d279a9a5edc4b62f2114a12ae69521be22ddd6edd2c8604686ed10b2a5bb9406

Sharing

Copy URL Twitter E-mail

General

Target

d279a9a5edc4b62f2114a12ae69521be22ddd6edd2c8604686ed10b2a5bb9406
Size

686KB
MD5

b060fd4af709d75e99423cbdb05b33bf
SHA1

6c304b7b5625497406128ef3d7387fb9b2ba39e6
SHA256

d279a9a5edc4b62f2114a12ae69521be22ddd6edd2c8604686ed10b2a5bb9406
SHA512

4ca072bf395732f1f303f239b8160f58fb7df1b8919c85d20f726813ba3c9432c48979fda6a1cdfc7ad2cf52591d858b0de5f93b2ac1a55bad3875c4e9a1b0d9
SSDEEP

12288:fmEBTASggJMutz4hDhFEouFeED0NO3yEU8m/udmipauZZZZ37nvEo8uICH8WQpXd:xBTNJMuJ0NovlbSWcXPQg/ooo3/VMIjM

Score

N/A

Malware Config

Signatures

Files

d279a9a5edc4b62f2114a12ae69521be22ddd6edd2c8604686ed10b2a5bb9406
.exe windows x86

bbdfd4ac54366ed53ba864cd9c34bc06

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

08/07/2013, 08:29

Not After

09/07/2014, 08:29

Subject

CN=Skytouch Technology Co.\, Limited,O=Skytouch Technology Co.\, Limited,L=HongKong,ST=HongKong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2c:87:b1:0b:44:86:17:8b:a7:f8:ba:73:dd:e5:47:08:16:43:da:69
Signer

Actual PE Digest

2c:87:b1:0b:44:86:17:8b:a7:f8:ba:73:dd:e5:47:08:16:43:da:69

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Skytouch Technology Co.\, Limited,O=Skytouch Technology Co.\, Limited,L=HongKong,ST=HongKong,C=HK

22/10/2013, 11:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetStdHandle
OutputDebugStringW
GetCurrentDirectoryA
WriteConsoleW
GetFileInformationByHandle
GetFileSize
WriteFile
ReadFile
SetFilePointer
GetLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
WideCharToMultiByte
GetSystemDefaultLangID
GetModuleHandleW
GlobalAlloc
MultiByteToWideChar
GetProcAddress
GlobalFree
DeviceIoControl
GetVolumeInformationW
SetPriorityClass
FindFirstFileW
GetSystemWindowsDirectoryW
GetCurrentThread
OpenProcess
LoadLibraryW
CopyFileW
GetFileAttributesW
SetThreadPriority
GetFileSizeEx
FindClose
Process32FirstW
GlobalMemoryStatusEx
RemoveDirectoryW
SetProcessWorkingSetSize
Process32NextW
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetShortPathNameW
SetFileAttributesW
ExpandEnvironmentStringsW
FlushFileBuffers
SetFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetEvent
SetUnhandledExceptionFilter
WaitForMultipleObjects
ReleaseMutex
CreateThread
GetCurrentThreadId
GetCurrentProcessId
GetSystemTime
SetEndOfFile
GetQueuedCompletionStatus
TerminateThread
RaiseException
InterlockedExchange
ResetEvent
GetExitCodeThread
PostQueuedCompletionStatus
GetSystemInfo
CreateIoCompletionPort
lstrlenW
SetEnvironmentVariableA
GetFullPathNameA
GetTimeZoneInformation
SetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
SetStdHandle
SetFilePointerEx
GetConsoleCP
FreeLibrary
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
HeapReAlloc
GetStringTypeW
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetProcessHeap
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileType
ExitProcess
GetCurrentProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetVersionExW
MoveFileW
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
FindResourceW
GetEnvironmentVariableW
GetModuleFileNameW
CreateMutexW
SizeofResource
CloseHandle
LoadResource
Sleep
WaitForSingleObject
GetLastError
LockResource
FreeResource
GetTickCount
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
InitializeCriticalSectionAndSpinCount
HeapSize
AreFileApisANSI
GetModuleHandleExW
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetLastError
UnhandledExceptionFilter
HeapDestroy
FatalAppExitA
LoadLibraryExW
ExitThread
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
HeapFree
GetCommandLineW
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedDecrement
InterlockedIncrement

user32

DrawTextW
ReleaseDC
EndPaint
SetCursor
UpdateLayeredWindow
ScreenToClient
GetWindowRect
PostQuitMessage
PostMessageW
GetClientRect
BeginPaint
PtInRect
GetDC
TranslateMessage
GetWindowLongW
SystemParametersInfoW
PeekMessageW
SetWindowLongW
GetCursorPos
ShowWindow
CreateDialogParamW
GetSystemMetrics
wvsprintfW
GetDesktopWindow
SendMessageW
MessageBoxW
AdjustWindowRect
CreateWindowExW
RegisterClassExW
LoadCursorW
DispatchMessageW
MoveWindow
DefWindowProcW
wsprintfW

gdi32

SetTextColor
DeleteDC
CreateDIBSection
StretchBlt
GetDIBits
CreateDCW
SetBkMode
SetStretchBltMode
CreateFontIndirectW
GetObjectW
GetStockObject
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

advapi32

AdjustTokenPrivileges
RegEnumKeyExW
RegDeleteValueW
LookupPrivilegeValueW
RegQueryInfoKeyW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

shell32

SHChangeNotify
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString

shlwapi

StrToIntW
PathRemoveFileSpecW
SHDeleteKeyW
PathAppendW
StrTrimW
StrCpyW
StrChrW
PathFileExistsW

msimg32

AlphaBlend

dbghelp

StackWalk64
SymFunctionTableAccess64
MiniDumpWriteDump
SymFromAddr
SymInitialize
SymGetModuleBase64
SymCleanup

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

winhttp

WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpSetOption
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpGetProxyForUrl

sensapi

IsNetworkAlive

psapi

EnumProcesses
EmptyWorkingSet
GetProcessMemoryInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetCheckConnectionW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetReadFile
InternetConnectW
InternetWriteFile
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpEndRequestW

gdiplus

GdipFillEllipseI
GdipDrawEllipseI
GdipGetImageGraphicsContext
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipFree
GdipDeletePen
GdipCloneBitmapAreaI
GdipGetImageHeight
GdipCreateBitmapFromStreamICM
GdipFillEllipse
GdipBitmapLockBits
GdipFillRectangle
GdipDrawRectangle
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipSetSmoothingMode
GdipCreateBitmapFromScan0
GdipDrawEllipse
GdipCloneBrush
GdipDrawImageRectRect
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipSetPenLineJoin
GdipCreatePen1
GdipGetImageWidth
GdipCreatePath
GdipImageRotateFlip
GdipDrawLineI
GdipCloneImage
GdipCreateFromHDC
GdipGetImageEncoders
GdipCreateImageAttributes
GdipDeletePath
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipDisposeImageAttributes
GdipAddPathLineI
GdipSetImageAttributesWrapMode
GdipDeleteGraphics
GdipDrawPath
GdipDrawImageRectRectI
GdipDeleteBrush

Sections

.text
Size: 515KB - Virtual size: 514KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbdfd4ac54366ed53ba864cd9c34bc06

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30Certificate

Extended Key Usages

Key Usages

2c:87:b1:0b:44:86:17:8b:a7:f8:ba:73:dd:e5:47:08:16:43:da:69Signer

Signature Validations

Verification

22/10/2013, 11:40 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

dbghelp

rpcrt4

winhttp

sensapi

psapi

version

wininet

gdiplus

Sections

.text Size: 515KB - Virtual size: 514KB

.rdata Size: 110KB - Virtual size: 109KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 35KB - Virtual size: 35KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:60:78:02:2f:a9:1c:0e:b6:13:26:e0:e8:fd:be:9c:30
Certificate

2c:87:b1:0b:44:86:17:8b:a7:f8:ba:73:dd:e5:47:08:16:43:da:69
Signer

22/10/2013, 11:40
Valid: false

.text
Size: 515KB - Virtual size: 514KB

.rdata
Size: 110KB - Virtual size: 109KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 35KB - Virtual size: 35KB