b05c5e7021f17e66fd7c8903b41a607bad8b3b84270422165d0561396ad9f819

Sharing

Copy URL Twitter E-mail

General

Target

b05c5e7021f17e66fd7c8903b41a607bad8b3b84270422165d0561396ad9f819
Size

134KB
MD5

3eab25170d89845e0c04c804ea4d0aee
SHA1

176531cd611f9d4421377cdc2a1bea638d042a83
SHA256

b05c5e7021f17e66fd7c8903b41a607bad8b3b84270422165d0561396ad9f819
SHA512

6e8cbd814c7ae98aec8b6fa111ee4b42419ff566a3e1713fd9930668ca3b7f71f12c79e64be4cb72851a6bb0699035bc0b643009783b05a458901db16142ae06
SSDEEP

1536:lQzcPAeUfouru3V7QQI8Jeimz/gSiSKnnrC3zsHzrzlKWQdjZNqqc5chqWQJb:Upfo53V5I8y/RqnnrisTQddjZNqqc5c

Score

N/A

Malware Config

Signatures

Files

b05c5e7021f17e66fd7c8903b41a607bad8b3b84270422165d0561396ad9f819
.exe windows x86

4a407f373250cddacc223478888bdb25

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

28:75:c2:fc:a1:ca:7e:07:c1:71:40:5a:8a:84:85:6e
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

24/11/2014, 09:19

Not After

24/11/2015, 09:19

Subject

CN=上海多库信息科技有限公司,O=上海多库信息科技有限公司,L=上海市,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:21:57:73:cb:c9:07:53:d0:f5:59:83:55:a7:53:59:fd:f9:8d:73
Signer

Actual PE Digest

cb:21:57:73:cb:c9:07:53:d0:f5:59:83:55:a7:53:59:fd:f9:8d:73

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=上海多库信息科技有限公司,O=上海多库信息科技有限公司,L=上海市,ST=上海市,C=CN

27/04/2015, 09:26
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
CreateEventA
Sleep
SetEvent
ResetEvent
ReadFile
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
LoadLibraryA
GetModuleFileNameA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLocalTime
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
CreateFileA
TerminateThread
ExitThread
GetTickCount
SetFileAttributesA
GetFileAttributesA
CloseHandle
WaitForSingleObject
GetTempPathA
FlushFileBuffers
WriteFile
SetFilePointerEx
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetModuleHandleA
FreeEnvironmentStringsA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetConsoleMode
GetConsoleCP
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
GetFileType
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
GetStdHandle
SetHandleCount

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ws2_32

connect
inet_addr
htons
setsockopt
recv
socket
closesocket
send
gethostbyname
WSACleanup
WSAStartup
WSAGetLastError
WSACloseEvent

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a407f373250cddacc223478888bdb25

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

28:75:c2:fc:a1:ca:7e:07:c1:71:40:5a:8a:84:85:6eCertificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

cb:21:57:73:cb:c9:07:53:d0:f5:59:83:55:a7:53:59:fd:f9:8d:73Signer

Signature Validations

Verification

27/04/2015, 09:26 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ws2_32

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

28:75:c2:fc:a1:ca:7e:07:c1:71:40:5a:8a:84:85:6e
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

cb:21:57:73:cb:c9:07:53:d0:f5:59:83:55:a7:53:59:fd:f9:8d:73
Signer

27/04/2015, 09:26
Valid: false

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B