31f625e40d6e0476231ffaf4e01bbb432202de75d93bb517b247d6dbb5103f01

Sharing

Copy URL

Twitter E-mail

General

Target

31f625e40d6e0476231ffaf4e01bbb432202de75d93bb517b247d6dbb5103f01
Size

62KB
MD5

3daa3698fe53ed03fa5f95ebbc190e47
SHA1

86781d29d01574e4e28097589e7ec52219fa8050
SHA256

31f625e40d6e0476231ffaf4e01bbb432202de75d93bb517b247d6dbb5103f01
SHA512

a28cbbc6c12110d365ed119c86d674a6eb5a611fbd9228890d7fc3b57f869d38b1a10babb03e57f28726cfb5ac159d577cb8aa8d022a6629add12ee6f9df7e8d
SSDEEP

768:nmc/cCCcd9DQDOA0BNucA+MZvMtcv9Jv+t+lrgiR:MCn8DOA0BNuZRJvqQrh

Score

N/A

Malware Config

Signatures

Files

31f625e40d6e0476231ffaf4e01bbb432202de75d93bb517b247d6dbb5103f01
.dll windows x86

b4612a3d41538a9b7a31712d565dc1bc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/07/2011, 00:00

Not After

05/09/2013, 23:59

Subject

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=shanghai xin hao yi software Co.\, Ltd,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:dd:fb:89:ad:e6:93:0e:11:18:91:61:f6:0f:0a:8c:b3:a5:18:b9
Signer

Actual PE Digest

c1:dd:fb:89:ad:e6:93:0e:11:18:91:61:f6:0f:0a:8c:b3:a5:18:b9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=shanghai xin hao yi software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=shanghai xin hao yi software Co.\, Ltd,L=上海,ST=上海,C=CN

08/05/2013, 07:15
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc71

ord1177
ord1209
ord1084
ord1092
ord1167
ord1201
ord1175
ord1120
ord371
ord1098
ord1208
ord1206
ord1037
ord315
ord765
ord764
ord265
ord310
ord578
ord876
ord907
ord581
ord304
ord762
ord784
ord2468
ord781
ord3683
ord4038
ord4014
ord6278
ord3801
ord6276
ord4081
ord2833
ord1035
ord2272
ord5491
ord6168
ord2249
ord759
ord570
ord5567
ord4569
ord5227
ord3595
ord1486
ord2322
ord911
ord331
ord2141
ord590
ord3428
ord3635
ord3602
ord3609
ord1025
ord314
ord2248
ord757
ord566
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326

msvcr71

_vsnprintf
fclose
fputs
fwrite
fopen
_except_handler3
_strdate
_stricmp
_strtime
_tzset
strrchr
_mbschr
realloc
strchr
??1exception@@UAE@XZ
strncpy
malloc
sprintf
_CxxThrowException
memset
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
__CppXcptFilter
__security_error_handler
free
__CxxFrameHandler
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
LocalAlloc
LocalFree
GetTempPathA
GetFileSize
ReadFile
WriteFile
GetWindowsDirectoryA
DeleteFileA
FreeLibrary
GetTickCount
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
LoadLibraryA
Process32First
Process32Next
CreateToolhelp32Snapshot
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
GetCurrentProcess
WritePrivateProfileStringA
lstrcpyA
GetFileAttributesA
CreateFileA
TerminateThread
ResumeThread
GetSystemDirectoryA
WaitForSingleObject
CloseHandle
lstrlenA
lstrlenW
lstrcmpiA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

PostQuitMessage
PostThreadMessageA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

ole32

CoUninitialize
CoInitialize

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

msvcp71

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

start
stop

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4612a3d41538a9b7a31712d565dc1bc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4bCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c1:dd:fb:89:ad:e6:93:0e:11:18:91:61:f6:0f:0a:8c:b3:a5:18:b9Signer

Signature Validations

Verification

08/05/2013, 07:15 Valid: false

Headers

File Characteristics

Imports

mfc71

msvcr71

kernel32

user32

advapi32

ole32

oleaut32

msvcp71

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 784B

.reloc Size: 12KB - Virtual size: 8KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

68:78:c7:d3:95:19:2f:06:7c:7f:d0:81:52:c8:82:4b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c1:dd:fb:89:ad:e6:93:0e:11:18:91:61:f6:0f:0a:8c:b3:a5:18:b9
Signer

08/05/2013, 07:15
Valid: false

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 784B

.reloc
Size: 12KB - Virtual size: 8KB