b17c06c32e7eb9edd1c61c4421c280742091f1c38186e8c948f210f481d878a8

Sharing

Copy URL

Twitter E-mail

General

Target

b17c06c32e7eb9edd1c61c4421c280742091f1c38186e8c948f210f481d878a8
Size

49KB
MD5

64f87dd02d78b1dbc5456b3d1ed7355c
SHA1

4fdfe80fe7c2bf0c714ae1a459d0d2defbd72059
SHA256

b17c06c32e7eb9edd1c61c4421c280742091f1c38186e8c948f210f481d878a8
SHA512

f3327523fd0ebcde2e0c6fac5f3e4faa54132f95660cb44a23422e3582f482112372e6201c4d1ab217a1eb3063e5f5b3cb07422345168a9fc635f54821aea54b
SSDEEP

384:ow9q4ogxkL0KQLjJRa+BXEKCrmRwIZII5fZsr/VBx0OgyKNl3BFQoLiOOLLvYiD0:VrDOLnc7U9qbZdmV30vPXFQoML7sYz6p

Score

N/A

Malware Config

Signatures

Files

b17c06c32e7eb9edd1c61c4421c280742091f1c38186e8c948f210f481d878a8
.exe windows x86

40aa263ef5ccbab834cd9f59f4e5826a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30-04-2007 00:00

Not After

29-04-2012 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fd
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

11-10-2010 00:00

Not After

11-10-2011 23:59

Subject

CN=海南铭汇文化传媒有限公司,OU=WoSign Class 3 Code Signing,O=海南铭汇文化传媒有限公司,L=海口市,ST=海南省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

74:f0:b5:7b:60:97:af:c6:5e:c6:e0:0e:2c:c9:e9:ea:c2:a9:3f:24
Signer

Actual PE Digest

74:f0:b5:7b:60:97:af:c6:5e:c6:e0:0e:2c:c9:e9:ea:c2:a9:3f:24

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=海南铭汇文化传媒有限公司,OU=WoSign Class 3 Code Signing,O=海南铭汇文化传媒有限公司,L=海口市,ST=海南省,C=CN

11-10-2010 09:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
GetLastError
FindNextFileA
SetFileAttributesA
WinExec
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
ExitProcess
CloseHandle
CreateMutexA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers

user32

RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
wsprintfA

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40aa263ef5ccbab834cd9f59f4e5826a

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fdCertificate

Extended Key Usages

Key Usages

74:f0:b5:7b:60:97:af:c6:5e:c6:e0:0e:2c:c9:e9:ea:c2:a9:3f:24Signer

Signature Validations

Verification

11-10-2010 09:38 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 16B

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

7a:e1:93:de:23:50:9d:f1:0b:11:a0:fa:97:72:ae:fd
Certificate

74:f0:b5:7b:60:97:af:c6:5e:c6:e0:0e:2c:c9:e9:ea:c2:a9:3f:24
Signer

11-10-2010 09:38
Valid: false

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 16B