6bfaa8e1608157d439f1493bb023c936ed2b49cb3877328fb228721c3d2af655

Sharing

Copy URL Twitter E-mail

General

Target

6bfaa8e1608157d439f1493bb023c936ed2b49cb3877328fb228721c3d2af655
Size

1.2MB
MD5

0cacf0b608e8d2657c9eb325e80b3b0d
SHA1

40d608e323215ef527889eadf902772b9c8ac014
SHA256

6bfaa8e1608157d439f1493bb023c936ed2b49cb3877328fb228721c3d2af655
SHA512

0f1ec9cfed406d6f68091e2097a165e51cd831257b700b3b5666e56d64f9834541af8193d40cca9280e0effe7c39f6860370c63f8107741dd8d78be692fd0af0
SSDEEP

12288:a1feZ+W6FKEtEMARlahGh623/OpgriFhRnQRk6Q+7R7xmWbdjMNwbn9y6sY:u2QW6FKSEMAREhGdeDFXQywNxlYw

Score

N/A

Malware Config

Signatures

Files

6bfaa8e1608157d439f1493bb023c936ed2b49cb3877328fb228721c3d2af655
.exe windows x86

84d2f38049f97d0503bdf8e1416b2933

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/10/2008, 00:00

Not After

23/11/2010, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=SECURE APPLICATION DEVELOPMENT,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3729
ord804
ord4267
ord4284
ord3089
ord6880
ord4204
ord2919
ord2860
ord941
ord5710
ord4278
ord6663
ord2764
ord4123
ord539
ord2763
ord2820
ord551
ord4853
ord6662
ord5440
ord6383
ord5450
ord6394
ord3610
ord656
ord6442
ord4476
ord3873
ord939
ord2645
ord6675
ord6888
ord6007
ord6907
ord3998
ord2301
ord2370
ord6334
ord925
ord926
ord940
ord3092
ord668
ord4202
ord3181
ord4058
ord2781
ord2770
ord356
ord1768
ord3698
ord2108
ord3301
ord2582
ord4402
ord3370
ord3640
ord693
ord4243
ord6242
ord6696
ord5148
ord4694
ord3293
ord3910
ord2450
ord6762
ord6283
ord6282
ord3693
ord5788
ord5787
ord283
ord2639
ord3302
ord4133
ord4297
ord1929
ord2116
ord3742
ord818
ord861
ord4406
ord613
ord289
ord4124
ord536
ord922
ord3499
ord355
ord5953
ord3706
ord812
ord1270
ord1232
ord559
ord6144
ord1200
ord2152
ord6605
ord5781
ord2452
ord816
ord562
ord5862
ord472
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord6438
ord2621
ord1134
ord2725
ord2863
ord1176
ord6785
ord4287
ord2119
ord3870
ord6195
ord4400
ord3630
ord682
ord3811
ord3771
ord6134
ord3061
ord6136
ord2864
ord2405
ord3596
ord5864
ord6061
ord5571
ord5579
ord5736
ord5678
ord5794
ord5789
ord5873
ord6172
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord6453
ord3708
ord3721
ord3797
ord3286
ord4129
ord924
ord6905
ord6199
ord5280
ord2614
ord2915
ord5572
ord5981
ord535
ord765
ord1175
ord2817
ord2642
ord1576
ord823
ord858
ord5683
ord4277
ord470
ord2754
ord755
ord2380
ord2100
ord2096
ord2862
ord3996
ord4710
ord2086
ord6215
ord4299
ord4234
ord2302
ord781
ord795
ord324
ord384
ord537
ord1146
ord2818
ord641
ord686
ord3573
ord3597
ord4425
ord4407
ord1775
ord6052
ord2514
ord4998
ord4376
ord5265
ord6197
ord4285
ord2078
ord3874
ord5875
ord323
ord2859
ord1640
ord1641
ord5785
ord640
ord2122
ord540
ord860
ord800
ord2379
ord4275
ord1793
ord2414
ord3626
ord3663
ord825
ord567
ord556
ord1168
ord609
ord809
ord3619
ord3571
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord3572
ord2784
ord2574

msvcrt

__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
_setmbcp
_CxxThrowException
_wcsicmp
__setusermatherr
_controlfp
__CxxFrameHandler
free
_snprintf
strncat
strncpy
strrchr
_beginthreadex
atoi
strchr
realloc
_mbscmp
_mbsicmp
_vsnprintf
_stricmp
malloc
_except_handler3
fclose
fseek
_strnicmp
fopen
fwrite
wcscpy
wcslen
wcsncpy
wcsstr
sprintf
isalnum
strncmp
vsprintf
_atoi64
fread
ftell
atol
_ftol
_mbsnbcpy
_mbsnbcmp
wcscmp
_wtoi
strstr
_mbsstr
_mbctolower
strtoul
rand
sscanf
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_strlwr

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
CreateFileA
WriteFile
RemoveDirectoryA
lstrlenA
MultiByteToWideChar
GetDiskFreeSpaceExA
GetSystemDefaultUILanguage
SuspendThread
TerminateThread
GetPrivateProfileSectionA
WritePrivateProfileStringA
FindFirstFileA
GetModuleHandleA
CopyFileA
DeleteFileA
FindClose
Sleep
GetModuleFileNameA
CreateDirectoryA
GetWindowsDirectoryA
CreateThread
CloseHandle
CreateMutexA
GetTickCount
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
lstrcpyA
GetStartupInfoA
GetVersionExA
GetEnvironmentVariableA
SetFileAttributesA
GetLastError
GetCurrentProcess
LockResource
LoadResource
SizeofResource
FindResourceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
WaitForSingleObject
InterlockedDecrement
LocalFree
WideCharToMultiByte
GlobalFree
GetFileTime
OpenFile
GetPrivateProfileStringA
GetLocalTime
Process32Next
CreateToolhelp32Snapshot
Process32First
TerminateProcess
OpenProcess
lstrcmpiA
GetExitCodeThread
GetTempPathA
GetSystemWindowsDirectoryA
lstrcmpA
DeviceIoControl
InterlockedIncrement
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
lstrlenW
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
ReadFile
GetFileSize
GetPrivateProfileIntA
FindResourceExA
WritePrivateProfileSectionA
FlushFileBuffers
CreateEventA
MulDiv
ResumeThread
ResetEvent
FindNextFileA
GetCommandLineA
SetEvent

user32

EndPaint
GetDlgItem
GetSysColor
CallWindowProcA
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
RegisterClassExA
SetClassLongA
SetWindowLongA
EqualRect
ClientToScreen
ReleaseCapture
GetCapture
SetCapture
FillRect
ScreenToClient
GetWindowLongA
GetWindowDC
GetCursorPos
LoadCursorA
SetCursor
GetFocus
FindWindowA
GetDC
ReleaseDC
GetWindowRect
GetWindow
GetClassNameA
SetForegroundWindow
ExitWindowsEx
wsprintfA
GrayStringA
DrawTextA
TabbedTextOutA
CreateWindowExA
ShowWindow
PtInRect
BeginPaint
GetSystemMetrics
TrackPopupMenu
UnregisterHotKey
IsIconic
DrawIcon
GetSystemMenu
AppendMenuA
RegisterHotKey
LoadIconA
IsRectEmpty
IsWindowVisible
KillTimer
IsWindow
PostMessageA
FrameRect
SetTimer
EnableWindow
CreateAcceleratorTableA
InvalidateRgn
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
SetDlgItemTextA
LoadBitmapA
SendMessageA
GetClientRect
CopyRect
InvalidateRect
GetSubMenu
OffsetRect
UpdateWindow
ChildWindowFromPointEx
LoadImageA
DestroyIcon
SystemParametersInfoA
GetIconInfo
SetWindowRgn
WindowFromPoint
GetActiveWindow
InflateRect
DrawStateA
GetClassInfoA
SetRect
SetFocus
IsChild
SetWindowPos
DestroyWindow
RedrawWindow
GetDesktopWindow
MapWindowPoints
EnumChildWindows
GetWindowThreadProcessId
DrawIconEx
GetParent
LoadMenuA

gdi32

CreateRoundRectRgn
CreatePolygonRgn
CombineRgn
OffsetRgn
FrameRgn
CreateRectRgn
GetDeviceCaps
CreateFontIndirectA
CreatePen
Rectangle
GetTextExtentPoint32A
GetTextColor
GetTextMetricsA
CreateDIBSection
DeleteDC
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetStockObject
CreateSolidBrush
CreateFontA
GetObjectA
SelectObject
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetPixel

advapi32

RegEnumKeyExA
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyA
ChangeServiceConfigA
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
AdjustTokenPrivileges
RegOpenKeyExA
RegFlushKey
RegCloseKey
RegEnumKeyA
RegCreateKeyA
InitiateSystemShutdownExA

shell32

SHGetFolderPathA
Shell_NotifyIconA
CommandLineToArgvW
SHBrowseForFolderA
SHGetPathFromIDListA
SHCreateDirectoryExA
ShellExecuteA

comctl32

ImageList_Draw
ImageList_GetIconSize
ImageList_AddMasked
ImageList_GetIcon
_TrackMouseEvent
ImageList_GetImageCount

ole32

CoCreateInstance
OleRun
CLSIDFromProgID
CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromString

olepro32

ord251
ord253

oleaut32

GetErrorInfo
SysFreeString
SysAllocString
LoadRegTypeLi
SysStringLen
SysAllocStringLen
DispCallFunc
VariantClear

urlmon

URLDownloadToFileA
URLDownloadToCacheFileA

shlwapi

SHDeleteValueA
StrStrIA
StrRChrA
PathCombineA
PathRemoveFileSpecA
PathIsDirectoryA
SHGetValueA
PathAppendA
PathFileExistsA
SHDeleteKeyA
SHSetValueA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

setupapi

SetupIterateCabinetA

iphlpapi

GetAdaptersInfo

wininet

HttpAddRequestHeadersA
InternetReadFile
InternetCrackUrlA
InternetOpenA
InternetConnectA
InternetCloseHandle
InternetGetConnectedState
HttpSendRequestA
HttpOpenRequestA

netapi32

Netbios

msimg32

GradientFill

Sections

.text
Size: 424KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 428KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�=w
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

84d2f38049f97d0503bdf8e1416b2933

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:ddCertificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

urlmon

shlwapi

version

setupapi

iphlpapi

wininet

netapi32

msimg32

Sections

.text Size: 424KB - Virtual size: 420KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 428KB - Virtual size: 424KB

�=w Size: 244KB - Virtual size: 244KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

21:d9:1d:91:5f:64:fe:5a:ea:a1:6d:d9:b4:6f:06:dd
Certificate

.text
Size: 424KB - Virtual size: 420KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 428KB - Virtual size: 424KB

�=w
Size: 244KB - Virtual size: 244KB