df6e269dda6bb28a69815a8df41911bfbf7b2575004fe2435e1213d24c4b67e7

Sharing

Copy URL Twitter E-mail

General

Target

df6e269dda6bb28a69815a8df41911bfbf7b2575004fe2435e1213d24c4b67e7
Size

120KB
MD5

2b1b325a19651bd922d120aa1309f36e
SHA1

762858877ac372b0e14c00d324b18077ff1db16d
SHA256

df6e269dda6bb28a69815a8df41911bfbf7b2575004fe2435e1213d24c4b67e7
SHA512

327e148cd56e927f0d637a8dcd2d5d17b7583861dccd054effd6078a68d18b48084980926d0ccd018c958d9052467c27f0603c5cc04d66c0e93046bf5a9a1513
SSDEEP

3072:+oc04Ocd57izPTdPnu2CW25ChLvvnpUIzNC:+ocbOGIzPTdPuh35ChbvSX

Score

N/A

Malware Config

Signatures

Files

df6e269dda6bb28a69815a8df41911bfbf7b2575004fe2435e1213d24c4b67e7
.dll windows x64

b07925d67b7ea0e87c78d311c754e306

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:9d:f8:69
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:9d:f8:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:72:d5:ef:35:61:03
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

02/11/2011, 22:17

Not After

06/11/2014, 06:41

Subject

CN=北京寻几网际网络技术有限公司,O=北京寻几网际网络技术有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c0f61646d696e4032376e65742e6e6574

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

39
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cc:0a:6f:93:e8:06:be:4d:b2:be:08:28:60:c8:c3:13:cd:fd:78:a5
Signer

Actual PE Digest

cc:0a:6f:93:e8:06:be:4d:b2:be:08:28:60:c8:c3:13:cd:fd:78:a5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=北京寻几网际网络技术有限公司,O=北京寻几网际网络技术有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c0f61646d696e4032376e65742e6e6574

25/02/2013, 20:06
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

iphlpapi

CreateIpForwardEntry

ws2_32

inet_ntoa
ntohs
htons
WSCGetProviderPath
sendto
select
closesocket
inet_addr
socket

psapi

GetModuleFileNameExA

kernel32

FlushFileBuffers
FlsFree
CreateFileW
WriteConsoleW
SetStdHandle
HeapReAlloc
GetConsoleMode
GetLongPathNameA
GetCurrentProcess
SetEvent
WaitForSingleObject
CreateEventA
GlobalFree
GlobalAlloc
CloseHandle
GetLastError
CreateMutexW
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
ExpandEnvironmentStringsW
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
EncodePointer
DecodePointer
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FlsGetValue
SetLastError
FlsAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
GetModuleHandleW
ExitProcess
LCMapStringW
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetConsoleCP

Exports

Exports

GetData
SetData
WSPStartup

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b07925d67b7ea0e87c78d311c754e306

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:9d:f8:69Certificate

Key Usages

19:9d:f8:79Certificate

Key Usages

06:72:d5:ef:35:61:03Certificate

Extended Key Usages

Key Usages

39Certificate

Key Usages

cc:0a:6f:93:e8:06:be:4d:b2:be:08:28:60:c8:c3:13:cd:fd:78:a5Signer

Signature Validations

Verification

25/02/2013, 20:06 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

iphlpapi

ws2_32

psapi

kernel32

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 6KB - Virtual size: 16KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:9d:f8:69
Certificate

19:9d:f8:79
Certificate

06:72:d5:ef:35:61:03
Certificate

39
Certificate

cc:0a:6f:93:e8:06:be:4d:b2:be:08:28:60:c8:c3:13:cd:fd:78:a5
Signer

25/02/2013, 20:06
Valid: false

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 6KB - Virtual size: 16KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB