6bbd30f4f137aa9eef74a08bd4cc786c50076ba9d518ff4474103b3efe66183d

Sharing

Copy URL

Twitter E-mail

General

Target

6bbd30f4f137aa9eef74a08bd4cc786c50076ba9d518ff4474103b3efe66183d
Size

367KB
MD5

81b6f91a0a0b84d8a4a9fa0223ef2532
SHA1

8040f1010784a10a29d7f81234efa87ffd3dd87c
SHA256

6bbd30f4f137aa9eef74a08bd4cc786c50076ba9d518ff4474103b3efe66183d
SHA512

189394d8aa5780893f6adb543848d4329d5b02dc4ea5974054aab7faff04c7e4bdd7434b7437be200ad31928846406e5fb4d98e6cd982103b343482ac31bd9b4
SSDEEP

6144:9nWsanWyF1ELAki/Fmu/fjvDTpXU8n5pJ1fgpsl:9WtWygE5/k2J1fOsl

Score

N/A

Malware Config

Signatures

Files

6bbd30f4f137aa9eef74a08bd4cc786c50076ba9d518ff4474103b3efe66183d
.dll windows x86

e5c6085533a4645659e7cd6d63eccbe8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

13/08/2010, 00:00

Not After

12/08/2013, 23:59

Subject

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f3:10:1d:3f:54:dc:f4:d7:b0:3d:fa:6a:be:d6:1a:1e:23:42:be:1a
Signer

Actual PE Digest

f3:10:1d:3f:54:dc:f4:d7:b0:3d:fa:6a:be:d6:1a:1e:23:42:be:1a

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=T.E.C Solutions (G.Z.)Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=T.E.C Solutions (G.Z.)Limited,L=Guangzhou,ST=Guangdong,C=CN

02/08/2013, 03:26
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
GetCurrentProcess
LoadLibraryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
InterlockedIncrement
lstrlenA
InterlockedDecrement
LocalFree
FormatMessageA
LoadResource
FindResourceExW
GetACP
lstrlenW
FormatMessageW
GetVersionExW
GetWindowsDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryW
FreeConsole
AllocConsole
WriteConsoleW
GetStdHandle
OutputDebugStringA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
PulseEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
GlobalLock
GlobalSize
GlobalAlloc
GlobalUnlock
GetFileAttributesExW
IsBadReadPtr
IsBadStringPtrW
GetCurrentThreadId
SetEndOfFile
CreateFileA
GetSystemInfo
GetFileAttributesW
CreateFileMappingW
GetFileAttributesA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualQuery
FreeLibrary
FlushInstructionCache
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
SetStdHandle
SetConsoleCtrlHandler
GetOEMCP
GetStringTypeW
GetStringTypeA
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
UnhandledExceptionFilter
IsBadCodePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetSystemDirectoryW
FreeEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
GetFileInformationByHandle
GetModuleHandleW
WideCharToMultiByte
Sleep
WriteFile
CreateFileW
ReadFile
SetFilePointer
GetFileSize
OutputDebugStringW
MultiByteToWideChar
CopyFileW
OpenProcess
VirtualQueryEx
VirtualProtectEx
LoadLibraryA
GlobalFree
GetProcAddress
InitializeCriticalSection
CloseHandle
DeleteCriticalSection
IsBadWritePtr
GetTickCount
GetModuleFileNameW
GetStartupInfoA
GetFileType
SetHandleCount
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
FatalAppExitA
GetCurrentThread
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
HeapSize
HeapAlloc
HeapReAlloc
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
HeapFree
ExitProcess
TerminateProcess

user32

SetTimer
WindowFromDC
GetScrollInfo
FindWindowExW
KillTimer
GetCaretPos
GetWindowRect
SetWindowsHookExA
SetWindowsHookExW
SendMessageW
IsWindow
GetFocus
WindowFromPoint
RegisterWindowMessageW
MessageBoxW
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
OpenDesktopW
GetUserObjectInformationW
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
CloseDesktop
GetDC
ReleaseDC
LoadCursorW
SetCursor
GetCursorPos
MsgWaitForMultipleObjects
RegisterClipboardFormatW
GetClassNameW
SetKeyboardState
GetKeyboardState
GetForegroundWindow
GetWindowLongW
GetWindowThreadProcessId
GetSystemMetrics
PostMessageW
EnumClipboardFormats
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetFocus
SetCaretPos
TranslateMessage
DispatchMessageW

gdi32

GetDIBits
SetDIBits
CreateDIBSection
SetDIBColorTable
BitBlt
SetStretchBltMode
StretchBlt
GdiFlush
GetStockObject
GetPaletteEntries
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetPixel
DeleteObject
DeleteDC
GetObjectW

advapi32

RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegConnectRegistryW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

oleaut32

SysFreeString

gdiplus

GdipCloneImage
GdipCreateBitmapFromFileICM
GdipDisposeImage
GdipCreateBitmapFromFile
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

IMHAInit
IMWndActivated
INJInstallDetours
INJUninstallDetours
InitGDI
InstallDetours
InstallDetoursOne
ModifyPassthruThread
SetCtrlPhotoFlag
SetFlags
SetRecordPhotoFlag
SetStatus
SyncIMWnd
TGetLogConfig
TSetLogConfig
TencentUserNameSet
TencentWindowClose
UninstallDetours
UninstallDetoursOne

Sections

.text
Size: 268KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

TLCONFIG
Size: 4KB - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5c6085533a4645659e7cd6d63eccbe8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4aCertificate

Extended Key Usages

Key Usages

f3:10:1d:3f:54:dc:f4:d7:b0:3d:fa:6a:be:d6:1a:1e:23:42:be:1aSigner

Signature Validations

Verification

02/08/2013, 03:26 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

oleaut32

gdiplus

version

Exports

Exports

Sections

.text Size: 268KB - Virtual size: 264KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 32KB - Virtual size: 60KB

TLCONFIG Size: 4KB - Virtual size: 536B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

56:f5:1b:61:d9:7d:b2:8c:df:fd:e6:ba:2d:15:90:4a
Certificate

f3:10:1d:3f:54:dc:f4:d7:b0:3d:fa:6a:be:d6:1a:1e:23:42:be:1a
Signer

02/08/2013, 03:26
Valid: false

.text
Size: 268KB - Virtual size: 264KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 32KB - Virtual size: 60KB

TLCONFIG
Size: 4KB - Virtual size: 536B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB