4c43f905d0fcebbddd5c727ba4e983a48baeb2c91f6ebbc2e59cbaeb719eed29

Sharing

Copy URL Twitter E-mail

General

Target

4c43f905d0fcebbddd5c727ba4e983a48baeb2c91f6ebbc2e59cbaeb719eed29
Size

21KB
MD5

f89212a3c7a3dab8a14bea2dfff15e83
SHA1

d80aa95a0b8b490014d67bc6c8891c023f9a64b7
SHA256

4c43f905d0fcebbddd5c727ba4e983a48baeb2c91f6ebbc2e59cbaeb719eed29
SHA512

6ff73e849ec6be3dc3ec6e8c07f8613c3512aa6bceae75e035af0f7cd0ac1a877b6aa677631cf419fbcf9a6e5ceb02d2bc497168c77b739977dc9f35bf538297
SSDEEP

384:kFzAr3ytCT9lJliNBRJmyOtuhSKDNxDP71KIbC4Ih:y4gC5lJlinJmyOtLKxrhbCf

Score

N/A

Malware Config

Signatures

Files

4c43f905d0fcebbddd5c727ba4e983a48baeb2c91f6ebbc2e59cbaeb719eed29
.dll windows x86

4c9bb2f8b665059fd4caced20e348be8

Code Sign

02:3a:64
Certificate

Issuer

CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US

Not Before

18/10/2012, 14:38

Not After

20/05/2022, 14:38

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

19/05/2022, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:6b:e9:8f:73:7a:9c:11:d6:9c:e0:b3:16:69:6e:eb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

22/12/2009, 00:00

Not After

21/12/2012, 23:59

Subject

CN=Duowan Entertainment Information Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Duowan Entertainment Information Technology (Beijing) Co.\, Ltd.,L=beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:02:c9:16:7a:93:45:ee:33:c0:30:96:d6:f3:98:27:49:d9:c8:46
Signer

Actual PE Digest

7f:02:c9:16:7a:93:45:ee:33:c0:30:96:d6:f3:98:27:49:d9:c8:46

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Duowan Entertainment Information Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Duowan Entertainment Information Technology (Beijing) Co.\, Ltd.,L=beijing,ST=Beijing,C=CN

21/12/2012, 08:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
LoadLibraryW
GetProcAddress
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msvcr90

_encoded_null
_decode_pointer
free
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_malloc_crt
_encode_pointer
??_V@YAXPAX@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_initterm
__CxxFrameHandler3

Exports

Exports

CreateDecoder

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c9bb2f8b665059fd4caced20e348be8

Code Sign

02:3a:64Certificate

Extended Key Usages

Key Usages

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:baCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

3e:6b:e9:8f:73:7a:9c:11:d6:9c:e0:b3:16:69:6e:ebCertificate

Extended Key Usages

Key Usages

7f:02:c9:16:7a:93:45:ee:33:c0:30:96:d6:f3:98:27:49:d9:c8:46Signer

Signature Validations

Verification

21/12/2012, 08:37 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp90

version

msvcr90

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 988B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 1KB - Virtual size: 1KB

02:3a:64
Certificate

7e:1f:df:72:99:e8:d2:45:a1:5d:0b:a8:e5:b1:59:ba
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

3e:6b:e9:8f:73:7a:9c:11:d6:9c:e0:b3:16:69:6e:eb
Certificate

7f:02:c9:16:7a:93:45:ee:33:c0:30:96:d6:f3:98:27:49:d9:c8:46
Signer

21/12/2012, 08:37
Valid: false

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 988B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 1KB - Virtual size: 1KB