86

3e825e10c10755a2400abef99b36f2ae

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:49:b5:9d:6d:97:01:f1:2f:2c:6f:86:bd:7b:db:ca
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/08/2013, 00:00

Not After

29/09/2015, 23:59

Subject

CN=Doremi Software CO.\, Ltd.,OU=研发部,O=Doremi Software CO.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:25:fd:2d:1d:16:99:59:70:e5:38:30:55:9c:3a:2f:a2:f7:37:39
Signer

Actual PE Digest

07:25:fd:2d:1d:16:99:59:70:e5:38:30:55:9c:3a:2f:a2:f7:37:39

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Doremi Software CO.\, Ltd.,OU=研发部,O=Doremi Software CO.\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN

08/07/2014, 06:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathW

ffmetadata

avcodec_register_all
avformat_write_header
avcodec_close
av_dump_format
avcodec_open2
av_malloc
av_strerror
av_get_bytes_per_sample
av_free
avpicture_fill
sws_scale
av_rescale_q
swr_init
av_dict_get
avcodec_alloc_frame
av_samples_alloc_array_and_samples
avcodec_get_frame_defaults
avcodec_find_encoder_by_name
av_opt_set_int
av_d2q
avio_open
avformat_alloc_output_context2
av_opt_set_sample_fmt
av_strdup
av_dict_set
av_init_packet
av_interleaved_write_frame
avcodec_find_encoder
avcodec_fill_audio_frame
avcodec_get_context_defaults3
av_samples_get_buffer_size
avcodec_encode_audio2
av_write_trailer
avformat_new_stream
sws_getContext
av_register_all
avio_close
avpicture_get_size
swr_convert
avcodec_encode_video2
ff_dv_codec_profile_check
av_log
av_log_set_callback
av_freep
swr_alloc

kernel32

Sleep
WriteConsoleW
SetStdHandle
LCMapStringW
FlushFileBuffers
HeapReAlloc
GetConsoleMode
GetConsoleCP
RtlUnwind
HeapSize
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
RaiseException
IsProcessorFeaturePresent
HeapCreate
MultiByteToWideChar
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
GetFileType
SetHandleCount
GetModuleFileNameW
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
LoadLibraryW
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
WaitForSingleObject
SetEvent
InterlockedExchangeAdd
GetLocaleInfoA
MapViewOfFile
GetLastError
CloseHandle
CreateDirectoryW
WriteFile
CreateFileW
GetLocalTime
lstrcatW
DeleteFileW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e825e10c10755a2400abef99b36f2ae

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

19:49:b5:9d:6d:97:01:f1:2f:2c:6f:86:bd:7b:db:caCertificate

Extended Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:25:fd:2d:1d:16:99:59:70:e5:38:30:55:9c:3a:2f:a2:f7:37:39Signer

Signature Validations

Verification

08/07/2014, 06:37 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shell32

ffmetadata

kernel32

Sections

.text Size: 113KB - Virtual size: 113KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 9KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

19:49:b5:9d:6d:97:01:f1:2f:2c:6f:86:bd:7b:db:ca
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:25:fd:2d:1d:16:99:59:70:e5:38:30:55:9c:3a:2f:a2:f7:37:39
Signer

08/07/2014, 06:37
Valid: false

.text
Size: 113KB - Virtual size: 113KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 9KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB