ac6f49ef538f38c3c151f7f6dc65a3083ac236fe08bc220327d6a7397de7df8c

Sharing

Copy URL

Twitter E-mail

General

Target

ac6f49ef538f38c3c151f7f6dc65a3083ac236fe08bc220327d6a7397de7df8c
Size

291KB
MD5

49f6913953d4de36820139b5408eb8f2
SHA1

cc289186c725c43c23a137b208f59dcb6517bad8
SHA256

ac6f49ef538f38c3c151f7f6dc65a3083ac236fe08bc220327d6a7397de7df8c
SHA512

5912cee643c7a82b77e72b3b8913a5817382f387fbc6f5b56f37524a00eaa78a8e536142d729992b85f1d1035016d29635d6f2372dfe00937f64869bbecc9253
SSDEEP

3072:kOgw9iQYWyUHUo7XYozRii6KJwS/tM/x3kKjhIZoaOEOCV5VYO4eeC:xp94n8oo1h3JwSlMZ35jsdxVYO5

Score

N/A

Malware Config

Signatures

Files

ac6f49ef538f38c3c151f7f6dc65a3083ac236fe08bc220327d6a7397de7df8c
.exe windows x86

6f5d5b45f88d3c5fb2e62c85ea6bb665

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

15-02-2009 00:00

Not After

15-02-2010 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tencent,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

10:21:34:4a:ca:fa:6c:ee:91:87:aa:65:0f:04:c3:a2:66:e5:1e:2d
Signer

Actual PE Digest

10:21:34:4a:ca:fa:6c:ee:91:87:aa:65:0f:04:c3:a2:66:e5:1e:2d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tencent,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

16-07-2009 05:30
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
InterlockedIncrement
CreateThread
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
lstrcmpiA
ReadFile
CreateFileW
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
LoadLibraryW
LCMapStringA
GetCPInfo
LoadLibraryA
OpenMutexW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetStdHandle
SetUnhandledExceptionFilter
GetCommandLineA
GetProcAddress
WideCharToMultiByte
lstrlenW
ReleaseMutex
lstrlenA
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
LCMapStringW
CreateMutexW
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
UnhandledExceptionFilter
SetLastError
TlsAlloc
WriteFile
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
UnmapViewOfFile
Sleep
WaitForMultipleObjects
CreateEventW
ResetEvent
SetEvent
GetTickCount
OpenProcess
OpenEventW
GetLastError
WaitForSingleObject
TerminateThread
EnterCriticalSection
CloseHandle
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetStringTypeW
SetHandleCount
HeapSize
TerminateProcess
RaiseException
ExitProcess
GetVersion
GetStartupInfoW
GetModuleHandleA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
TlsGetValue
TlsSetValue
ResumeThread
RtlUnwind
InterlockedExchange
LocalFree

user32

SetWindowLongW
GetWindowLongW
CallWindowProcW
CreateWindowExW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
KillTimer
PostThreadMessageW
CharNextW
GetMessageW
IsChild
GetFocus
EndPaint
GetClientRect
BeginPaint
SendMessageW
LoadStringW
DefWindowProcW
PostMessageW
IsWindow
DestroyWindow
SetTimer
SetRectEmpty

gdi32

SetWindowOrgEx
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetViewportOrgEx
DeleteDC
RestoreDC

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID
CoLoadLibrary
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocString
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
LoadRegTypeLi
VariantCopy
VariantInit
VariantChangeType

atl

ord57
ord18
ord17
ord20
ord21
ord16
ord11
ord10
ord43
ord45
ord30
ord32
ord58
ord26
ord27
ord23
ord44

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathFileExistsW

wininet

InternetSetCookieW
InternetCrackUrlA

ws2_32

htons
recvfrom
ntohl
gethostname
inet_addr
inet_ntoa
WSAStartup
WSACleanup
closesocket
sendto
bind
WSAGetLastError
htonl
gethostbyname
socket

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f5d5b45f88d3c5fb2e62c85ea6bb665

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20Certificate

Extended Key Usages

Key Usages

10:21:34:4a:ca:fa:6c:ee:91:87:aa:65:0f:04:c3:a2:66:e5:1e:2dSigner

Signature Validations

Verification

16-07-2009 05:30 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl

version

shlwapi

wininet

ws2_32

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 20KB - Virtual size: 22KB

.rsrc Size: 119KB - Virtual size: 139KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

10:21:34:4a:ca:fa:6c:ee:91:87:aa:65:0f:04:c3:a2:66:e5:1e:2d
Signer

16-07-2009 05:30
Valid: false

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 20KB - Virtual size: 22KB

.rsrc
Size: 119KB - Virtual size: 139KB