1aa661b6292b97bdfc5afce30a55715d60e2ab331982de9b0bc27a820e6e84d3

Sharing

Copy URL Twitter E-mail

General

Target

1aa661b6292b97bdfc5afce30a55715d60e2ab331982de9b0bc27a820e6e84d3
Size

1.7MB
MD5

fd7b9b98b6fac161554cd25e3784a2f5
SHA1

28da46f46b1d512ea419aa5c6a0c4f14ba84b8d0
SHA256

1aa661b6292b97bdfc5afce30a55715d60e2ab331982de9b0bc27a820e6e84d3
SHA512

b551c2aefb7dba495875ebe17270c8c6940c6861468d3adab3536f5914059f816a1fe6bba1cdf1d87d68f30818de84b08126934c2b735452b521cdb21270e41a
SSDEEP

49152:1f/gTDqW/6nobDhSUJ5cnqP2bomdn/rg9mQvb:WDqW/pDPGq+Xd/s97vb

Score

N/A

Malware Config

Signatures

Files

1aa661b6292b97bdfc5afce30a55715d60e2ab331982de9b0bc27a820e6e84d3
.exe windows x86

483725ae03fda62e42fd3c7080af897b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b1:33:dc:ef:ad:95
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

16/07/2012, 16:23

Not After

19/07/2013, 02:21

Subject

CN=Guangxi Nanning Shengtaian E-commerce Development Co.\, Ltd.,O=Guangxi Nanning Shengtaian E-commerce Development Co.\, Ltd.,L=Nanning,ST=Guangxi,C=CN,1.2.840.113549.1.9.1=#0c136b656675407368656e67746169616e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:3b:be:e7:7d:70:33:27:ea:d0:3f:4d:84:bf:ab:45:3a:9d:1e:97
Signer

Actual PE Digest

15:3b:be:e7:7d:70:33:27:ea:d0:3f:4d:84:bf:ab:45:3a:9d:1e:97

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Guangxi Nanning Shengtaian E-commerce Development Co.\, Ltd.,O=Guangxi Nanning Shengtaian E-commerce Development Co.\, Ltd.,L=Nanning,ST=Guangxi,C=CN,1.2.840.113549.1.9.1=#0c136b656675407368656e67746169616e2e636f6d

14/03/2013, 06:45
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

GradientFill

kernel32

FreeResource
LoadResource
SizeofResource
GetFileAttributesA
GetLocalTime
WritePrivateProfileStringA
LockResource
OutputDebugStringA
DosDateTimeToFileTime
CreateFileA
SetFilePointer
SystemTimeToFileTime
SetFileTime
WriteFile
ReadFile
GetFileType
GetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
FlushFileBuffers
CreateFileW
FindResourceA
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
GetStringTypeW
GetConsoleMode
GetConsoleCP
HeapSize
RtlUnwind
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetACP
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetSystemTime
CloseHandle
GetModuleHandleA
WinExec
GetModuleFileNameA
SetFileAttributesA
CreateDirectoryA
TerminateProcess
OpenProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetStdHandle
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetLastError
GetSystemTimeAsFileTime

user32

GetMessageA
FindWindowA
UpdateWindow
LoadImageA
GetSystemMetrics
DispatchMessageA
WindowFromDC
ShowWindow
SetLayeredWindowAttributes
GetDlgItem
InvalidateRect
TranslateMessage
BeginPaint
SendMessageA
MoveWindow
GetClientRect
LoadBitmapA
DrawTextA
KillTimer
PostMessageA
wvsprintfA
EndPaint
DestroyWindow
PostQuitMessage
SetTimer
GetWindowRect
CreateDialogParamA
GetDlgCtrlID

gdi32

SetTextColor
DeleteDC
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
GetStockObject
BitBlt

advapi32

AdjustTokenPrivileges
RegOpenKeyExA
RegCreateKeyExA
LookupPrivilegeValueA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHCreateDirectoryExA
SHGetPathFromIDListA

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance

gdiplus

GdiplusStartup

shlwapi

PathStripPathA

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

483725ae03fda62e42fd3c7080af897b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:9d:f8:8eCertificate

Key Usages

1b:b1:33:dc:ef:ad:95Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

15:3b:be:e7:7d:70:33:27:ea:d0:3f:4d:84:bf:ab:45:3a:9d:1e:97Signer

Signature Validations

Verification

14/03/2013, 06:45 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msimg32

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

shlwapi

psapi

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 11KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:9d:f8:8e
Certificate

1b:b1:33:dc:ef:ad:95
Certificate

3d
Certificate

15:3b:be:e7:7d:70:33:27:ea:d0:3f:4d:84:bf:ab:45:3a:9d:1e:97
Signer

14/03/2013, 06:45
Valid: false

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 11KB - Virtual size: 11KB