General

Malware Config

Signatures

Files

• 21b241e1bc0fc488e8c1f5aefe842037e348936e16f89e42f57c5f30305ab346

  .exe windows x86

  0e2b0c48d5c7e0af756a1d45ad1efe66

  
  

  Code Sign

  0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  25-11-2020 00:00

  Not After

  22-02-2024 23:59

  Subject

  CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  25-11-2020 00:00

  Not After

  22-02-2024 23:59

  Subject

  CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  53:c9:53:8d:d1:99:55:c2:68:6e:90:9f:b4:8a:69:60:57:f2:33:bf:f0:29:f6:92:41:38:1c:f0:3f:66:41:a4

  Signer

  Actual PE Digest

  53:c9:53:8d:d1:99:55:c2:68:6e:90:9f:b4:8a:69:60:57:f2:33:bf:f0:29:f6:92:41:38:1c:f0:3f:66:41:a4

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

  08-11-2021 12:00

  Valid: true

  Chain 1

  CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  ab:01:d0:52:b0:f1:b9:b4:32:79:d5:ab:47:0e:1b:88:f0:28:bc:8c

  Signer

  Actual PE Digest

  ab:01:d0:52:b0:f1:b9:b4:32:79:d5:ab:47:0e:1b:88:f0:28:bc:8c

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

  01-12-2022 14:34

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  psapi

  GetModuleFileNameExA

  ws2_32

  htons

  WSAStartup

  WSAGetLastError

  WSACleanup

  gethostbyname

  closesocket

  setsockopt

  ioctlsocket

  __WSAFDIsSet

  select

  shutdown

  connect

  recv

  send

  htonl

  ntohl

  socket

  kernel32

  UnmapViewOfFile

  EnterCriticalSection

  LeaveCriticalSection

  DuplicateHandle

  SetErrorMode

  TerminateProcess

  RaiseException

  GetFileTime

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  GetTempPathW

  GetFileAttributesW

  GetFileSizeEx

  TerminateThread

  FreeResource

  GetUserDefaultUILanguage

  DecodePointer

  ProcessIdToSessionId

  OpenMutexW

  CreateMutexW

  GetLogicalDrives

  GetDriveTypeW

  DeviceIoControl

  FindFirstFileW

  RemoveDirectoryW

  MoveFileExW

  FindNextFileW

  FindClose

  GetExitCodeProcess

  IsDBCSLeadByte

  GetFullPathNameW

  SetEndOfFile

  SetFilePointerEx

  CopyFileW

  CreateFileA

  SwitchToThread

  CreateDirectoryA

  GetPrivateProfileIntA

  GetPrivateProfileStringA

  GetVersionExW

  LoadLibraryA

  GetSystemDefaultLangID

  OpenProcess

  SleepEx

  CreateMutexA

  AreFileApisANSI

  TryEnterCriticalSection

  HeapCreate

  GetDiskFreeSpaceW

  OutputDebugStringA

  LockFile

  GetFullPathNameA

  UnlockFileEx

  HeapValidate

  GetTempPathA

  FormatMessageW

  GetDiskFreeSpaceA

  GetFileAttributesA

  FlushViewOfFile

  WaitForSingleObjectEx

  GetVersionExA

  DeleteFileA

  HeapCompact

  UnlockFile

  CreateFileMappingA

  LocalFree

  LockFileEx

  SystemTimeToFileTime

  GetSystemTimeAsFileTime

  GetSystemTime

  FormatMessageA

  QueryPerformanceCounter

  FlushFileBuffers

  GetStdHandle

  GetFileType

  GetModuleHandleA

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  MulDiv

  GetACP

  lstrlenW

  GlobalUnlock

  ExitProcess

  VerifyVersionInfoW

  VerSetConditionMask

  CreateDirectoryW

  MapViewOfFile

  LocalFileTimeToFileTime

  GlobalAlloc

  lstrcpyW

  lstrcmpiW

  IsValidCodePage

  SetStdHandle

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  GetConsoleCP

  ReadConsoleW

  SetEnvironmentVariableA

  SetConsoleMode

  ReadConsoleInputA

  GetConsoleMode

  SetConsoleCtrlHandler

  GetModuleHandleExW

  ExitThread

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  PeekNamedPipe

  RtlUnwind

  UnregisterWaitEx

  QueryDepthSList

  InterlockedFlushSList

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  ReleaseSemaphore

  VirtualProtect

  VirtualFree

  VirtualAlloc

  LoadLibraryExW

  FreeLibraryAndExitThread

  GetThreadTimes

  UnregisterWait

  RegisterWaitForSingleObject

  SetThreadAffinityMask

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  CreateThread

  SignalObjectAndWait

  CreateTimerQueue

  InitializeSListHead

  GetStartupInfoW

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  ResetEvent

  IsDebuggerPresent

  LCMapStringW

  CompareStringW

  GetCPInfo

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  SetLastError

  QueryPerformanceFrequency

  FindFirstFileExW

  GetNativeSystemInfo

  GetExitCodeThread

  GetCurrentThread

  GetStringTypeW

  EncodePointer

  SetUnhandledExceptionFilter

  InitializeCriticalSection

  GetCurrentProcessId

  GetModuleFileNameA

  GetSystemDirectoryW

  CreateFileMappingW

  GetEnvironmentVariableW

  GetLocaleInfoW

  GetPrivateProfileSectionW

  GetPrivateProfileIntW

  GetPrivateProfileStringW

  GetCommandLineW

  GetSystemInfo

  GetDiskFreeSpaceExW

  GlobalMemoryStatusEx

  OutputDebugStringW

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  LoadLibraryW

  FreeLibrary

  InterlockedExchangeAdd

  GetTickCount

  GetFileAttributesExW

  GetLocalTime

  GetModuleFileNameW

  InterlockedDecrement

  InterlockedIncrement

  MoveFileW

  DeleteFileW

  SetFilePointer

  SetEvent

  WaitForSingleObject

  CreateEventW

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  WideCharToMultiByte

  Sleep

  InterlockedExchange

  InterlockedCompareExchange

  GetProcessHeap

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  HeapDestroy

  GetCurrentThreadId

  GlobalFree

  MultiByteToWideChar

  GetCurrentProcess

  GetFileSize

  WriteFile

  ReadFile

  GetLastError

  GetModuleHandleW

  GetProcAddress

  CreateFileW

  CloseHandle

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  GlobalLock

  user32

  wsprintfW

  EnumDisplayDevicesW

  GetDC

  MonitorFromWindow

  GetMonitorInfoW

  ReleaseDC

  DestroyWindow

  DefWindowProcW

  GetSystemMetrics

  MessageBoxW

  InvalidateRgn

  GetWindowTextW

  GetWindowTextLengthW

  SetWindowTextW

  IsWindowEnabled

  InvalidateRect

  IsWindow

  GetProcessWindowStation

  GetUserObjectInformationW

  MessageBoxA

  IsRectEmpty

  IntersectRect

  PtInRect

  SetCursor

  LoadCursorW

  CharNextW

  CreateAcceleratorTableW

  InflateRect

  UnionRect

  SendMessageW

  GetWindowRect

  ScreenToClient

  GetKeyState

  GetClientRect

  SetWindowPos

  GetWindowLongW

  SetWindowLongW

  IsIconic

  GetActiveWindow

  GetWindow

  SetFocus

  BeginPaint

  EndPaint

  GetUpdateRect

  IsWindowVisible

  MapWindowPoints

  CreateWindowExW

  GetCursorPos

  ReleaseCapture

  GetSysColor

  GetMessageW

  DestroyMenu

  TrackPopupMenu

  EnableMenuItem

  AppendMenuW

  TranslateMessage

  DispatchMessageW

  IsZoomed

  PostMessageW

  GetFocus

  SetTimer

  KillTimer

  SetCapture

  GetParent

  LoadImageW

  SetWindowRgn

  ShowWindow

  EnableWindow

  PostQuitMessage

  RegisterClassW

  GetClassInfoExW

  RegisterClassExW

  GetGUIThreadInfo

  SetForegroundWindow

  MapVirtualKeyExW

  GetKeyboardLayout

  OffsetRect

  CallWindowProcW

  SetPropW

  CreatePopupMenu

  GetCaretBlinkTime

  ClientToScreen

  SetCaretPos

  GetCaretPos

  GetKeyNameTextW

  GetPropW

  HideCaret

  ShowCaret

  CreateCaret

  GetWindowRgn

  UpdateLayeredWindow

  EqualRect

  FillRect

  DrawTextW

  SetRect

  CharPrevW

  MoveWindow

  gdi32

  CreateRectRgnIndirect

  GetClipBox

  SelectClipRgn

  CreateRoundRectRgn

  PlayEnhMetaFile

  GetEnhMetaFileHeader

  CreateDIBitmap

  AddFontMemResourceEx

  GetTextMetricsW

  CloseEnhMetaFile

  CreateEnhMetaFileW

  SetWindowOrgEx

  Rectangle

  RestoreDC

  BitBlt

  SaveDC

  StretchBlt

  CreateCompatibleDC

  DeleteDC

  ExtSelectClipRgn

  CreatePen

  CreateFontIndirectW

  GetStockObject

  GetObjectW

  GetObjectA

  DeleteObject

  CreateCompatibleBitmap

  GetDeviceCaps

  SetStretchBltMode

  CreatePatternBrush

  CreateSolidBrush

  CreatePenIndirect

  MoveToEx

  LineTo

  RoundRect

  GetBitmapBits

  SetBitmapBits

  CombineRgn

  RemoveFontMemResourceEx

  CreateDIBSection

  SetBkMode

  SetTextColor

  SetBkColor

  GetCharABCWidthsW

  GetTextExtentPoint32W

  TextOutW

  GdiFlush

  CreateRectRgn

  SelectObject

  PtInRegion

  advapi32

  CryptAcquireContextW

  RegOpenKeyExA

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  ReportEventA

  RegisterEventSourceA

  DeregisterEventSource

  CryptReleaseContext

  CryptGenRandom

  RegQueryValueExA

  shell32

  SHBrowseForFolderW

  DragQueryFileW

  SHGetFolderPathA

  ord165

  ShellExecuteExW

  SHGetSpecialFolderPathW

  SHCreateDirectoryExW

  CommandLineToArgvW

  SHGetPathFromIDListW

  SHChangeNotify

  ole32

  RegisterDragDrop

  DoDragDrop

  OleDuplicateData

  CoInitialize

  CoCreateInstance

  CoUninitialize

  CoInitializeEx

  CoTaskMemFree

  CoCreateGuid

  ReleaseStgMedium

  OleLockRunning

  CLSIDFromString

  CLSIDFromProgID

  CreateStreamOnHGlobal

  comctl32

  ord17

  _TrackMouseEvent

  gdiplus

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipSetStringFormatTrimming

  GdipDeleteStringFormat

  GdipTranslateWorldTransform

  GdipCloneStringFormat

  GdipSetInterpolationMode

  GdipSetSmoothingMode

  GdipSetTextRenderingHint

  GdipDeleteFont

  GdipCreateFontFromLogfontA

  GdipCreateFontFromDC

  GdipDrawRectangleI

  GdipSetPenMode

  GdipMeasureString

  GdipCreatePen1

  GdipFillRectangleI

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipDisposeImage

  GdipCloneImage

  GdipAlloc

  GdipFree

  GdipLoadImageFromStream

  GdiplusShutdown

  GdiplusStartup

  GdipDeletePen

  GdipDrawString

  GdipDrawImageRectI

  GdipRotateWorldTransform

  GdipStringFormatGetGenericTypographic

  imm32

  ImmGetContext

  ImmReleaseContext

  ImmSetCompositionWindow

  winhttp

  WinHttpReceiveResponse

  WinHttpWriteData

  WinHttpSetOption

  WinHttpSendRequest

  WinHttpQueryHeaders

  WinHttpGetIEProxyConfigForCurrentUser

  WinHttpAddRequestHeaders

  WinHttpOpenRequest

  WinHttpConnect

  WinHttpCrackUrl

  WinHttpQueryDataAvailable

  WinHttpReadData

  WinHttpGetProxyForUrl

  WinHttpSetTimeouts

  WinHttpCloseHandle

  WinHttpOpen

  shlwapi

  PathFileExistsW

  PathRemoveFileSpecW

  PathAddBackslashW

  PathRemoveFileSpecA

  PathIsDirectoryW

  d3d9

  Direct3DCreate9

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  netapi32

  Netbios

  Sections

  .text

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 529KB - Virtual size: 529KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 64KB - Virtual size: 82KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .QMGuid

  Size: 512B - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 210KB - Virtual size: 209KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 117KB - Virtual size: 117KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ