32fd084f39a4699ebd7a4b40622d7d5f5b10f33930ec8a1f6902dcfeab25d19f

Sharing

Copy URL

Twitter E-mail

General

Target

32fd084f39a4699ebd7a4b40622d7d5f5b10f33930ec8a1f6902dcfeab25d19f
Size

286KB
MD5

59307a94aaa81347e9574bdabeb6b0e8
SHA1

2e03107fa37440194d324acb33f087caa9a4d94c
SHA256

32fd084f39a4699ebd7a4b40622d7d5f5b10f33930ec8a1f6902dcfeab25d19f
SHA512

030f609cd16cdd8fef64c3c660e4e7dfbb57f6b9d5e891703382cc7b39740e3f163a9f0d3e7e91b9913747332944d5ab6801d04289dcc71850c6dbdeae5394c0
SSDEEP

6144:oj9yD7jntcSNAeZgUNDu5niZOqbwlk7HgTw52jX5qzjQZ:5B9epmDkni3

Score

N/A

Malware Config

Signatures

Files

32fd084f39a4699ebd7a4b40622d7d5f5b10f33930ec8a1f6902dcfeab25d19f
.exe windows x64

f015c411a6648fcf2e2da25b8bf9855d

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30-04-2007 00:00

Not After

29-04-2012 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6b:d0:fa:31:11:e1:60:37:0e:59:8f:35:d2:0a:41:b4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13-09-2010 00:00

Not After

12-11-2011 23:59

Subject

CN=Shenzhen DriveTheLife Software Technology Co.Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen DriveTheLife Software Technology Co.Ltd,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

98:4f:58:15:4c:6b:d0:97:b8:de:3e:ad:4a:72:bb:dc:d1:de:ef:a9
Signer

Actual PE Digest

98:4f:58:15:4c:6b:d0:97:b8:de:3e:ad:4a:72:bb:dc:d1:de:ef:a9

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shenzhen DriveTheLife Software Technology Co.Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Shenzhen DriveTheLife Software Technology Co.Ltd,L=Shenzhen,ST=Guangdong,C=CN

01-09-2011 11:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

MoveFileExA
FreeLibrary
Sleep
GetFileAttributesA
GetSystemDirectoryA
GetLastError
GetProcAddress
GetTempFileNameA
LoadLibraryA
lstrlenA
GetCurrentProcess
LocalAlloc
LocalFree
FormatMessageA
GetWindowsDirectoryA
GetSystemInfo
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
GetModuleFileNameA
DeleteCriticalSection
CopyFileA
CloseHandle
SetFileAttributesA
CreateFileA
GetModuleHandleA
HeapReAlloc
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LCMapStringW
LCMapStringA
SetStdHandle
GetStartupInfoA
SetHandleCount
GetStdHandle
ExitProcess
GetFileType
HeapCreate
HeapSetInformation
FlsAlloc
HeapFree
HeapAlloc
MultiByteToWideChar
ReadFile
SetFilePointer
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCommandLineA
GetProcessHeap
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
GetCPInfo
GetACP
GetOEMCP
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId

setupapi

SetupDiSetDriverInstallParamsA
SetupFindNextLine
SetupGetLineCountA
SetupOpenInfFileA
SetupFindFirstLineA
SetupGetStringFieldA
SetupGetTargetPathA
SetupGetFieldCount
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupCloseInfFile
SetupDiGetINFClassA
SetupDiSetDeviceInstallParamsA
SetupDiBuildDriverInfoList
SetupDiGetSelectedDriverA
SetupDiGetDeviceInstallParamsA
SetupDiGetDriverInstallParamsA
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupDiSetSelectedDevice
SetupDiGetClassDevsA

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�x
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f015c411a6648fcf2e2da25b8bf9855d

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

6b:d0:fa:31:11:e1:60:37:0e:59:8f:35:d2:0a:41:b4Certificate

Extended Key Usages

Key Usages

98:4f:58:15:4c:6b:d0:97:b8:de:3e:ad:4a:72:bb:dc:d1:de:ef:a9Signer

Signature Validations

Verification

01-09-2011 11:08 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

setupapi

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 7KB - Virtual size: 24KB

.pdata Size: 9KB - Virtual size: 9KB

�x Size: 512B - Virtual size: 176B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

6b:d0:fa:31:11:e1:60:37:0e:59:8f:35:d2:0a:41:b4
Certificate

98:4f:58:15:4c:6b:d0:97:b8:de:3e:ad:4a:72:bb:dc:d1:de:ef:a9
Signer

01-09-2011 11:08
Valid: false

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 7KB - Virtual size: 24KB

.pdata
Size: 9KB - Virtual size: 9KB

�x
Size: 512B - Virtual size: 176B