General

Malware Config

Signatures

Files

• e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1

  .dll windows x86

  ce8ef9d98e08009ea204ef32e9f458ed

  
  

  Code Sign

  04:00:00:00:00:01:2f:4e:e1:52:d7

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  24-05-2016 00:00

  Not After

  24-06-2027 00:00

  Subject

  CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  14-06-2018 10:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  04:00:00:00:00:01:31:89:c6:50:04

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  02-08-2011 10:00

  Not After

  29-03-2029 10:00

  Subject

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  04:00:00:00:00:01:21:58:53:08:a2

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  18-03-2009 10:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  cb:d3:78:e8:87:6e:54:c0:ee:c1:f6:a6:a8:21:01:70:9b:0e:3b:67:3d:81:c8:00:5d:14:ed:53:27:08:87:a4

  Signer

  Actual PE Digest

  cb:d3:78:e8:87:6e:54:c0:ee:c1:f6:a6:a8:21:01:70:9b:0e:3b:67:3d:81:c8:00:5d:14:ed:53:27:08:87:a4

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  31-07-2020 11:14

  Valid: true

  Chain 1

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  87:1f:8c:b5:b2:2a:80:db:3c:08:0d:23:4c:52:61:9f:b9:88:32:89

  Signer

  Actual PE Digest

  87:1f:8c:b5:b2:2a:80:db:3c:08:0d:23:4c:52:61:9f:b9:88:32:89

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  31-07-2020 11:14

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateDirectoryW

  GetCurrentDirectoryW

  SetFileTime

  GetVersionExW

  GetTickCount

  CreateFileW

  ReadFile

  GetFileSize

  UnlockFile

  LockFile

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  CreateMutexW

  GetCurrentProcessId

  OpenProcess

  GetLongPathNameW

  MoveFileExW

  MoveFileW

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  GetFileAttributesW

  SetFileAttributesW

  GetFullPathNameW

  RemoveDirectoryW

  GetWindowsDirectoryW

  GetTempPathW

  lstrlenW

  FindClose

  SetLastError

  WideCharToMultiByte

  MultiByteToWideChar

  FindResourceExW

  FindResourceW

  GetModuleHandleW

  GetModuleFileNameW

  LoadLibraryW

  CreateEventW

  SizeofResource

  LoadResource

  WaitForMultipleObjects

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  FindFirstChangeNotificationW

  FindCloseChangeNotification

  CompareFileTime

  GetFileInformationByHandle

  SetEndOfFile

  WriteConsoleW

  SetFilePointerEx

  ReadConsoleW

  SetStdHandle

  SetConsoleCtrlHandler

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  SwitchToThread

  GetDriveTypeW

  WritePrivateProfileStringW

  GetCommandLineW

  LoadLibraryExW

  lstrcmpiW

  InterlockedDecrement

  InterlockedIncrement

  DecodePointer

  GlobalFindAtomW

  GlobalAddAtomW

  GetStartupInfoW

  CreateProcessW

  OpenEventW

  Sleep

  GetVersion

  LocalFree

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  GetLastError

  GetCurrentProcess

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  GetProcAddress

  FreeLibrary

  LockResource

  DeleteFileA

  IsValidCodePage

  FindNextFileA

  FindFirstFileExW

  FindFirstFileExA

  GetConsoleMode

  GetConsoleCP

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetStringTypeW

  GetFileType

  GetStdHandle

  GetACP

  GetCurrentThread

  GetModuleFileNameA

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ResumeThread

  ExitThread

  CreateThread

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  RtlUnwind

  InterlockedFlushSList

  GetSystemWindowsDirectoryW

  FreeResource

  lstrcmpiA

  lstrcmpA

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  WaitForSingleObjectEx

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GlobalFree

  CreateFileA

  GetTempFileNameA

  GetTempPathA

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  FlushFileBuffers

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  IsProcessorFeaturePresent

  FlushInstructionCache

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  InitializeSListHead

  WriteFile

  SearchPathW

  EncodePointer

  IsDebuggerPresent

  DeviceIoControl

  GetShortPathNameW

  GetPrivateProfileStringW

  LocalAlloc

  InterlockedCompareExchange

  InterlockedExchange

  GetDiskFreeSpaceExW

  GetSystemDirectoryW

  GetLogicalDriveStringsW

  GetFileAttributesExW

  SetFilePointer

  CloseHandle

  RaiseException

  GetEnvironmentVariableW

  GetTempFileNameW

  FormatMessageW

  TerminateProcess

  GetExitCodeProcess

  CopyFileW

  OutputDebugStringA

  OutputDebugStringW

  GetFileSizeEx

  GetLocalTime

  ResetEvent

  GetSystemInfo

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  user32

  DefWindowProcW

  GetClassInfoExW

  FindWindowExW

  PostMessageW

  KillTimer

  RegisterClassExW

  GetWindowThreadProcessId

  CallWindowProcW

  SetTimer

  UnregisterClassW

  CreateWindowExW

  IsDialogMessageW

  OffsetRect

  GetActiveWindow

  EndDialog

  DialogBoxParamW

  GetMonitorInfoW

  MonitorFromWindow

  LoadImageW

  GetWindow

  MapWindowPoints

  SetForegroundWindow

  GetSystemMetrics

  MessageBoxW

  wsprintfW

  RegisterWindowMessageW

  SendMessageTimeoutW

  SendNotifyMessageW

  FindWindowW

  UnionRect

  EqualRect

  PtInRect

  SetCursor

  DrawFocusRect

  DestroyCursor

  MoveWindow

  UnregisterClassA

  IsIconic

  PostQuitMessage

  CharNextW

  BringWindowToTop

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  GetParent

  FillRect

  ScreenToClient

  GetWindowTextLengthW

  SetWindowTextW

  InvalidateRect

  DrawTextW

  ReleaseCapture

  SetCapture

  GetAsyncKeyState

  GetFocus

  DestroyWindow

  UnhookWinEvent

  SetWinEventHook

  GetWindowTextW

  WaitForInputIdle

  SendMessageW

  GetShellWindow

  SystemParametersInfoW

  LoadCursorW

  SetWindowLongW

  GetWindowLongW

  CopyRect

  GetWindowRect

  GetClientRect

  SetWindowRgn

  EndPaint

  BeginPaint

  ReleaseDC

  GetDC

  IsWindowVisible

  SetWindowPos

  UpdateLayeredWindow

  ShowWindow

  IsWindow

  gdi32

  RestoreDC

  RectVisible

  GetObjectW

  CreateDIBSection

  SetTextColor

  SetBkMode

  SelectClipRgn

  SaveDC

  EnumFontFamiliesW

  GetStockObject

  CreateRectRgnIndirect

  SetViewportOrgEx

  SelectObject

  DeleteObject

  DeleteDC

  CreateRectRgn

  CreateCompatibleDC

  CreateCompatibleBitmap

  CombineRgn

  BitBlt

  CreateFontW

  OffsetViewportOrgEx

  advapi32

  FreeSid

  RegQueryValueExA

  RegOpenKeyExA

  RegEnumKeyExA

  CryptContextAddRef

  CryptDecrypt

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  RegEnumValueW

  RegCloseKey

  DuplicateTokenEx

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  OpenProcessToken

  GetUserNameW

  AllocateAndInitializeSid

  CryptEncrypt

  CheckTokenMembership

  EqualSid

  DeleteAce

  LookupAccountSidW

  LookupAccountNameW

  SetEntriesInAclW

  GetExplicitEntriesFromAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  BuildExplicitAccessWithNameW

  GetTrusteeNameW

  ChangeServiceConfigW

  ChangeServiceConfig2W

  CloseServiceHandle

  ControlService

  CreateServiceW

  DeleteService

  LockServiceDatabase

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfigW

  QueryServiceConfig2W

  QueryServiceLockStatusW

  QueryServiceStatus

  StartServiceW

  UnlockServiceDatabase

  CryptAcquireContextW

  CryptReleaseContext

  CryptDestroyKey

  CryptSetKeyParam

  CryptGenRandom

  CryptImportKey

  GetTokenInformation

  shell32

  SHLoadInProc

  CommandLineToArgvW

  SHGetFolderPathW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateDirectoryExW

  ShellExecuteW

  ord165

  SHChangeNotify

  SHFileOperationW

  ole32

  CoSetProxyBlanket

  CoInitializeEx

  CreateStreamOnHGlobal

  CoCreateGuid

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoCreateInstance

  CoUninitialize

  StringFromGUID2

  CoInitializeSecurity

  OleRun

  CoInitialize

  oleaut32

  VariantCopy

  SysFreeString

  VarUI4FromStr

  VariantInit

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  SysStringLen

  VariantClear

  SysAllocStringByteLen

  SysStringByteLen

  SysAllocString

  shlwapi

  SHDeleteValueW

  StrStrIW

  PathIsDirectoryW

  SHSetValueA

  PathIsRootW

  PathIsRelativeW

  PathRemoveFileSpecW

  SHGetValueW

  PathFindFileNameW

  PathFindExtensionW

  PathFileExistsW

  PathCombineW

  PathAppendW

  PathRenameExtensionA

  PathFindFileNameA

  PathIsPrefixW

  wnsprintfW

  SHSetValueW

  StrCmpIW

  StrToIntExW

  SHGetValueA

  StrCmpNIW

  StrTrimA

  StrStrIA

  AssocQueryStringW

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  gdiplus

  GdipDrawImageRectRect

  GdipCreateBitmapFromFileICM

  GdipCreateBitmapFromStreamICM

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromStream

  GdiplusStartup

  GdiplusShutdown

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipDrawImagePointRectI

  GdipDrawImageRectRectI

  GdipDisposeImage

  GdipCloneImage

  GdipSetStringFormatTrimming

  GdipAlloc

  GdipFree

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreatePen1

  GdipDeletePen

  GdipCreateImageAttributes

  GdipSetStringFormatLineAlign

  GdipSetImageAttributesColorMatrix

  GdipSetTextRenderingHint

  GdipDrawRectangleI

  GdipFillRectangleI

  GdipDisposeImageAttributes

  GdipCreateFontFamilyFromName

  GdipDeleteFontFamily

  GdipCreateFont

  GdipDeleteFont

  GdipDrawString

  GdipMeasureString

  GdipCreateStringFormat

  GdipDeleteStringFormat

  GdipSetStringFormatFlags

  GdipSetStringFormatAlign

  psapi

  EnumProcesses

  GetModuleFileNameExW

  iphlpapi

  GetAdaptersInfo

  wininet

  InternetGetConnectedState

  urlmon

  URLDownloadToFileW

  URLDownloadToCacheFileW

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  setupapi

  SetupIterateCabinetW

  secur32

  GetUserNameExW

  crypt32

  CertGetNameStringW

  wintrust

  WTHelperProvDataFromStateData

  WinVerifyTrust

  Exports

  Exports

  BasicEntry

  Dll_Entry

  Start

  Sections

  .text

  Size: 954KB - Virtual size: 954KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 210KB - Virtual size: 209KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 49KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ