General

Malware Config

Signatures

Files

• 75bc46911cf423a0d66b61827840453f84815a8190e3576fd0980dd4a89d4c20

  .exe windows x86

  
  

  Code Sign

  61:42:0c:92:e0:19:42:0c:07:f4:a0:3a:bc:82:8e:4b

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

  Not Before

  29-01-2016 09:18

  Not After

  29-03-2017 09:18

  Subject

  CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftKernelCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1e:b1:32:d5:7e:79:68:96:0d:f2:6e:85:4e:b0:dd:a6

  Certificate

  Issuer

  CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Not Before

  01-01-2000 00:00

  Not After

  31-12-2099 23:59

  Subject

  CN=Fake TimeStamp Responder,OU=timestamp.pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-11-2014 00:58

  Not After

  08-11-2029 00:58

  Subject

  CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  1e:b1:32:d5

  Certificate

  Issuer

  CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Not Before

  01-01-2000 00:00

  Not After

  31-12-2099 23:59

  Subject

  CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1e:b1:32:d5:7e:79:68:96

  Certificate

  Issuer

  CN=JemmyLoveJenny EV Root CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Not Before

  01-01-2000 00:00

  Not After

  31-12-2099 23:59

  Subject

  CN=JemmyLoveJenny SHA1 TimeStamping Services CA,OU=pki.jemmylovejenny.tk,O=JemmyLoveJenny PKI Service,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  19:c2:85:30:e9:3b:36

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  17-09-2006 22:46

  Not After

  31-12-2019 23:59

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  01

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  17-09-2006 19:46

  Not After

  17-09-2036 19:46

  Subject

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageKeyEncipherment

  KeyUsageKeyAgreement

  KeyUsageCertSign

  KeyUsageCRLSign

  e6:55:ae:31:6c:bb:8f:c9:54:a1:7e:1a:ac:b1:93:7c:a9:32:32:04

  Signer

  Actual PE Digest

  e6:55:ae:31:6c:bb:8f:c9:54:a1:7e:1a:ac:b1:93:7c:a9:32:32:04

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Hengyida Information Technology CO.\,LTD.,O=Hengyida Information Technology CO.\,LTD.,L=Chengdu,ST=Sichuan,C=CN,1.2.840.113549.1.9.1=#0c1865617374726976657267726f7570407961686f6f2e636f6d

  18-02-2017 00:00

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ecode

  Size: 480KB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .beyond

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .adata

  Size: - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE