aff0560f46081b224aae7254ab0f6c258e76204bf88f64633d9b81afa7afee22

Sharing

Copy URL Twitter E-mail

General

Target

aff0560f46081b224aae7254ab0f6c258e76204bf88f64633d9b81afa7afee22
Size

768KB
MD5

c08f40eb164d92103e30aadf2735e738
SHA1

2bdeae66c57924569d9416ff4225d36218d6c985
SHA256

aff0560f46081b224aae7254ab0f6c258e76204bf88f64633d9b81afa7afee22
SHA512

27b5f81507f628c244baaeeb8b210b89610afc0d07fb3a7cc94ca9ed5ef33080a2fdf102de871a11b443ca931d8c455704d16e0aa965d373d21eebbcdceecd74
SSDEEP

1536:L3xVd5v5o8ou41StBmTBWt8wohie1S1v5o8ou41StBmTBWt9SwL9:LBVdA7MDm+8w07UE7MDm+999

Score

N/A

Malware Config

Signatures

Files

aff0560f46081b224aae7254ab0f6c258e76204bf88f64633d9b81afa7afee22
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:44:c0
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

22/10/2008, 12:07

Not After

31/12/2029, 12:07

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:ae
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

09/11/2016, 08:45

Not After

09/11/2026, 08:45

Subject

CN=WoSign Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:a3:66:d3:c5:1f:f7:c0:7c:d5:33:3c:a5:ec:8d:9d
Certificate

Issuer

CN=WoSign Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

12/04/2018, 09:24

Not After

11/04/2021, 09:24

Subject

CN=YAMICSOFT TECHNOLOGY LIMITED,O=YAMICSOFT TECHNOLOGY LIMITED,L=Hong Kong,ST=Hong Kong,C=CN,1.2.840.113549.1.9.1=#0c15636f6e746163744079616d6963736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

88:f8:94:a3:e4:89:62:88:11:4c:93:79:a0:8f:ee:91:53:6c:7a:15:10:11:d6:08:ee:6a:ae:4b:bc:e9:e8:c8
Signer

Actual PE Digest

88:f8:94:a3:e4:89:62:88:11:4c:93:79:a0:8f:ee:91:53:6c:7a:15:10:11:d6:08:ee:6a:ae:4b:bc:e9:e8:c8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=YAMICSOFT TECHNOLOGY LIMITED,O=YAMICSOFT TECHNOLOGY LIMITED,L=Hong Kong,ST=Hong Kong,C=CN,1.2.840.113549.1.9.1=#0c15636f6e746163744079616d6963736f66742e636f6d

11/09/2019, 01:22
Valid: true

Chain 1

CN=YAMICSOFT TECHNOLOGY LIMITED,O=YAMICSOFT TECHNOLOGY LIMITED,L=Hong Kong,ST=Hong Kong,C=CN,1.2.840.113549.1.9.1=#0c15636f6e746163744079616d6963736f66742e636f6d

CN=WoSign Code Signing CA,O=WoSign CA Limited,C=CN

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 393KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

04:44:c0Certificate

Key Usages

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:aeCertificate

Extended Key Usages

Key Usages

65:a3:66:d3:c5:1f:f7:c0:7c:d5:33:3c:a5:ec:8d:9dCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

88:f8:94:a3:e4:89:62:88:11:4c:93:79:a0:8f:ee:91:53:6c:7a:15:10:11:d6:08:ee:6a:ae:4b:bc:e9:e8:c8Signer

Signature Validations

Verification

11/09/2019, 01:22 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 393KB - Virtual size: 392KB

.reloc Size: 512B - Virtual size: 12B

.rsrc Size: 367KB - Virtual size: 366KB

04:44:c0
Certificate

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:ae
Certificate

65:a3:66:d3:c5:1f:f7:c0:7c:d5:33:3c:a5:ec:8d:9d
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

88:f8:94:a3:e4:89:62:88:11:4c:93:79:a0:8f:ee:91:53:6c:7a:15:10:11:d6:08:ee:6a:ae:4b:bc:e9:e8:c8
Signer

11/09/2019, 01:22
Valid: true

.text
Size: 393KB - Virtual size: 392KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 367KB - Virtual size: 366KB