General

Malware Config

Signatures

Files

• 0ea8e2e648a6a4d1df10efc933866ab260f2d646ea16a758bb6b734d275f5f2d

  .exe windows x86

  
  

  Code Sign

  46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2f:10:b9:7b:e7:9d:fe:3f:a7:cd:42:c9:fc:23:1c:c2

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

  Not Before

  30-03-2015 05:01

  Not After

  30-03-2016 06:01

  Subject

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  01-03-2011 01:00

  Not After

  01-03-2016 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  85:50:08:08:13:9f:e2:74:81:0e:59:05:86:29:9d:22:7b:69:26:79

  Signer

  Actual PE Digest

  85:50:08:08:13:9f:e2:74:81:0e:59:05:86:29:9d:22:7b:69:26:79

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=深圳易博万隆科技有限公司,O=深圳易博万隆科技有限公司,L=深圳市,ST=广东省,C=CN

  17-11-2022 13:20

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 326KB - Virtual size: 326KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 7KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ