General

Malware Config

Signatures

Files

• 86410648ca0cf27bbf6980cf8eedc6bde2af72fbef12276ae66eb39c23eec603

  .exe windows x86

  6b32d61103abc44abecd1ed95fad6a4d

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  11:83:ef:09:6f:14:d7:bc:f9:f0:69:9c:ea:15:6b:7f

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  22-02-2012 00:00

  Not After

  21-02-2015 23:59

  Subject

  CN=Beijing Baofeng Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  76:73:3c:e6:22:58:c2:24:aa:cf:02:3b:5c:41:fd:f1:bc:e2:08:0d

  Signer

  Actual PE Digest

  76:73:3c:e6:22:58:c2:24:aa:cf:02:3b:5c:41:fd:f1:bc:e2:08:0d

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Beijing Baofeng Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

  24-02-2014 18:22

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetThreadPriority

  GetCurrentThread

  GetCurrentProcess

  SetPriorityClass

  ExitProcess

  GetTickCount

  CloseHandle

  ReleaseMutex

  OpenMutexA

  lstrlenA

  lstrcpynA

  OutputDebugStringA

  WaitForSingleObject

  SetFilePointer

  WriteFile

  CreateFileA

  LockResource

  LoadResource

  CreateThread

  EnumResourceNamesA

  EndUpdateResourceA

  UpdateResourceA

  BeginUpdateResourceA

  GlobalFree

  ReadFile

  GlobalAlloc

  GetFileSize

  GetFileAttributesA

  GetModuleHandleA

  GetLastError

  GlobalMemoryStatusEx

  GetSystemInfo

  lstrcpyA

  GetSystemDefaultUILanguage

  CreateProcessA

  TerminateProcess

  ExitThread

  lstrcmpA

  GetLocalTime

  WinExec

  Sleep

  LoadLibraryA

  FindResourceA

  GetProcAddress

  GetStartupInfoA

  user32

  GetDesktopWindow

  wsprintfA

  advapi32

  RegOpenKeyExA

  OpenSCManagerA

  OpenServiceA

  CloseServiceHandle

  DeleteService

  StartServiceCtrlDispatcherA

  shell32

  ShellExecuteA

  ShellExecuteExA

  SHChangeNotify

  ws2_32

  send

  select

  WSACleanup

  recv

  setsockopt

  WSAIoctl

  inet_ntoa

  connect

  WSAStartup

  htonl

  __WSAFDIsSet

  socket

  inet_addr

  sendto

  closesocket

  htons

  shlwapi

  SHDeleteKeyA

  iphlpapi

  GetAdaptersInfo

  GetIfTable

  msvcrt

  _XcptFilter

  ??2@YAPAXI@Z

  ??3@YAXPAX@Z

  _except_handler3

  _onexit

  __dllonexit

  _controlfp

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  _acmdln

  free

  _exit

  realloc

  malloc

  sprintf

  atoi

  strncpy

  strcspn

  strstr

  localtime

  time

  exit

  strncmp

  Sections

  .text

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ