54827e55704dd1551b5d13fd6404913d2dc229d9316ca995538f39cab60b3198

Sharing

Copy URL Twitter E-mail

General

Target

54827e55704dd1551b5d13fd6404913d2dc229d9316ca995538f39cab60b3198
Size

454KB
MD5

2921cf2c9341fd87d01177af3db7d9fc
SHA1

5e4790ca4d0f617aad39fd247687087689afa791
SHA256

54827e55704dd1551b5d13fd6404913d2dc229d9316ca995538f39cab60b3198
SHA512

891b31fd62faa91c4b1d53d179a6d2ef6c3f5c564eaeaf26ef4366234775299454f6f46c7c611d9f8833ce8daa1d7589491b1d94ea7da8d7f87ba95de66322be
SSDEEP

6144:9rNJONfNjXk6gW3v1yQYg1ktw1cmH7BnE6V2deXqOga2NOLKib:9ZJON269yqktw1cm/Ke6xNCxb

Score

N/A

Malware Config

Signatures

Files

54827e55704dd1551b5d13fd6404913d2dc229d9316ca995538f39cab60b3198
.dll windows x86

9a3f76ee2d93cc85c8c4ccbc615eceda

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/07/2011, 00:00

Not After

05/09/2013, 23:59

Subject

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=shanghai xin hao yi software Co.\, Ltd,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3b:87:9b:7e:10:ea:bd:32:97:cc:37:a2:0d:ae:c8:76:42:bd:67:09
Signer

Actual PE Digest

3b:87:9b:7e:10:ea:bd:32:97:cc:37:a2:0d:ae:c8:76:42:bd:67:09

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=shanghai xin hao yi software Co.\, Ltd,L=上海,ST=上海,C=CN

09/05/2013, 10:31
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

connect
select
htons
WSAGetLastError
WSAStartup
inet_ntoa
closesocket
recv
gethostbyname
gethostname
WSACleanup
inet_addr
send

wininet

InternetQueryOptionA

kernel32

LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
LocalAlloc
InterlockedDecrement
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
FlushFileBuffers
InterlockedIncrement
GlobalFlags
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
RtlUnwind
GetSystemTimeAsFileTime
IsBadReadPtr
VirtualProtect
VirtualAlloc
GetSystemInfo
ExitThread
GetTimeZoneInformation
GetCommandLineA
HeapReAlloc
ExitProcess
SetStdHandle
GetFileType
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeA
IsBadCodePtr
SetEnvironmentVariableA
SetFilePointer
GetFileTime
SetFileTime
LocalFileTimeToFileTime
lstrcpyA
FindNextFileA
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcatA
lstrcmpW
GetModuleHandleA
GlobalLock
FormatMessageA
lstrcpynA
FileTimeToLocalFileTime
GetFileSize
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
GlobalAlloc
TerminateProcess
GlobalUnlock
GlobalFree
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
WritePrivateProfileStringA
LeaveCriticalSection
EnterCriticalSection
GetTempPathA
CreateDirectoryA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
OutputDebugStringA
GetStartupInfoA
VirtualQuery
CopyFileA
GetCurrentProcessId
WaitForSingleObjectEx
SetEvent
GetCurrentThreadId
FindFirstFileA
FindClose
CreateThread
LoadLibraryA
GetProcAddress
FreeLibrary
CreateEventA
WaitForSingleObject
ResetEvent
CompareStringW
CompareStringA
lstrlenW
lstrcmpiA
GetVersion
MultiByteToWideChar
GetSystemDirectoryA
CreateFileA
ReadFile
CloseHandle
GetFileAttributesA
WriteFile
GetTickCount
DeleteFileA
Sleep
SetFileAttributesA
GetModuleFileNameA
GetComputerNameA
GetProcessHeap
HeapAlloc
HeapFree
DeviceIoControl
GetLastError
SetLastError
LocalFree
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenA
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetErrorMode

user32

EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
IsWindowEnabled
SetWindowTextA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
GetFocus
GetLastActivePopup
DispatchMessageA
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetKeyState
SetForegroundWindow
GetClientRect
GetMenu
GetSysColor
PostQuitMessage
GetParent
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
PtInRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetLastErrorEx
ShowWindow
SendMessageA
LoadIconA
DestroyWindow
GetThreadDesktop
CreateDesktopA
OpenInputDesktop
MessageBoxA
GetDC
ReleaseDC
CloseDesktop
SwitchDesktop
SetThreadDesktop
GetWindowLongA
GetWindow
GetWindowTextA
FindWindowExA
PeekMessageA
InvalidateRect
wsprintfW
GetDesktopWindow
GetForegroundWindow
GetSystemMetrics
GetWindowRect
GetClassNameA
GetShellWindow
GetWindowThreadProcessId
PostThreadMessageA
GetMessageA
CharUpperA
UnhookWindowsHookEx
IsWindowVisible
EnableWindow
UnregisterClassA
SetCursor
ValidateRect
GetCursorPos
GetActiveWindow
TranslateMessage
GetSysColorBrush
LoadCursorA
FindWindowA
IsWindow
DestroyMenu
AdjustWindowRectEx
KillTimer
SetTimer
PostMessageA
SetWindowPos

gdi32

GetStockObject
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
SetMapMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleDC
PtVisible

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueA
RegEnumKeyA
CryptDecrypt
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
RegEnumKeyExA
RegDeleteKeyA
RegSetValueA
RegDeleteValueA
OpenSCManagerA
CreateServiceA
FreeSid
OpenServiceA
StartServiceA
CloseServiceHandle
RegQueryInfoKeyA
GetUserNameA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
GetLengthSid
InitializeAcl
AddAccessAllowedAce
RegSetKeySecurity
RegOpenCurrentUser
RegOpenKeyExA
RegCloseKey
RegSetValueExA
AllocateAndInitializeSid
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityA

shell32

SHGetSpecialFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
SHChangeNotify

comctl32

ord17

shlwapi

SHDeleteKeyA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA
SHDeleteValueA

ole32

StringFromCLSID
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoInitialize
CoRegisterMessageFilter
CoCreateInstance

oleaut32

VariantClear
VariantChangeType
VariantInit

urlmon

URLDownloadToFileA

wsock32

recvfrom
sendto
accept

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

start
stop

Sections

.text
Size: 256KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.inidata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a3f76ee2d93cc85c8c4ccbc615eceda

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4bCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3b:87:9b:7e:10:ea:bd:32:97:cc:37:a2:0d:ae:c8:76:42:bd:67:09Signer

Signature Validations

Verification

09/05/2013, 10:31 Valid: false

Headers

File Characteristics

Imports

ws2_32

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

urlmon

wsock32

iphlpapi

version

Exports

Exports

Sections

.text Size: 256KB - Virtual size: 253KB

.rdata Size: 56KB - Virtual size: 53KB

.data Size: 44KB - Virtual size: 61KB

.inidata Size: 44KB - Virtual size: 40KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 36KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3b:87:9b:7e:10:ea:bd:32:97:cc:37:a2:0d:ae:c8:76:42:bd:67:09
Signer

09/05/2013, 10:31
Valid: false

.text
Size: 256KB - Virtual size: 253KB

.rdata
Size: 56KB - Virtual size: 53KB

.data
Size: 44KB - Virtual size: 61KB

.inidata
Size: 44KB - Virtual size: 40KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 36KB - Virtual size: 32KB