bd671419add44b807fff425da6015790c01ba00645a0a16867430ba2d4aeba40

Sharing

Copy URL Twitter E-mail

General

Target

bd671419add44b807fff425da6015790c01ba00645a0a16867430ba2d4aeba40
Size

3.1MB
MD5

4aa8a0bb9e07a0b1a614360a4951170d
SHA1

620eead915b06ce51bbf9befa7434360f114fd18
SHA256

bd671419add44b807fff425da6015790c01ba00645a0a16867430ba2d4aeba40
SHA512

0c04ef1e43bc37ef9af6211df560413c09aebeb25e4fe112807a466b22c57b33de1e690ec5011394a351a45208bf714804eaaaccd444fe1ba36c89e5b6e4a131
SSDEEP

49152:Q7W+kFG6NNuAp4nU6ZqOyT4YAf7ruzS1+RmodHs5l2nlxj8t8qX1:QC+kFG6NNuZDqOykbfvr1+n/o

Score

N/A

Malware Config

Signatures

Files

bd671419add44b807fff425da6015790c01ba00645a0a16867430ba2d4aeba40
.exe windows x86

8c2e137d5f928d8075d6b892493bb2a6

Code Sign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:c2:ad:1e:17:6e:3b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/12/2011, 12:03

Not After

10/12/2012, 00:12

Subject

CN=历下景祥科技经营部,O=历下景祥科技经营部,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c116a6e6b6a73635f6a78403136332e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 19:46

Not After

17/09/2036, 19:46

Subject

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

11:da:b0:0c:a6:b2:d9:a3:f1:0d:59:ca:20:52:1e:bb:aa:c1:ab:59
Signer

Actual PE Digest

11:da:b0:0c:a6:b2:d9:a3:f1:0d:59:ca:20:52:1e:bb:aa:c1:ab:59

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=历下景祥科技经营部,O=历下景祥科技经营部,L=济南市,ST=山东省,C=CN,1.2.840.113549.1.9.1=#0c116a6e6b6a73635f6a78403136332e636f6d

07/02/2012, 07:13
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
GetLastError
CreateFileA
CloseHandle
SetFilePointer
WriteFile
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
lstrlenA
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetSystemTime
GetTickCount
GetFileAttributesA
CreateProcessA
VirtualAlloc
VirtualProtect
VirtualFree
LoadLibraryA
IsBadReadPtr
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
LCMapStringW
LCMapStringA
GetSystemInfo
IsBadCodePtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
ExitProcess
RtlUnwind
HeapReAlloc
GetStartupInfoA
GetCommandLineA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
VirtualQuery
HeapDestroy
HeapCreate
IsBadWritePtr
TerminateProcess
HeapSize
GetStringTypeA
GetStringTypeW
GetOEMCP
GetCPInfo
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte

user32

MessageBoxA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c2e137d5f928d8075d6b892493bb2a6

Code Sign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

19:9d:f8:8eCertificate

Key Usages

14:c2:ad:1e:17:6e:3bCertificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

01Certificate

Key Usages

11:da:b0:0c:a6:b2:d9:a3:f1:0d:59:ca:20:52:1e:bb:aa:c1:ab:59Signer

Signature Validations

Verification

07/02/2012, 07:13 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 3.0MB - Virtual size: 3.0MB

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

19:9d:f8:8e
Certificate

14:c2:ad:1e:17:6e:3b
Certificate

3d
Certificate

01
Certificate

11:da:b0:0c:a6:b2:d9:a3:f1:0d:59:ca:20:52:1e:bb:aa:c1:ab:59
Signer

07/02/2012, 07:13
Valid: false

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 3.0MB - Virtual size: 3.0MB