05de6cf9143e0a0f73fb7e6857a26360b2b07c21de7e942686103fa90a25ab9f

Sharing

Copy URL Twitter E-mail

General

Target

05de6cf9143e0a0f73fb7e6857a26360b2b07c21de7e942686103fa90a25ab9f
Size

49KB
MD5

fa0b10405c8a68d4dd9051f716f34b67
SHA1

8a7c3a781f48cd864b0e21c439218503b9a15b49
SHA256

05de6cf9143e0a0f73fb7e6857a26360b2b07c21de7e942686103fa90a25ab9f
SHA512

8fd0adf1279c8cc6bde8065b263c2b63b8090f97b3a05ebe1f0244bb8412723031562f7a449a4b5b5a63dcd98cc3680af31cfa63f057fe375e0e819cb4d0669a
SSDEEP

384:ow9q4ogPkL0KQLjJRa+BXEKCrmRwIZII5fZsr/VBx0OgyKNl3BFQoLiROLLvYiD0:VrDcLnc7U9qbZdmV30vPXFQo/L7sYz6p

Score

N/A

Malware Config

Signatures

Files

05de6cf9143e0a0f73fb7e6857a26360b2b07c21de7e942686103fa90a25ab9f
.exe windows x86

40aa263ef5ccbab834cd9f59f4e5826a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fd
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

11/10/2010, 00:00

Not After

11/10/2011, 23:59

Subject

CN=海南铭汇文化传媒有限公司,OU=WoSign Class 3 Code Signing,O=海南铭汇文化传媒有限公司,L=海口市,ST=海南省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

86:ef:47:0c:44:c2:2f:b6:aa:8c:ec:e9:7c:6b:3c:3e:b2:2c:a2:d8
Signer

Actual PE Digest

86:ef:47:0c:44:c2:2f:b6:aa:8c:ec:e9:7c:6b:3c:3e:b2:2c:a2:d8

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=海南铭汇文化传媒有限公司,OU=WoSign Class 3 Code Signing,O=海南铭汇文化传媒有限公司,L=海口市,ST=海南省,C=CN

11/10/2010, 09:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
GetLastError
FindNextFileA
SetFileAttributesA
WinExec
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
ExitProcess
CloseHandle
CreateMutexA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers

user32

RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
wsprintfA

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40aa263ef5ccbab834cd9f59f4e5826a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fdCertificate

Extended Key Usages

Key Usages

86:ef:47:0c:44:c2:2f:b6:aa:8c:ec:e9:7c:6b:3c:3e:b2:2c:a2:d8Signer

Signature Validations

Verification

11/10/2010, 09:38 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 16B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fd
Certificate

86:ef:47:0c:44:c2:2f:b6:aa:8c:ec:e9:7c:6b:3c:3e:b2:2c:a2:d8
Signer

11/10/2010, 09:38
Valid: false

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 16B