b2f18705d26d5f11ca9c1bfb5ebf25377d888e5fb32c83074bc3370c1f39aa04

Sharing

Copy URL Twitter E-mail

General

Target

b2f18705d26d5f11ca9c1bfb5ebf25377d888e5fb32c83074bc3370c1f39aa04
Size

686KB
MD5

b6ac2a8bafd465fefb86ea7a7974a642
SHA1

3b8afab5cf2fb7ecb777a660f7e37000552c07a3
SHA256

b2f18705d26d5f11ca9c1bfb5ebf25377d888e5fb32c83074bc3370c1f39aa04
SHA512

97b8247532cc2900b7e48e257a6b28dc86a79cd659745a6c30ee05a1b895e5dde0588a8100befe7f55a7b249e11fa6d06eaa8eef1db0ebd108b5eb3c0fa146c2
SSDEEP

12288:emEBTASggJMutz4hDhFEouFeED0NO3yEU8m/udmipauZZZZ37nvEo8uICH8WQpXU:qBTNJMuJ0NovlbSWcXPQg/ooo3/VMIE4

Score

N/A

Malware Config

Signatures

Files

b2f18705d26d5f11ca9c1bfb5ebf25377d888e5fb32c83074bc3370c1f39aa04
.exe windows x86

bbdfd4ac54366ed53ba864cd9c34bc06

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

08/07/2013, 08:29

Not After

09/07/2014, 08:29

Subject

CN=Skytouch Technology Co.\, Limited,O=Skytouch Technology Co.\, Limited,L=HongKong,ST=HongKong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:e9:e8:d5:83:74:70:67:d9:33:b1:6d:fc:33:77:8a:0f:b3:e9:a6
Signer

Actual PE Digest

0c:e9:e8:d5:83:74:70:67:d9:33:b1:6d:fc:33:77:8a:0f:b3:e9:a6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skytouch Technology Co.\, Limited,O=Skytouch Technology Co.\, Limited,L=HongKong,ST=HongKong,C=HK

22/10/2013, 11:43
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetStdHandle
OutputDebugStringW
GetCurrentDirectoryA
WriteConsoleW
GetFileInformationByHandle
GetFileSize
WriteFile
ReadFile
SetFilePointer
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
WideCharToMultiByte
GetSystemDefaultLangID
GetModuleHandleW
GlobalAlloc
MultiByteToWideChar
GetProcAddress
GlobalFree
DeviceIoControl
GetVolumeInformationW
SetPriorityClass
FindFirstFileW
GetSystemWindowsDirectoryW
GetCurrentThread
OpenProcess
LoadLibraryW
CopyFileW
GetFileAttributesW
SetThreadPriority
GetFileSizeEx
FindClose
Process32FirstW
GlobalMemoryStatusEx
RemoveDirectoryW
SetProcessWorkingSetSize
Process32NextW
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetShortPathNameW
SetFileAttributesW
ExpandEnvironmentStringsW
FlushFileBuffers
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetEvent
SetUnhandledExceptionFilter
WaitForMultipleObjects
ReleaseMutex
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetSystemTime
SetEndOfFile
GetQueuedCompletionStatus
TerminateThread
RaiseException
InterlockedExchange
ResetEvent
GetExitCodeThread
PostQueuedCompletionStatus
GetSystemInfo
CreateIoCompletionPort
lstrlenW
SetEnvironmentVariableA
GetFullPathNameA
GetTimeZoneInformation
SetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
SetStdHandle
SetFilePointerEx
GetConsoleCP
FreeLibrary
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
HeapReAlloc
GetStringTypeW
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetProcessHeap
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileType
ExitProcess
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetVersionExW
MoveFileW
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
CreateMutexW
SizeofResource
CloseHandle
LoadResource
Sleep
WaitForSingleObject
GetLastError
LockResource
FreeResource
GetTickCount
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
InitializeCriticalSectionAndSpinCount
HeapSize
AreFileApisANSI
GetModuleHandleExW
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetLastError
UnhandledExceptionFilter
HeapDestroy
FatalAppExitA
LoadLibraryExW
ExitThread
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
HeapFree
GetCommandLineW
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedDecrement
InterlockedIncrement

user32

DrawTextW
ReleaseDC
EndPaint
SetCursor
UpdateLayeredWindow
ScreenToClient
GetWindowRect
PostQuitMessage
PostMessageW
GetClientRect
BeginPaint
PtInRect
GetDC
TranslateMessage
GetWindowLongW
SystemParametersInfoW
PeekMessageW
SetWindowLongW
GetCursorPos
ShowWindow
CreateDialogParamW
GetSystemMetrics
wvsprintfW
GetDesktopWindow
SendMessageW
MessageBoxW
AdjustWindowRect
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
MoveWindow
DefWindowProcW
wsprintfW

gdi32

SetTextColor
DeleteDC
CreateDIBSection
StretchBlt
GetDIBits
CreateDCW
SetBkMode
SetStretchBltMode
CreateFontIndirectW
GetObjectW
GetStockObject
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

AdjustTokenPrivileges
RegEnumKeyExW
RegDeleteValueW
LookupPrivilegeValueW
RegQueryInfoKeyW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

shell32

SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString

shlwapi

StrToIntW
PathRemoveFileSpecW
SHDeleteKeyW
PathAppendW
StrTrimW
StrCpyW
StrChrW
PathFileExistsW

msimg32

AlphaBlend

dbghelp

StackWalk64
SymFunctionTableAccess64
MiniDumpWriteDump
SymFromAddr
SymInitialize
SymGetModuleBase64
SymCleanup

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

winhttp

WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpSetOption
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpGetProxyForUrl

sensapi

IsNetworkAlive

psapi

EnumProcesses
EmptyWorkingSet
GetProcessMemoryInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetCheckConnectionW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetReadFile
InternetConnectW
InternetWriteFile
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpEndRequestW

gdiplus

GdipFillEllipseI
GdipDrawEllipseI
GdipGetImageGraphicsContext
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipFree
GdipDeletePen
GdipCloneBitmapAreaI
GdipGetImageHeight
GdipCreateBitmapFromStreamICM
GdipFillEllipse
GdipBitmapLockBits
GdipFillRectangle
GdipDrawRectangle
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipSetSmoothingMode
GdipCreateBitmapFromScan0
GdipDrawEllipse
GdipCloneBrush
GdipDrawImageRectRect
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipSetPenLineJoin
GdipCreatePen1
GdipGetImageWidth
GdipCreatePath
GdipImageRotateFlip
GdipDrawLineI
GdipCloneImage
GdipCreateFromHDC
GdipGetImageEncoders
GdipCreateImageAttributes
GdipDeletePath
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipDisposeImageAttributes
GdipAddPathLineI
GdipSetImageAttributesWrapMode
GdipDeleteGraphics
GdipDrawPath
GdipDrawImageRectRectI
GdipDeleteBrush

Sections

.text
Size: 515KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbdfd4ac54366ed53ba864cd9c34bc06

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30Certificate

Extended Key Usages

Key Usages

0c:e9:e8:d5:83:74:70:67:d9:33:b1:6d:fc:33:77:8a:0f:b3:e9:a6Signer

Signature Validations

Verification

22/10/2013, 11:43 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

dbghelp

rpcrt4

winhttp

sensapi

psapi

version

wininet

gdiplus

Sections

.text Size: 515KB - Virtual size: 514KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 35KB - Virtual size: 35KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30
Certificate

0c:e9:e8:d5:83:74:70:67:d9:33:b1:6d:fc:33:77:8a:0f:b3:e9:a6
Signer

22/10/2013, 11:43
Valid: false

.text
Size: 515KB - Virtual size: 514KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 35KB - Virtual size: 35KB