c6e5742a5dc72b1ec747b09e765aaf4690e7637ea84339aba590ad5fbeea6896

Sharing

Copy URL Twitter E-mail

General

Target

c6e5742a5dc72b1ec747b09e765aaf4690e7637ea84339aba590ad5fbeea6896
Size

65KB
MD5

376eddc355649b1a8b8f293c4d06f241
SHA1

e194fb72dfe5644d82b1731a615e246a45af63b5
SHA256

c6e5742a5dc72b1ec747b09e765aaf4690e7637ea84339aba590ad5fbeea6896
SHA512

a516268ec7bfb999da368fb50782b67aece6ede51bac561a1d46fe4a238292b79ca73ee796d91a692da9ea950bcbbe5ad450f85f156d674504dd99a63d754ac3
SSDEEP

1536:kX/IMZHO0lu+s60VwvrrDmrCrO1HuTR65CY:KQMUlVwvrHmrMO1HuTRlY

Score

N/A

Malware Config

Signatures

Files

c6e5742a5dc72b1ec747b09e765aaf4690e7637ea84339aba590ad5fbeea6896
.dll windows x86

7dabdb1d81bc318202cca27aed9c03e6

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:40:da:4a:a5:93:87:1c:a5:35:16:7a:93:64:9c:ac
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/03/2013, 00:00

Not After

05/04/2014, 23:59

Subject

CN=Shenzhen Paojiaosizhi Information Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=产品组,O=Shenzhen Paojiaosizhi Information Technology Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:ac:58:ea:7e:bb:80:6a:06:70:41:ce:08:69:74:dd:a8:74:88:e9
Signer

Actual PE Digest

e6:ac:58:ea:7e:bb:80:6a:06:70:41:ce:08:69:74:dd:a8:74:88:e9

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Shenzhen Paojiaosizhi Information Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=产品组,O=Shenzhen Paojiaosizhi Information Technology Co.\,Ltd.,L=Shenzhen,ST=Guangdong,C=CN

27/04/2013, 10:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_lock
_onexit
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
_purecall
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__FrameUnwindFilter
_cexit
??_V@YAXPAX@Z
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
__dllonexit

mfc90

ord4114
ord2895
ord6558
ord4528
ord6556
ord6583
ord4383
ord2359
ord6289
ord6290
ord2342
ord1391
ord1401
ord5745
ord1866
ord4028
ord391
ord1241
ord1152
ord1137
ord4515
ord4512
ord2965
ord6006
ord6430
ord4279
ord4282
ord2125
ord1744
ord1745
ord2766
ord2978
ord3107
ord4714
ord2961
ord3122
ord2769
ord2888
ord2759
ord3227
ord4066
ord4067
ord4057
ord2886
ord910
ord601
ord274
ord819
ord4334
ord4890
ord4667
ord3485
ord6433
ord1252
ord6252
ord2157
ord1221
ord2246
ord1751
ord3418
ord3728
ord1377
ord721
ord474
ord3935
ord5634
ord3387
ord4040
ord5647
ord5607
ord2069
ord345
ord4679
ord1748
ord5005
ord1728
ord5403
ord4585
ord1144
ord1143
ord599

kernel32

InterlockedExchange
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
SetUnhandledExceptionFilter

msvcm90

?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z

user32

GetWindow
GetClientRect
SendMessageA
PostMessageA
CopyRect
SetWindowPos

mscoree

_CorDllMain

Exports

Exports

AfxmReleaseManagedReferences

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dabdb1d81bc318202cca27aed9c03e6

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

79:40:da:4a:a5:93:87:1c:a5:35:16:7a:93:64:9c:acCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e6:ac:58:ea:7e:bb:80:6a:06:70:41:ce:08:69:74:dd:a8:74:88:e9Signer

Signature Validations

Verification

27/04/2013, 10:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

mfc90

kernel32

msvcm90

user32

mscoree

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 2KB - Virtual size: 1KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

79:40:da:4a:a5:93:87:1c:a5:35:16:7a:93:64:9c:ac
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e6:ac:58:ea:7e:bb:80:6a:06:70:41:ce:08:69:74:dd:a8:74:88:e9
Signer

27/04/2013, 10:14
Valid: false

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 2KB - Virtual size: 1KB