c85724ed9c07c565436f508e6418850bef81ae1172f24f352abec1c357ee4218

Sharing

Copy URL Twitter E-mail

General

Target

c85724ed9c07c565436f508e6418850bef81ae1172f24f352abec1c357ee4218
Size

9.0MB
MD5

873c1016d7835885e48178e9619b7dec
SHA1

d70608250dd58bd77fa0b9c457c8068a999fb9da
SHA256

c85724ed9c07c565436f508e6418850bef81ae1172f24f352abec1c357ee4218
SHA512

5343ca492832bc3d97b954431e953b5ac77f901bfbb132d836b7ba4c3fca095825e5e90647adb101679d575787148abf7ee6af5693449476299a8767a2da7911
SSDEEP

196608:ZjKTxSRnOW3B5XBZRv99jIi9nOBGvZP0lfYOuNde7g+exFmiqkbu2KhtqG:AxSRnFzZ1h9nHvZMlfYasynkb0htB

Score

N/A

Malware Config

Signatures

Files

c85724ed9c07c565436f508e6418850bef81ae1172f24f352abec1c357ee4218
.exe windows x86

e1c969a06a98711adcdc967adeb8f05e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

60:8e:07:6c:00:4f:23:b5:4c:b0:ee:05:0d:12:52:46
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

30/12/2014, 03:10

Not After

30/12/2015, 03:10

Subject

CN=上海游讯信息科技有限公司,O=上海游讯信息科技有限公司,L=上海市,ST=上海市,C=CN,1.2.840.113549.1.9.1=#0c0f67616d65407978646f776e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

af:a2:02:5c:c3:ba:7c:ca:c9:07:f0:6e:86:c1:d5:2e:3a:74:8f:9e
Signer

Actual PE Digest

af:a2:02:5c:c3:ba:7c:ca:c9:07:f0:6e:86:c1:d5:2e:3a:74:8f:9e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=上海游讯信息科技有限公司,O=上海游讯信息科技有限公司,L=上海市,ST=上海市,C=CN,1.2.840.113549.1.9.1=#0c0f67616d65407978646f776e2e636f6d

28/05/2015, 05:54
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetOpenUrlW
InternetQueryDataAvailable
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
DeleteUrlCacheEntryW
InternetConnectW
GetUrlCacheEntryInfoW
InternetReadFile
InternetOpenW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetCrackUrlW

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

GetVersionExA
LoadLibraryA
CompareStringW
GlobalFindAtomW
GetModuleHandleA
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetVolumeInformationW
GetFullPathNameW
GetFileSizeEx
GetFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
SetErrorMode
GetStartupInfoW
HeapFree
HeapAlloc
UnhandledExceptionFilter
GlobalAddAtomW
IsDebuggerPresent
CreateThread
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
SetStdHandle
GetFileType
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FindNextFileW
SetEnvironmentVariableA
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleW
GlobalFree
MulDiv
FormatMessageW
LocalFree
LocalAlloc
SetLastError
FileTimeToLocalFileTime
ExitThread
CreateEventW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
GetCurrentThreadId
FileTimeToSystemTime
UnmapViewOfFile
GetFileSize
InterlockedDecrement
InterlockedIncrement
FreeLibrary
LocalFileTimeToFileTime
GetCurrentDirectoryW
ReadFile
SetFileTime
SystemTimeToFileTime
SetFilePointer
FindClose
FindFirstFileW
WideCharToMultiByte
GetProcAddress
LoadLibraryW
GetTickCount
lstrlenA
FreeResource
GlobalUnlock
WritePrivateProfileStringW
GlobalAlloc
GlobalLock
SetFileAttributesW
DeleteFileW
CloseHandle
GetDiskFreeSpaceExW
GetShortPathNameW
RemoveDirectoryW
lstrlenW
CreateFileW
TerminateProcess
GetFileAttributesW
GetVersionExW
Sleep
OpenProcess
WriteFile
GetPrivateProfileStringW
WaitForSingleObject
CreateDirectoryW
GetModuleFileNameW
LockResource
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetProcessHeap
SetUnhandledExceptionFilter

user32

EndDialog
CreateDialogIndirectParamW
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
GetMenu
DestroyMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
ShowWindow
MoveWindow
GetDlgCtrlID
ReleaseDC
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
ValidateRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxW
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
SetCursor
ScreenToClient
SetCapture
SetFocus
InvalidateRect
GetWindowLongW
PostThreadMessageW
UnregisterClassW
MessageBeep
GetNextDlgTabItem
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
SetRect
SetWindowLongW
GetCursorPos
GetSysColorBrush
CharNextW
CharUpperW
EndPaint
BeginPaint
OffsetRect
GetWindowDC
ReleaseCapture
CallWindowProcW
DefWindowProcW
PtInRect
SetRectEmpty
CopyRect
IsRectEmpty
GetDesktopWindow
GetSubMenu
SendMessageW
SetWindowRgn
SetTimer
PostMessageW
KillTimer
LoadCursorW
GetClientRect
GetSystemMetrics
EnableWindow
wsprintfW
UpdateWindow
GetDC
ClientToScreen
IsWindow
GrayStringW
RegisterClipboardFormatW

gdi32

RestoreDC
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SaveDC
SetBkColor
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
TextOutW
GetObjectW
RectVisible
PtVisible
SetTextColor
GetClipBox
CreateBitmap
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateRoundRectRgn
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegDeleteKeyW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW

oledlg

OleUIBusyW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
CoTaskMemAlloc
CreateILockBytesOnHGlobal
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
OleCreateFontIndirect
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen

gdiplus

GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipFree
GdipDeleteGraphics
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipCloneImage
GdipDrawImageRectRect
GdipDeleteBrush
GdipDeletePen
GdipCloneBrush
GdipGetImageHeight
GdipSetTextRenderingHint
GdipDeleteFont
GdipSetImageAttributesWrapMode
GdipSetStringFormatAlign
GdipDeleteFontFamily
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipCreateFont
GdipCreateImageAttributes
GdipDrawString
GdipCreateFontFamilyFromName
GdipSetSolidFillColor
GdipFillRectangleI
GdipCreateStringFormat
GdipGetImageWidth
GdipCreatePen1
GdipDeleteStringFormat
GdipDrawRectangleI
GdipGetPathWorldBounds
GdipGetFontStyle
GdipGetFamily
GdipAddPathString
GdipGetFontSize
GdipDeletePath
GdipCreatePath

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

netapi32

Netbios

snmpapi

SnmpUtilOidCpy
SnmpUtilVarBindFree
SnmpUtilOidNCmp

ws2_32

WSAStartup

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1c969a06a98711adcdc967adeb8f05e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

60:8e:07:6c:00:4f:23:b5:4c:b0:ee:05:0d:12:52:46Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

af:a2:02:5c:c3:ba:7c:ca:c9:07:f0:6e:86:c1:d5:2e:3a:74:8f:9eSigner

Signature Validations

Verification

28/05/2015, 05:54 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

iphlpapi

netapi32

snmpapi

ws2_32

Sections

.text Size: 387KB - Virtual size: 387KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 12KB - Virtual size: 28KB

.rsrc Size: 8.4MB - Virtual size: 8.4MB

.reloc Size: 65KB - Virtual size: 64KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

60:8e:07:6c:00:4f:23:b5:4c:b0:ee:05:0d:12:52:46
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

af:a2:02:5c:c3:ba:7c:ca:c9:07:f0:6e:86:c1:d5:2e:3a:74:8f:9e
Signer

28/05/2015, 05:54
Valid: false

.text
Size: 387KB - Virtual size: 387KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 12KB - Virtual size: 28KB

.rsrc
Size: 8.4MB - Virtual size: 8.4MB

.reloc
Size: 65KB - Virtual size: 64KB