e0fa9f34b89e6f7db93aae638bcd89f61134756dcf57cc77503b1016fb7e3322

Sharing

Copy URL Twitter E-mail

General

Target

e0fa9f34b89e6f7db93aae638bcd89f61134756dcf57cc77503b1016fb7e3322
Size

354KB
MD5

324e44e4f0e91062720b00afc3a3c793
SHA1

82cab7a4b78394a3750a2b87d5bf6e920fdc31b7
SHA256

e0fa9f34b89e6f7db93aae638bcd89f61134756dcf57cc77503b1016fb7e3322
SHA512

ed90aa1e0b58c250ff73cb25c8ed2053bda8de69eccfb17bf5f239a6acad2e0e58546f175737c2d1f4508d5187b3ffe0b29e6618c8ef8e0d99e1aa590ff21aa4
SSDEEP

6144:DBmL10IepiB8Q4oHYblllQ7UrlUHQCJwF7tAM0tpRqprHWe9bxcUqUR5X:DB010Iep7bllOcqHQCaF7tAM0tGpXxm6

Score

N/A

Malware Config

Signatures

Files

e0fa9f34b89e6f7db93aae638bcd89f61134756dcf57cc77503b1016fb7e3322
.dll windows x86

bbbe3af8452aea89f91ade974a832282

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3d:1f:27:dd:94:d5:6a:0e:f3:c3:3b:e9:37:cf:f1:ec
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/09/2013, 00:00

Not After

03/10/2015, 23:59

Subject

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=value added,O=shanghai xin hao yi software Co.\, Ltd,L=shanghai,ST=shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:e5:df:c9:05:ea:96:61:4f:9e:76:6b:54:b4:02:1b:f1:da:b2:ec
Signer

Actual PE Digest

99:e5:df:c9:05:ea:96:61:4f:9e:76:6b:54:b4:02:1b:f1:da:b2:ec

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=value added,O=shanghai xin hao yi software Co.\, Ltd,L=shanghai,ST=shanghai,C=CN

25/06/2014, 10:12
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetLocalTime
GetTimeZoneInformation
ExitThread
CreateThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
HeapReAlloc
GetSystemTimeAsFileTime
CreateDirectoryA
HeapSize
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
ExitProcess
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
RtlUnwind
GetFileTime
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
InterlockedDecrement
SetLastError
MulDiv
FormatMessageA
SuspendThread
ResumeThread
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
lstrcpynA
GlobalLock
CreateNamedPipeA
CreatePipe
ConnectNamedPipe
DisconnectNamedPipe
FreeResource
TerminateProcess
GlobalUnlock
RaiseException
AreFileApisANSI
FindFirstFileA
FindClose
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
LocalAlloc
lstrcmpA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
GetFileAttributesA
GetComputerNameA
GlobalAlloc
GlobalFree
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OpenFileMappingA
OutputDebugStringA
GetCurrentProcess
GetTickCount
WriteFile
FindResourceA
LoadResource
LockResource
SizeofResource
CompareStringW
CompareStringA
lstrlenW
GetVersion
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
Sleep
lstrcpyA
WaitForSingleObject
TerminateThread
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
CreateEventA
SetEvent
GetModuleFileNameA
DeleteFileA
GetSystemDirectoryA
lstrcatA
lstrlenA
CreateFileMappingA
GetLastError
MapViewOfFile
lstrcmpiA
CreateFileA
GetFileSize
ReadFile
UnmapViewOfFile
SetHandleCount
CloseHandle

user32

GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowTextA
IsDialogMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
wsprintfA
TabbedTextOutA
DrawTextA
DrawTextExA
SetPropA
GetPropA
GrayStringA
SendDlgItemMessageA
GetFocus
SetFocus
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
LoadIconA
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
SetForegroundWindow
UpdateWindow
GetClientRect
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
GetDlgCtrlID
ClientToScreen
GetDC
ReleaseDC
BeginPaint
EndPaint
GetSysColorBrush
DefWindowProcA
CallWindowProcA
LoadCursorA
DestroyMenu
RemovePropA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
SetLastErrorEx
UnregisterClassA
IsWindowVisible
ShowWindow
SendMessageA
RegisterWindowMessageA
GetClassNameA
PostThreadMessageA
CharUpperA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
UnhookWindowsHookEx

gdi32

TextOutA
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
RectVisible
PtVisible
DeleteObject
GetClipBox
SetTextColor
SetBkColor
GetObjectA
CreateBitmap
GetDeviceCaps
SaveDC
RestoreDC
SetMapMode
ExtTextOutA

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryValueA
RegEnumKeyA
CryptDecrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
RegEnumKeyExA
RegOpenKeyA
GetUserNameA
RegCloseKey

comctl32

ord17

shlwapi

PathIsUNCA
PathFileExistsA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
StrStrIA

ole32

CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantChangeType
VariantInit

urlmon

URLDownloadToFileA

crypt32

CryptQueryObject
CryptMsgGetParam
CertCloseStore
CertGetNameStringA
CryptMsgClose
CertFindCertificateInStore
CertCreateContext
CertOpenStore
CertFreeCertificateContext
CertAddCertificateContextToStore

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

wininet

InternetSetOptionA
InternetCloseHandle
HttpOpenRequestA
InternetQueryOptionA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetOpenA
InternetConnectA

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExA

ws2_32

recvfrom
sendto
bind
htons
setsockopt
inet_ntoa
socket
gethostbyname
WSAGetLastError
select
inet_addr
connect
ioctlsocket
send
shutdown
htonl
closesocket

Exports

Exports

CommMgerc
Mgerae
Mgerck
Mgercx
Mgerda
ck0
cx0
cx1
cx2
cx3

Sections

.text
Size: 240KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbbe3af8452aea89f91ade974a832282

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3d:1f:27:dd:94:d5:6a:0e:f3:c3:3b:e9:37:cf:f1:ecCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

99:e5:df:c9:05:ea:96:61:4f:9e:76:6b:54:b4:02:1b:f1:da:b2:ecSigner

Signature Validations

Verification

25/06/2014, 10:12 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

ole32

oleaut32

urlmon

crypt32

wtsapi32

wininet

iphlpapi

version

wintrust

psapi

ws2_32

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 238KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 12KB - Virtual size: 36KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 28KB - Virtual size: 25KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3d:1f:27:dd:94:d5:6a:0e:f3:c3:3b:e9:37:cf:f1:ec
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

99:e5:df:c9:05:ea:96:61:4f:9e:76:6b:54:b4:02:1b:f1:da:b2:ec
Signer

25/06/2014, 10:12
Valid: false

.text
Size: 240KB - Virtual size: 238KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 12KB - Virtual size: 36KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 28KB - Virtual size: 25KB