General

Malware Config

Signatures

Files

• 3bb7c68fe66fe431c4a3d486bebbca02671c29b84e26082e57a0e8c42c5cfe04

  .exe windows x86

  6c0c957f7e8cb96552b5945210ae1cba

  
  

  Code Sign

  1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

  Certificate

  Issuer

  OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

  Not Before

  08-11-2006 00:00

  Not After

  07-11-2021 23:59

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1e:b0:f4:d8:21:e2:39:ba:81:b3:d1:0e:61:b7:61:5b

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  30-05-2014 00:00

  Not After

  30-05-2015 23:59

  Subject

  CN=Guangxi Nanning Shengtai'an E-Business Development CO.LTD,O=Guangxi Nanning Shengtai'an E-Business Development CO.LTD,L=Guangxi,ST=Nanning,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  c1:91:bd:6b:7e:84:bc:f1:52:4d:7c:73:d4:05:77:c4:e8:2a:8d:ea

  Signer

  Actual PE Digest

  c1:91:bd:6b:7e:84:bc:f1:52:4d:7c:73:d4:05:77:c4:e8:2a:8d:ea

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Guangxi Nanning Shengtai'an E-Business Development CO.LTD,O=Guangxi Nanning Shengtai'an E-Business Development CO.LTD,L=Guangxi,ST=Nanning,C=CN

  17-11-2022 13:13

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  Process32First

  GetLastError

  Process32Next

  CreateMutexA

  CreateToolhelp32Snapshot

  GetVolumeInformationA

  DeviceIoControl

  GetVersionExA

  GetFileAttributesA

  GetProcAddress

  GetSystemInfo

  OutputDebugStringA

  WinExec

  lstrlenA

  DosDateTimeToFileTime

  SetFilePointer

  SystemTimeToFileTime

  SetFileTime

  ReadFile

  GetFileType

  GetCurrentDirectoryW

  GetFullPathNameA

  GetDriveTypeW

  lstrcmpA

  CreateFileW

  WriteConsoleW

  SetStdHandle

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  HeapSize

  GetStringTypeW

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  SetHandleCount

  IsValidCodePage

  GetOEMCP

  LoadLibraryW

  InitializeCriticalSectionAndSpinCount

  HeapCreate

  IsProcessorFeaturePresent

  GetLocaleInfoW

  WriteFile

  CreateFileA

  GetACP

  WideCharToMultiByte

  MultiByteToWideChar

  LockResource

  SizeofResource

  LoadResource

  FreeResource

  FindResourceA

  TerminateThread

  DeleteFileA

  CloseHandle

  GetModuleHandleA

  GetModuleFileNameA

  WritePrivateProfileStringA

  GetLocalTime

  GetPrivateProfileStringA

  SetFileAttributesA

  CreateDirectoryA

  TerminateProcess

  Sleep

  OpenProcess

  GetCurrentProcess

  IsDBCSLeadByteEx

  GetModuleFileNameW

  GetStdHandle

  SetLastError

  TlsFree

  TlsSetValue

  TlsGetValue

  InterlockedIncrement

  TlsAlloc

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  LCMapStringW

  RtlUnwind

  GetCPInfo

  RaiseException

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineA

  MoveFileA

  HeapReAlloc

  HeapAlloc

  ExitProcess

  GetModuleHandleW

  HeapFree

  CreateThread

  GetCurrentThreadId

  ExitThread

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  DecodePointer

  EncodePointer

  InterlockedExchange

  InterlockedDecrement

  user32

  SetWindowPos

  GetDlgItem

  CreateWindowExA

  MessageBoxA

  TranslateMessage

  SendMessageA

  GetClientRect

  SendDlgItemMessageA

  PostQuitMessage

  ShowWindow

  GetMessageA

  DestroyWindow

  EndPaint

  wvsprintfA

  PostMessageA

  EnableWindow

  SetDlgItemTextA

  GetDlgItemTextA

  DispatchMessageA

  GetSystemMetrics

  LoadImageA

  CreateDialogParamA

  IsDlgButtonChecked

  BeginPaint

  gdi32

  CreateFontA

  advapi32

  OpenProcessToken

  OpenSCManagerA

  StartServiceA

  CreateServiceA

  CloseServiceHandle

  RegCloseKey

  AdjustTokenPrivileges

  RegOpenKeyExA

  RegCreateKeyExA

  LookupPrivilegeValueA

  RegQueryValueExA

  RegSetValueExA

  shell32

  ShellExecuteA

  SHGetSpecialFolderLocation

  SHCreateDirectoryExA

  SHBrowseForFolderA

  SHGetPathFromIDListA

  ole32

  CoInitialize

  CoTaskMemFree

  CoCreateInstance

  gdiplus

  GdipFillRectangleI

  GdipDrawLineI

  GdipCreateFromHDC

  GdiplusStartup

  GdipCreateFontFamilyFromName

  GdipDrawString

  GdipCreateFont

  GdipCreateSolidFill

  GdipDeleteFontFamily

  GdipDeleteGraphics

  GdipDeleteFont

  GdipDeletePen

  GdipDeleteBrush

  GdipCreatePen1

  wininet

  HttpOpenRequestA

  InternetConnectA

  InternetCloseHandle

  InternetOpenA

  InternetReadFile

  InternetOpenUrlA

  HttpQueryInfoA

  HttpSendRequestA

  shlwapi

  UrlGetPartA

  PathFileExistsA

  PathStripPathA

  PathRemoveBackslashA

  netapi32

  Netbios

  sensapi

  IsNetworkAlive

  psapi

  EnumProcesses

  EnumProcessModules

  GetModuleFileNameExA

  version

  VerQueryValueA

  GetFileVersionInfoA

  GetFileVersionInfoSizeA

  iphlpapi

  GetAdaptersInfo

  Sections

  .text

  Size: 222KB - Virtual size: 221KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 48KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4.0MB - Virtual size: 4.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 25KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ