ace48be4a2e78570176d201bcdb0057cc7111b86ae20a09dedc64d607d974e17

Sharing

Copy URL Twitter E-mail

General

Target

ace48be4a2e78570176d201bcdb0057cc7111b86ae20a09dedc64d607d974e17
Size

77KB
MD5

5e46c0f42845bdd358b720f6fdf7adb0
SHA1

6c13ef15311eba1b4b4b20b91a92a2e292004015
SHA256

ace48be4a2e78570176d201bcdb0057cc7111b86ae20a09dedc64d607d974e17
SHA512

f1023d73bb9443238f2c04f57ecefa18f31018727a46fe5ebfbcbc858607d9fe0abe17ad6efe27d23b8e4b76fb30b051a12098b06c7a181dfb023819278becbd
SSDEEP

768:piz3R/K7pZ69h2/VQ6gvDW1Vbv11S1IVugwTleCHYKiGuKr+nOOMXXSMgEp23+zX:S/K7pZ66mY0VgwcCAz3OOe/W0LlV0c

Score

N/A

Malware Config

Signatures

Files

ace48be4a2e78570176d201bcdb0057cc7111b86ae20a09dedc64d607d974e17
.exe windows x64

c127d3fc09e6ecd4eb5fe7557d4d4515

Code Sign

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/03/2019, 00:00

Not After

11/04/2020, 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/03/2019, 00:00

Not After

11/04/2020, 12:00

Subject

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:4f:41:f3:4a:90:aa:92:39:51:4c:b0:1d:b8:df:e3:41:27:09:42:b5:f3:36:6f:92:65:1b:b8:d0:35:2f:06
Signer

Actual PE Digest

8d:4f:41:f3:4a:90:aa:92:39:51:4c:b0:1d:b8:df:e3:41:27:09:42:b5:f3:36:6f:92:65:1b:b8:d0:35:2f:06

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

17/10/2019, 08:39
Valid: true

Chain 1

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

b5:6c:36:20:06:1b:d4:73:2f:23:05:38:03:11:f6:e4:2e:f4:06:f9
Signer

Actual PE Digest

b5:6c:36:20:06:1b:d4:73:2f:23:05:38:03:11:f6:e4:2e:f4:06:f9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=IT,O=Wondershare Technology Co.\,Ltd,L=拉萨,ST=西藏,C=CN

17/10/2019, 08:39
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opencl

clReleaseDevice
clGetPlatformInfo
clGetDeviceInfo
clGetDeviceIDs
clGetPlatformIDs

msvcp120

?_Future_error_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
_Thrd_sleep
?_Orphan_all@_Container_base0@std@@QEAAXXZ
_Xtime_diff_to_millis2
xtime_get
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

msvcr120

memcpy
??0exception@std@@QEAA@XZ
memcmp
__crtSetUnhandledExceptionFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtCapturePreviousContext
free
memchr
memmove
??1exception@std@@UEAA@XZ
??3@YAXPEAX@Z
??0exception@std@@QEAA@AEBV01@@Z
??2@YAPEAX_K@Z
??_V@YAXPEAX@Z
sprintf_s
strcmp
malloc
_fseeki64
_ftelli64
fread
fclose
fopen
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
?wait@Concurrency@@YAXI@Z
printf
_purecall
__CxxFrameHandler3
_CxxThrowException
memset
_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
?terminate@@YAXXZ
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess

kernel32

GetLastError
lstrlenA
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LocalFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
WideCharToMultiByte

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c127d3fc09e6ecd4eb5fe7557d4d4515

Code Sign

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4dCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

8d:4f:41:f3:4a:90:aa:92:39:51:4c:b0:1d:b8:df:e3:41:27:09:42:b5:f3:36:6f:92:65:1b:b8:d0:35:2f:06Signer

Signature Validations

Verification

17/10/2019, 08:39 Valid: true

Chain 1

b5:6c:36:20:06:1b:d4:73:2f:23:05:38:03:11:f6:e4:2e:f4:06:f9Signer

Signature Validations

Verification

17/10/2019, 08:39 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

opencl

msvcp120

ole32

oleaut32

msvcr120

kernel32

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 168B

02:f7:b0:7c:55:25:b8:c9:07:01:6c:37:79:8a:63:55
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:7c:6a:d9:68:4b:16:0a:25:99:89:6f:d7:9a:9e:4d
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

8d:4f:41:f3:4a:90:aa:92:39:51:4c:b0:1d:b8:df:e3:41:27:09:42:b5:f3:36:6f:92:65:1b:b8:d0:35:2f:06
Signer

17/10/2019, 08:39
Valid: true

b5:6c:36:20:06:1b:d4:73:2f:23:05:38:03:11:f6:e4:2e:f4:06:f9
Signer

17/10/2019, 08:39
Valid: false

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 168B