92b1eabcba5c0017b6fdd28a075fe7f7e4367b32b0a14523306684305b19c620

Sharing

Copy URL Twitter E-mail

General

Target

92b1eabcba5c0017b6fdd28a075fe7f7e4367b32b0a14523306684305b19c620
Size

129KB
MD5

7efbc4d4087743991a92bf0fbb2d6531
SHA1

28b42effc85ee9db30dae6858e444b1a9a480c70
SHA256

92b1eabcba5c0017b6fdd28a075fe7f7e4367b32b0a14523306684305b19c620
SHA512

6a9c974ae1b187881d9516ac3a072c3d6917148463bf9072b6ad5605677da26484706598710e7fe3310de5ca24bb956489e47473b3b4e4d1665d812f4ae4afc5
SSDEEP

1536:yM0rLe1YSaegVVxbfRcKyss4CppoGD4xcoLOEkp5:yM0e1Y5VVxbfRcKySdpOoLOEkp5

Score

N/A

Malware Config

Signatures

Files

92b1eabcba5c0017b6fdd28a075fe7f7e4367b32b0a14523306684305b19c620
.exe windows x86

1f65031e2576210379217f4019ce4d6a

Code Sign

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/02/2015, 00:00

Not After

05/04/2016, 23:59

Subject

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:6e:87:a5:c2:f3:d8:ac:4c:66:36:0a:10:36:a8:10:53:b7:59:da
Signer

Actual PE Digest

d5:6e:87:a5:c2:f3:d8:ac:4c:66:36:0a:10:36:a8:10:53:b7:59:da

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

20/01/2023, 16:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
FlushFileBuffers
DisconnectNamedPipe
WriteFile
TerminateThread
GetPrivateProfileIntW
ProcessIdToSessionId
LoadLibraryA
ConnectNamedPipe
GetTickCount
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
CreateNamedPipeW
LocalAlloc
WaitForSingleObject
SetEvent
CreateEventW
GetModuleFileNameW
GetLocalTime
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCommandLineW
GetCurrentProcess
TerminateProcess
GetLastError
GetFileAttributesW
Sleep
InterlockedExchange
OutputDebugStringW
OutputDebugStringA
CloseHandle
InterlockedCompareExchange
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapDestroy

user32

GetWindowLongW
DispatchMessageW
FindWindowW
PostMessageW
CreateWindowExW
SetWindowLongW
DefWindowProcW
GetMessageW

advapi32

DuplicateTokenEx
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
ChangeServiceConfig2W
CreateServiceW
DeleteService
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
ControlService
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CreateProcessAsUserW

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

StrCmpW
PathAppendW
PathFindFileNameW
PathFileExistsW
SHGetValueW

msvcr100

__CxxFrameHandler3
_CxxThrowException
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
??3@YAXPAX@Z
wmemcpy_s
memcpy_s
_beginthread
_wcsicmp
memmove_s
_vscwprintf
vswprintf_s
free
wcsstr
_wcslwr_s
calloc
wcschr
wcscpy_s
sprintf
_time64
??2@YAPAXI@Z
_beginthreadex
swscanf_s
_wtoi
srand
rand
_vsnwprintf_s
wcstoul
memset
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW

Exports

Exports

??4CUpdateSubModuleHelper@@QAEAAV0@ABV0@@Z

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kesyrsc
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1f65031e2576210379217f4019ce4d6a

Code Sign

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d5:6e:87:a5:c2:f3:d8:ac:4c:66:36:0a:10:36:a8:10:53:b7:59:daSigner

Signature Validations

Verification

20/01/2023, 16:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcr100

userenv

setupapi

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 38KB - Virtual size: 39KB

kesyrsc Size: - Virtual size: 4KB

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d5:6e:87:a5:c2:f3:d8:ac:4c:66:36:0a:10:36:a8:10:53:b7:59:da
Signer

20/01/2023, 16:00
Valid: false

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 38KB - Virtual size: 39KB

kesyrsc
Size: - Virtual size: 4KB