General

Malware Config

Signatures

Files

• d041074ebaeadd95fd85e146a7779690eb21dde3ab55ef742b924fafefdcddc4

  .exe windows x86

  
  

  Code Sign

  ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d

  Certificate

  Issuer

  CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

  Not Before

  23-08-2007 00:00

  Not After

  22-08-2008 23:59

  Subject

  CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  25-04-2007 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  ExtKeyUsageClientAuth

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  09-07-1999 18:31

  Not After

  09-07-2019 18:40

  Subject

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  KeyUsageCertSign

  KeyUsageCRLSign

  43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  30-04-2007 00:00

  Not After

  29-04-2012 23:59

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  79:40:22:fb:cd:7f:47:ed:89:45:e3:3a:82:f7:e6:06:c9:4b:dc:45

  Signer

  Actual PE Digest

  79:40:22:fb:cd:7f:47:ed:89:45:e3:3a:82:f7:e6:06:c9:4b:dc:45

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

  17-11-2022 13:16

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tqn

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE