430d784b0ce7aa5c118197774075b1e0746400deacfbfcb005bf921c25a5cc2d

Sharing

Copy URL Twitter E-mail

General

Target

430d784b0ce7aa5c118197774075b1e0746400deacfbfcb005bf921c25a5cc2d
Size

393KB
MD5

4e161be4535b896bdcc815c18c053fb9
SHA1

e86a65fb68fadf5d6c0ec64056508b95ddab31b5
SHA256

430d784b0ce7aa5c118197774075b1e0746400deacfbfcb005bf921c25a5cc2d
SHA512

d2089c7e0cd45a38db86b6f448877fd59e92b0691b3a6da562158199bb9f3d7c68463549ff11e2bdb3d91fa3b4e18940b8e3db5d1736581d20f1ec6e7123128f
SSDEEP

6144:B/cylI435Nf/6P/Sc1umMbL7fLb+cnoP/r545mcbdnjtB8YS3TBwLYQuVzcUjc/N:9n+4pNKAj+Tr+fnjH8p3TuLYRc/eWr

Score

N/A

Malware Config

Signatures

Files

430d784b0ce7aa5c118197774075b1e0746400deacfbfcb005bf921c25a5cc2d
.dll windows x86

40cf3997b2d9cc76b705755362f682f5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrRChrW
SHGetValueW
PathRemoveFileSpecW
PathAppendW
StrStrIW
SHSetValueW
PathFindFileNameW
StrChrW
StrStrW
PathIsDirectoryW
SHDeleteValueW
StrCmpIW
PathFileExistsW
StrCmpW
PathCombineW
SHDeleteKeyW

wininet

InternetCrackUrlW
InternetSetOptionA
InternetCloseHandle
InternetSetStatusCallbackA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetOpenA
InternetWriteFile
InternetConnectA
InternetGetConnectedState

iphlpapi

GetAdaptersInfo

mfc42u

ord600
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord6466
ord5929
ord3805
ord920
ord837
ord832
ord3753
ord3403
ord3222
ord3049
ord3420
ord3875
ord2910
ord537
ord3826
ord3820
ord3074
ord4075
ord5706
ord927
ord922
ord940
ord6640
ord4616
ord4418
ord3733
ord815
ord538
ord561
ord800
ord861
ord3948
ord2717
ord535
ord2810
ord858
ord823
ord2756
ord540
ord4124
ord2606
ord2755
ord4272
ord6868
ord4197
ord6278
ord269
ord826
ord1165
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord942
ord539
ord6279

msvcrt

strerror
_snwprintf
swprintf
realloc
_except_handler3
_vsnprintf
exit
wcsncat
wcscpy
wcstok
_errno
__CxxFrameHandler
_vsnwprintf
wcsncpy
_purecall
_wcsicmp
_wtoi
wcscmp
wcslen
free
malloc
wcsncmp
wcschr
wcsrchr
_ftol
_i64toa
fwrite
fclose
fread
fseek
_wfopen
swscanf
time
_CxxThrowException
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
?terminate@@YAXXZ

kernel32

WaitForMultipleObjects
WideCharToMultiByte
GetFileAttributesW
UnlockFileEx
LockFileEx
FindFirstFileW
FindNextFileW
FindClose
FlushFileBuffers
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFileTimeToFileTime
WriteFile
SetFilePointerEx
GetFileSizeEx
TlsGetValue
OpenThread
TlsSetValue
GetCurrentProcessId
CreateMutexW
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
TlsAlloc
SetEnvironmentVariableW
ReleaseMutex
TlsFree
HeapFree
SetFilePointer
ReadFile
GetSystemTimeAsFileTime
CreateFileA
GetCurrentThreadId
OutputDebugStringW
MultiByteToWideChar
FormatMessageW
GetSystemTime
MoveFileExW
LocalAlloc
LocalFree
lstrlenW
CreateThread
ResumeThread
GetShortPathNameW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetLongPathNameW
CreateFileW
DeviceIoControl
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
GetFileAttributesExW
DeleteFileW
CreateDirectoryW
SystemTimeToFileTime
GetDriveTypeW
GetFullPathNameW
GetTickCount
InterlockedCompareExchange
Sleep
GetExitCodeProcess
TerminateProcess
CreateProcessW
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetCurrentProcess
SetLastError
WaitForSingleObject
ResetEvent
SetEvent
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW

user32

GetActiveWindow
MessageBoxW
SendMessageTimeoutW
LoadStringW
FindWindowW

advapi32

RegSetValueExW
RegCloseKey
RegEnumKeyW
RegOpenKeyW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
FreeSid

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString
VariantCopy
VariantClear

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSACleanup
WSAStartup
gethostbyname

netapi32

Netbios

winmm

timeGetTime

Exports

Exports

Create360SafeEngine
CreateCloudEngine
CreateCloudEngineLocker
CreateFileReportLog
CreatePluginFactory
CreateQuarantine
CreateTrustZone
ForceMerge360Log

Sections

.text
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40cf3997b2d9cc76b705755362f682f5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

wininet

iphlpapi

mfc42u

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

version

ws2_32

netapi32

winmm

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 260KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 24KB - Virtual size: 35KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 32KB - Virtual size: 31KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 264KB - Virtual size: 260KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 24KB - Virtual size: 35KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 32KB - Virtual size: 31KB