1e517e7448dc1aefb59b0b0984c231fe06183885cf0fbb0d288b122ed76fde69

Sharing

Copy URL Twitter E-mail

General

Target

1e517e7448dc1aefb59b0b0984c231fe06183885cf0fbb0d288b122ed76fde69
Size

5.1MB
MD5

115f64f4d04a7a0f8c10b03e3e17a663
SHA1

bf30ec17ff197031e6a523c896d0f404633b4caf
SHA256

1e517e7448dc1aefb59b0b0984c231fe06183885cf0fbb0d288b122ed76fde69
SHA512

832e81e8c72c8cf58da9ed7036641d1154d2962616e14f89b8b5ec1e95d8a051e99fa34f6ac88ff0f7363121ef746bd24739975733bcd686e6280d1b111d97d8
SSDEEP

98304:2snFZZ+pu9d/Y2YAPQm2Rkyha0uWsdOSDn:X+u/Y2p2RrkT

Score

N/A

Malware Config

Signatures

Files

1e517e7448dc1aefb59b0b0984c231fe06183885cf0fbb0d288b122ed76fde69
.exe windows x86

c527e51f945d79667ff6ef9b097506a2

Code Sign

21:bd:62:27:3f:b8:01:a8
Certificate

Issuer

CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN

Not Before

26/11/2014, 09:46

Not After

30/12/2030, 16:00

Subject

CN=GDCA TrustAUTH R4 Extended Validation CodeSigning CA,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:17:89:50:52:85:2c:e8:cb:d4:26:21:9e:f6:2b:ef
Certificate

Issuer

CN=GDCA TrustAUTH R4 EV CodeSigning CA,O=Global Digital Cybersecurity Authority Co.\, Ltd.,C=CN

Not Before

26/12/2018, 03:11

Not After

26/12/2019, 03:11

Subject

SERIALNUMBER=91440101MA59QJN634,CN=广州市录音啦网络科技有限公司,OU=IT中心,O=广州市录音啦网络科技有限公司,POSTALCODE=510000,STREET=广州市番禺区市桥街光明南路199号20号楼201之36,L=广州,ST=广东,C=CN,1.2.840.113549.1.9.1=#0c0e6c7579696e6c614071712e636f6d,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:97:31:71:71:d4:d4:6f
Certificate

Issuer

CN=GDCA TrustAUTH R4 Generic CA,O=Global Digital Cybersecurity Authority Co.\, Ltd.,C=CN

Not Before

14/03/2017, 06:51

Not After

12/03/2027, 06:51

Subject

CN=GDCA Timestamp Signer,OU=数安时代科技股份有限公司,L=广州市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:09:97:fe:f0:47:ea:7a
Certificate

Issuer

CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN

Not Before

26/11/2014, 05:13

Not After

31/12/2040, 15:59

Subject

CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:35:6a:9c:70:b4:55:78
Certificate

Issuer

CN=GDCA TrustAUTH R5 ROOT,O=GUANG DONG CERTIFICATE AUTHORITY CO.\,LTD.,C=CN

Not Before

07/04/2016, 09:58

Not After

30/12/2030, 16:00

Subject

CN=GDCA TrustAUTH R4 Generic CA,O=Global Digital Cybersecurity Authority Co.\, Ltd.,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:77:af:31:4c:6a:a8:fd:c9:19:f1:4d:71:62:a5:06:13:66:ef:50:ba:c5:76:cd:1c:97:71:00:c9:96:42:e4
Signer

Actual PE Digest

3c:77:af:31:4c:6a:a8:fd:c9:19:f1:4d:71:62:a5:06:13:66:ef:50:ba:c5:76:cd:1c:97:71:00:c9:96:42:e4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=91440101MA59QJN634,CN=广州市录音啦网络科技有限公司,OU=IT中心,O=广州市录音啦网络科技有限公司,POSTALCODE=510000,STREET=广州市番禺区市桥街光明南路199号20号楼201之36,L=广州,ST=广东,C=CN,1.2.840.113549.1.9.1=#0c0e6c7579696e6c614071712e636f6d,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e

13/01/2019, 03:38
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidToStringA
RpcStringFreeA
UuidFromStringA

iphlpapi

GetAdaptersInfo

shlwapi

PathAppendA
PathFileExistsA

winmm

midiOutReset
midiStreamStop
midiStreamClose
midiStreamRestart
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutReset
waveOutPause
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveInUnprepareHeader
waveInClose
waveInStart
waveInOpen
waveInStop
waveInReset
waveInAddBuffer
waveInPrepareHeader
waveInGetDevCapsA
waveInGetNumDevs
PlaySoundA
mciSendStringA

ws2_32

bind
htonl
socket
sendto
recvfrom
ioctlsocket
connect
recv
htons
getpeername
accept
getsockname
ntohs
__WSAFDIsSet
WSAGetLastError
WSAAsyncSelect
closesocket
send
select
WSACleanup
WSAStartup
gethostbyname
inet_ntoa
inet_addr
listen
gethostname

rasapi32

RasGetConnectStatusA
RasHangUpA

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA
AVIStreamGetFrame

kernel32

MapViewOfFile
CreateFileMappingA
LocalFree
TerminateThread
UnmapViewOfFile
FormatMessageA
GetWindowsDirectoryA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
HeapCreate
HeapDestroy
HeapSize
SetFilePointer
GetFileSize
TerminateProcess
GlobalMemoryStatus
LoadLibraryExA
SetLastError
GetTimeZoneInformation
GetLocaleInfoA
lstrcmpiA
FileTimeToSystemTime
GetLocalTime
VirtualFree
VirtualAlloc
LocalAlloc
lstrcpynA
GetThreadLocale
GetStartupInfoA
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
VirtualQuery
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetStringTypeExA
GetCPInfo
GetACP
EnumCalendarInfoA
InterlockedIncrement
InterlockedDecrement
FileTimeToLocalFileTime
DuplicateHandle
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GlobalGetAtomNameA
lstrcmpA
GlobalHandle
LocalReAlloc
GetFileTime
GetCurrentThread
SetThreadPriority
SuspendThread
GlobalFlags
SetErrorMode
GetProcessVersion
GetOEMCP
ExitThread
GetSystemTime
SetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetEnvironmentVariableA
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
GetSystemInfo
IsProcessorFeaturePresent
GetSystemDirectoryA
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
WaitForMultipleObjects
CreateFileA
DeviceIoControl
SetEvent
FindResourceA
LoadResource
LockResource
SizeofResource
ReadFile
lstrlenW
RemoveDirectoryA
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
GetFullPathNameA
FreeLibrary
LoadLibraryA
GetLastError
GetVersionExA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
ExpandEnvironmentStringsA
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
GetFileAttributesA
DeleteFileA
CopyFileA
CreateDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
MulDiv
GetCommandLineA
GetTickCount
CreateProcessA
WaitForSingleObject
CloseHandle
InterlockedExchange
GetVersion

user32

AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetSysColorBrush
RegisterHotKey
RegisterWindowMessageA
SetClipboardViewer
UnregisterHotKey
CharNextA
LoadStringA
GetKeyboardType
GetNextDlgTabItem
GetDlgItem
GetClassNameA
GetDesktopWindow
LoadMenuA
GetAsyncKeyState
UnionRect
GetForegroundWindow
GetWindowTextA
SetWindowTextA
GetMenuItemCount
GetMenuItemID
GetMenuStringA
GetMenuState
GetTabbedTextExtentA
DrawStateA
GrayStringA
TabbedTextOutA
WindowFromDC
EnumChildWindows
GetWindowDC
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
FrameRect
GetPropA
MoveWindow
CallWindowProcA
SetPropA
DrawTextA
GetCursor
LoadIconA
TranslateMessage
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
SystemParametersInfoA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetSystemMenu
DeleteMenu
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
SetRect
InflateRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
InvertRect
IsRectEmpty
ScrollDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
LockWindowUpdate
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
GetScrollPos
RegisterClassA
GetClassLongA
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
WaitForInputIdle
RemovePropA
GetMessageTime
GetLastActivePopup
GetWindowPlacement
EndDialog
CreateDialogIndirectParamA
DestroyWindow
EndPaint
BeginPaint
CharUpperA
GetWindowTextLengthA
CreateWindowExA
ChangeClipboardChain
CountClipboardFormats
EnumClipboardFormats
CreatePopupMenu
GetClipboardFormatNameA
ReleaseDC
UnregisterClassA

gdi32

GetBkMode
GetTextColor
CreateRoundRectRgn
CreateEllipticRgn
PathToRegion
EndPath
BeginPath
GetWindowOrgEx
GetViewportOrgEx
GetWindowExtEx
GetDIBits
RealizePalette
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
DeleteObject
SelectClipRgn
CreatePolygonRgn
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBrushIndirect
CreateHatchBrush
CreateBitmap
CreatePatternBrush
SelectObject
CreatePen
GetClipRgn
SetStretchBltMode
SetPixel
CreateDIBSection
StartPage
SetBkColor
SetBkMode
PatBlt
CombineRgn
SetTextColor
CreateRectRgn
FillRgn
CreateSolidBrush
CreateFontIndirectA
GetStockObject
GetObjectA
SetWindowOrgEx
EndPage
EndDoc
DeleteDC
SaveDC
StartDocA
RestoreDC
CreatePenIndirect
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
SetWindowExtEx
SetMapMode
ExtCreatePen
StrokePath
StrokeAndFillPath
FillPath
PlayMetaFileRecord
EnumMetaFile
GetRgnBox
OffsetRgn
PtInRegion
CloseMetaFile
LineTo
MoveToEx
CreateMetaFileA
DeleteMetaFile
SetDIBitsToDevice
CreateFontA
TranslateCharsetInfo
SetPolyFillMode
SetROP2
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
GetCurrentPositionEx
PolyBezierTo
ExtSelectClipRgn
GetViewportExtEx
GetTextMetricsA
GetMapMode
BitBlt
GetPixel
CreateCompatibleDC
SetPixelV
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
Pie
Chord
Arc
Polygon
GetTextExtentPoint32A
CreateRectRgnIndirect
GetDeviceCaps

msimg32

GradientFill

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA
PrintDlgA
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ChooseColorA
ChooseFontA

advapi32

RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueA

shell32

Shell_NotifyIconA
DragQueryFileA
DragFinish
DragAcceptFiles
SHGetSpecialFolderPathA
ShellExecuteA

ole32

CLSIDFromString
OleUninitialize
OleInitialize
CoCreateGuid
CLSIDFromProgID
CreateStreamOnHGlobal
CoCreateInstance
OleRun
CoTaskMemFree

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElement
VariantCopyInd
VariantInit
SysAllocString
SafeArrayDestroy
SafeArrayCreate
SafeArrayPutElement
RegisterTypeLi
LHashValOfNameSys
LoadTypeLi
OleCreatePictureIndirect
SafeArrayGetDim
OleLoadPicture
SysFreeString
SafeArrayGetLBound
SysAllocStringLen
SysStringLen
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy
UnRegisterTypeLi

comctl32

ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_SetBkColor
ImageList_DragMove
ImageList_Draw
_TrackMouseEvent
ImageList_AddMasked
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_GetIcon
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_Write
ImageList_Read
ord17
ImageList_EndDrag
ImageList_DragShowNolock

wininet

InternetCloseHandle
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetSetOptionA
InternetOpenA

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CODE
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 711KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c527e51f945d79667ff6ef9b097506a2

Code Sign

21:bd:62:27:3f:b8:01:a8Certificate

Key Usages

42:17:89:50:52:85:2c:e8:cb:d4:26:21:9e:f6:2b:efCertificate

Extended Key Usages

Key Usages

6c:97:31:71:71:d4:d4:6fCertificate

Extended Key Usages

Key Usages

7d:09:97:fe:f0:47:ea:7aCertificate

Key Usages

28:35:6a:9c:70:b4:55:78Certificate

Key Usages

3c:77:af:31:4c:6a:a8:fd:c9:19:f1:4d:71:62:a5:06:13:66:ef:50:ba:c5:76:cd:1c:97:71:00:c9:96:42:e4Signer

Signature Validations

Verification

13/01/2019, 03:38 Valid: false

Headers

File Characteristics

Imports

rpcrt4

iphlpapi

shlwapi

winmm

ws2_32

rasapi32

msvfw32

avifil32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

wininet

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

CODE Size: 36KB - Virtual size: 34KB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 248KB - Virtual size: 711KB

DATA Size: 4KB - Virtual size: 1KB

BSS Size: 24KB - Virtual size: 22KB

.rsrc Size: 100KB - Virtual size: 97KB

21:bd:62:27:3f:b8:01:a8
Certificate

42:17:89:50:52:85:2c:e8:cb:d4:26:21:9e:f6:2b:ef
Certificate

6c:97:31:71:71:d4:d4:6f
Certificate

7d:09:97:fe:f0:47:ea:7a
Certificate

28:35:6a:9c:70:b4:55:78
Certificate

3c:77:af:31:4c:6a:a8:fd:c9:19:f1:4d:71:62:a5:06:13:66:ef:50:ba:c5:76:cd:1c:97:71:00:c9:96:42:e4
Signer

13/01/2019, 03:38
Valid: false

.text
Size: 2.7MB - Virtual size: 2.7MB

CODE
Size: 36KB - Virtual size: 34KB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 248KB - Virtual size: 711KB

DATA
Size: 4KB - Virtual size: 1KB

BSS
Size: 24KB - Virtual size: 22KB

.rsrc
Size: 100KB - Virtual size: 97KB