edf25c5c1d5acd19325051575650a474123287648cefbd91bb1956ddbe12ebe0

Sharing

Copy URL Twitter E-mail

General

Target

edf25c5c1d5acd19325051575650a474123287648cefbd91bb1956ddbe12ebe0
Size

9.3MB
MD5

3fc6a65598d24a7d75437b9e861afaee
SHA1

c5f16285ccec67909a7becce3c9689aa8016e895
SHA256

edf25c5c1d5acd19325051575650a474123287648cefbd91bb1956ddbe12ebe0
SHA512

4f4f5304dd9cf1dd3cc09cdd8d25bf38952d8e0ca885724e5a657175a72ed1a1a3dd591506ebfd75845acf62c520f6e388b0a3aa10cb851e6d6cc741f542b99f
SSDEEP

196608:Ge6KQ4CDYK4p3SPHmtNsg711BmHA7SbF4jbB4spmb1VAYZueo:B65P4p3SPHUNxSA7SRg1s/g

Score

N/A

Malware Config

Signatures

Files

edf25c5c1d5acd19325051575650a474123287648cefbd91bb1956ddbe12ebe0
.exe windows x86

e1c969a06a98711adcdc967adeb8f05e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:b3:64:72:0b:f5:0d:5f:c7:27:e0:de:0c:1b:78:04
Certificate

Issuer

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

12/05/2015, 00:26

Not After

12/05/2016, 01:26

Subject

CN=Dingping Zhang,L=Anqing,ST=Anhui,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:8a:71:87:2b:0c:a1:fa:4c:4b:92:79:77:02:7d:fc:1f:ff:ac:e8
Signer

Actual PE Digest

1e:8a:71:87:2b:0c:a1:fa:4c:4b:92:79:77:02:7d:fc:1f:ff:ac:e8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Dingping Zhang,L=Anqing,ST=Anhui,C=CN

15/05/2015, 07:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetOpenUrlW
InternetQueryDataAvailable
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
DeleteUrlCacheEntryW
InternetConnectW
GetUrlCacheEntryInfoW
InternetReadFile
InternetOpenW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle
InternetCrackUrlW

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

GetVersionExA
LoadLibraryA
CompareStringW
GlobalFindAtomW
GetModuleHandleA
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
GetVolumeInformationW
GetFullPathNameW
GetFileSizeEx
GetFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
SetErrorMode
GetStartupInfoW
HeapFree
HeapAlloc
UnhandledExceptionFilter
GlobalAddAtomW
IsDebuggerPresent
CreateThread
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
SetStdHandle
GetFileType
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
GetCurrentDirectoryA
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FindNextFileW
SetEnvironmentVariableA
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleW
GlobalFree
MulDiv
FormatMessageW
LocalFree
LocalAlloc
SetLastError
FileTimeToLocalFileTime
ExitThread
CreateEventW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ResumeThread
GetCurrentThreadId
FileTimeToSystemTime
UnmapViewOfFile
GetFileSize
InterlockedDecrement
InterlockedIncrement
FreeLibrary
LocalFileTimeToFileTime
GetCurrentDirectoryW
ReadFile
SetFileTime
SystemTimeToFileTime
SetFilePointer
FindClose
FindFirstFileW
WideCharToMultiByte
GetProcAddress
LoadLibraryW
GetTickCount
lstrlenA
FreeResource
GlobalUnlock
WritePrivateProfileStringW
GlobalAlloc
GlobalLock
SetFileAttributesW
DeleteFileW
CloseHandle
GetDiskFreeSpaceExW
GetShortPathNameW
RemoveDirectoryW
lstrlenW
CreateFileW
TerminateProcess
GetFileAttributesW
GetVersionExW
Sleep
OpenProcess
WriteFile
GetPrivateProfileStringW
WaitForSingleObject
CreateDirectoryW
GetModuleFileNameW
LockResource
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetProcessHeap
SetUnhandledExceptionFilter

user32

EndDialog
CreateDialogIndirectParamW
DrawTextExW
DrawTextW
TabbedTextOutW
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
GetMenu
DestroyMenu
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
ShowWindow
MoveWindow
GetDlgCtrlID
ReleaseDC
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
ValidateRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxW
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuItemID
GetMenuItemCount
SetCursor
ScreenToClient
SetCapture
SetFocus
InvalidateRect
GetWindowLongW
PostThreadMessageW
UnregisterClassW
MessageBeep
GetNextDlgTabItem
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
SetRect
SetWindowLongW
GetCursorPos
GetSysColorBrush
CharNextW
CharUpperW
EndPaint
BeginPaint
OffsetRect
GetWindowDC
ReleaseCapture
CallWindowProcW
DefWindowProcW
PtInRect
SetRectEmpty
CopyRect
IsRectEmpty
GetDesktopWindow
GetSubMenu
SendMessageW
SetWindowRgn
SetTimer
PostMessageW
KillTimer
LoadCursorW
GetClientRect
GetSystemMetrics
EnableWindow
wsprintfW
UpdateWindow
GetDC
ClientToScreen
IsWindow
GrayStringW
RegisterClipboardFormatW

gdi32

RestoreDC
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SaveDC
SetBkColor
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
TextOutW
GetObjectW
RectVisible
PtVisible
SetTextColor
GetClipBox
CreateBitmap
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateRoundRectRgn
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegDeleteKeyW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW

oledlg

OleUIBusyW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
CoTaskMemAlloc
CreateILockBytesOnHGlobal
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
OleCreateFontIndirect
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen

gdiplus

GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStream
GdipFree
GdipDeleteGraphics
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipCloneImage
GdipDrawImageRectRect
GdipDeleteBrush
GdipDeletePen
GdipCloneBrush
GdipGetImageHeight
GdipSetTextRenderingHint
GdipDeleteFont
GdipSetImageAttributesWrapMode
GdipSetStringFormatAlign
GdipDeleteFontFamily
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipCreateFont
GdipCreateImageAttributes
GdipDrawString
GdipCreateFontFamilyFromName
GdipSetSolidFillColor
GdipFillRectangleI
GdipCreateStringFormat
GdipGetImageWidth
GdipCreatePen1
GdipDeleteStringFormat
GdipDrawRectangleI
GdipGetPathWorldBounds
GdipGetFontStyle
GdipGetFamily
GdipAddPathString
GdipGetFontSize
GdipDeletePath
GdipCreatePath

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

netapi32

Netbios

snmpapi

SnmpUtilOidCpy
SnmpUtilVarBindFree
SnmpUtilOidNCmp

ws2_32

WSAStartup

Sections

.text
Size: 397KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1c969a06a98711adcdc967adeb8f05e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

5e:b3:64:72:0b:f5:0d:5f:c7:27:e0:de:0c:1b:78:04Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8Certificate

Extended Key Usages

Key Usages

1e:8a:71:87:2b:0c:a1:fa:4c:4b:92:79:77:02:7d:fc:1f:ff:ac:e8Signer

Signature Validations

Verification

15/05/2015, 07:07 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

psapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

iphlpapi

netapi32

snmpapi

ws2_32

Sections

.text Size: 397KB - Virtual size: 397KB

.rdata Size: 93KB - Virtual size: 92KB

.data Size: 12KB - Virtual size: 28KB

.rsrc Size: 8.8MB - Virtual size: 8.8MB

.reloc Size: 66KB - Virtual size: 65KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

5e:b3:64:72:0b:f5:0d:5f:c7:27:e0:de:0c:1b:78:04
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8
Certificate

1e:8a:71:87:2b:0c:a1:fa:4c:4b:92:79:77:02:7d:fc:1f:ff:ac:e8
Signer

15/05/2015, 07:07
Valid: false

.text
Size: 397KB - Virtual size: 397KB

.rdata
Size: 93KB - Virtual size: 92KB

.data
Size: 12KB - Virtual size: 28KB

.rsrc
Size: 8.8MB - Virtual size: 8.8MB

.reloc
Size: 66KB - Virtual size: 65KB