abebbac9ca5e06071a584c3236750a85d0d46a062e722ae47139038f40950970

Sharing

Copy URL

Twitter E-mail

General

Target

abebbac9ca5e06071a584c3236750a85d0d46a062e722ae47139038f40950970
Size

267KB
MD5

8a70b816529c1034901f1544463361fc
SHA1

c89c72fbce4028509cd86371d2b96ad41c016468
SHA256

abebbac9ca5e06071a584c3236750a85d0d46a062e722ae47139038f40950970
SHA512

fcc8e819161e78a6ca0025a751a0c9166dea214ca2423a42b976d0dbd292d8d09328fc8edefa8590c5c2d459b326b2416fee9977acf458c644d6c4f4f56c3650
SSDEEP

3072:ozHQaAPsIEVgXGetCXEmOUmQm0M0DdgbkKf2+01O0P:oUaEoaxtCc9x0nykT/xP

Score

N/A

Malware Config

Signatures

Files

abebbac9ca5e06071a584c3236750a85d0d46a062e722ae47139038f40950970
.exe windows x86

036eaaf0657cf441f2716db0c59ed77f

Code Sign

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27-03-2019 00:00

Not After

11-04-2020 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26-03-2019 00:00

Not After

11-04-2020 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:6e:1f:67:b1:ff:3b:7b:5f:f2:3d:0c:73:9e:b3:77:9b:dc:6e:5e:27:c3:74:1f:e3:1d:54:be:22:70:60:5f
Signer

Actual PE Digest

68:6e:1f:67:b1:ff:3b:7b:5f:f2:3d:0c:73:9e:b3:77:9b:dc:6e:5e:27:c3:74:1f:e3:1d:54:be:22:70:60:5f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

25-12-2019 07:49
Valid: true

Chain 1

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

40:e7:f3:0a:5c:ad:c1:14:44:45:da:9e:95:cd:41:ad:3c:94:c2:66
Signer

Actual PE Digest

40:e7:f3:0a:5c:ad:c1:14:44:45:da:9e:95:cd:41:ad:3c:94:c2:66

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

25-12-2019 07:49
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ws_batchconv

CreateLossFileConverter
ReleaseLossFileConverter

ws_log

ord360
ord2
ord50

comsupport

ord1
ord2

kernel32

FlushFileBuffers
WriteConsoleW
SetStdHandle
OutputDebugStringW
SetFilePointerEx
ReadFile
GetConsoleCP
GetStringTypeW
ReadConsoleW
GetConsoleMode
EncodePointer
QueryPerformanceCounter
WaitForSingleObject
SetEvent
OpenProcess
GetModuleFileNameW
CreateEventW
WaitForMultipleObjects
QueryPerformanceFrequency
CloseHandle
GetCurrentProcessId
GetModuleHandleW
Sleep
MapViewOfFile
UnmapViewOfFile
VirtualQuery
WideCharToMultiByte
OpenMutexW
GetLastError
GetProcAddress
OpenFileMappingW
OpenEventW
ReleaseMutex
LCMapStringW
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcess
CreateFileW
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
HeapSize
SetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
HeapAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
WriteFile
GetSystemTimeAsFileTime

user32

PostMessageW
TranslateMessage
GetMessageW
DispatchMessageW

ole32

CoInitialize

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

036eaaf0657cf441f2716db0c59ed77f

Code Sign

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

68:6e:1f:67:b1:ff:3b:7b:5f:f2:3d:0c:73:9e:b3:77:9b:dc:6e:5e:27:c3:74:1f:e3:1d:54:be:22:70:60:5fSigner

Signature Validations

Verification

25-12-2019 07:49 Valid: true

Chain 1

40:e7:f3:0a:5c:ad:c1:14:44:45:da:9e:95:cd:41:ad:3c:94:c2:66Signer

Signature Validations

Verification

25-12-2019 07:49 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ws_batchconv

ws_log

comsupport

kernel32

user32

ole32

Sections

.text Size: 90KB - Virtual size: 89KB

.rdata Size: 31KB - Virtual size: 30KB

.data Size: 5KB - Virtual size: 15KB

.rsrc Size: 127KB - Virtual size: 126KB

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

68:6e:1f:67:b1:ff:3b:7b:5f:f2:3d:0c:73:9e:b3:77:9b:dc:6e:5e:27:c3:74:1f:e3:1d:54:be:22:70:60:5f
Signer

25-12-2019 07:49
Valid: true

40:e7:f3:0a:5c:ad:c1:14:44:45:da:9e:95:cd:41:ad:3c:94:c2:66
Signer

25-12-2019 07:49
Valid: false

.text
Size: 90KB - Virtual size: 89KB

.rdata
Size: 31KB - Virtual size: 30KB

.data
Size: 5KB - Virtual size: 15KB

.rsrc
Size: 127KB - Virtual size: 126KB