6607ef5c78feaf20b2271d8295b9c6a0c9d1aa7f9836116bc322325c78ec4625

Sharing

Copy URL Twitter E-mail

General

Target

6607ef5c78feaf20b2271d8295b9c6a0c9d1aa7f9836116bc322325c78ec4625
Size

248KB
MD5

30486752023bf4f812915db1add5aade
SHA1

5b6b7b98c5b8582a8f32808e6280439c42287ff6
SHA256

6607ef5c78feaf20b2271d8295b9c6a0c9d1aa7f9836116bc322325c78ec4625
SHA512

5aaa7a1112e3f513cdc33f43fcd822fd0927e3a7b2f1105771e115399252eb737f24deef9483811b165d9fbd5bed94f1884e9e675f5efac811e3443d50da9ccb
SSDEEP

3072:uu3sJmY4zlIGl74PwNTD1U5DIm5DIN5DI5NQ7VZ3MKObi0vGFIPId1j1U1j1nTzy:uu3+m/fD3M/bIy21j1U1BTzhyT

Score

N/A

Malware Config

Signatures

Files

6607ef5c78feaf20b2271d8295b9c6a0c9d1aa7f9836116bc322325c78ec4625
.exe windows x86

46627bea9d42ba845b62252d180e5e23

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
GetShortPathNameW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
WriteFile
SetFilePointer
CreateFileW
GetLastError
CreateDirectoryW
GetVersionExW
TerminateProcess
ExitProcess
GetCurrentProcess
LoadLibraryA
GetStringTypeW
GetStringTypeA
SetStdHandle
FlushFileBuffers
IsBadCodePtr
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
HeapSize
HeapAlloc
HeapReAlloc
HeapFree
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
RtlUnwind
GetPrivateProfileStringW
DeleteFileW
MultiByteToWideChar
GetPrivateProfileIntW
GetTickCount
FreeLibrary
lstrcatW
CopyFileW
WritePrivateProfileStringW
GetLongPathNameW
lstrcpyW
lstrlenW
WideCharToMultiByte
GetProcAddress
Sleep
CreateProcessW
CloseHandle
SetEndOfFile

user32

GetDlgItem
GetSysColor
ShowWindow
PostMessageW
FindWindowW
IsWindow
SetTimer
DispatchMessageW
DestroyWindow
TranslateMessage
PeekMessageW
LoadIconW
SetWindowPos
CreateDialogParamW
GetDesktopWindow
SendMessageW
MessageBoxW
LoadStringW

gdi32

SetTextColor
CreateFontIndirectW
GetObjectW
SetBkMode
CreateSolidBrush

advapi32

RegSaveKeyW
RegCloseKey
RegUnLoadKeyW
RegOpenKeyExW
RegLoadKeyW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

SHDeleteKeyW
SHDeleteValueW
SHSetValueW
PathIsRootW
SHGetValueW
PathFileExistsW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__360sta
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

46627bea9d42ba845b62252d180e5e23

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

version

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 29KB

__360sta Size: 4KB - Virtual size: 4B

.rsrc Size: 168KB - Virtual size: 168KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 29KB

__360sta
Size: 4KB - Virtual size: 4B

.rsrc
Size: 168KB - Virtual size: 168KB