80bae29f567f244b81456d999039ed9aae02de19b92f3bec9bc1d1b38f773501

Sharing

Copy URL Twitter E-mail

General

Target

80bae29f567f244b81456d999039ed9aae02de19b92f3bec9bc1d1b38f773501
Size

1.6MB
MD5

090d26c84eb122cb2560d4c386ecc7c6
SHA1

e84abf7051781f1e8c3c0657a239122d314a281b
SHA256

80bae29f567f244b81456d999039ed9aae02de19b92f3bec9bc1d1b38f773501
SHA512

df91bac10d8e5701eaffd1b92d507fc726c2dc1153bafab98cd1d8cb372d698d07e379d3977d317809d0a93d5b6638af0f29664fd2a11339d6acc2174283f2f5
SSDEEP

49152:V+hNr1hwjiuQO63H6A/MsUDW7SsKp4CXQqw4EDl:VYvujlQO63H6bR5wtDl

Score

1^/10

Malware Config

Signatures

Files

80bae29f567f244b81456d999039ed9aae02de19b92f3bec9bc1d1b38f773501
.dll windows x86

5774734b3f34bc8eabac3f454f2a6852

Code Sign

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19/06/2018, 00:00

Not After

04/07/2021, 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Wan Chai,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

19/06/2018, 00:00

Not After

04/07/2021, 23:59

Subject

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Wan Chai,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:57:04:a0:f4:af:34:3e:04:bb:0d:5c:da:dd:af:ad:8c:b4:ba:21:b2:3f:79:46:6b:e5:cd:47:09:13:cd:89
Signer

Actual PE Digest

42:57:04:a0:f4:af:34:3e:04:bb:0d:5c:da:dd:af:ad:8c:b4:ba:21:b2:3f:79:46:6b:e5:cd:47:09:13:cd:89

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Wan Chai,C=HK

24/02/2021, 08:23
Valid: false

9f:f8:dc:40:62:90:b3:36:9b:16:a4:91:7f:51:b5:26:7e:18:83:aa
Signer

Actual PE Digest

9f:f8:dc:40:62:90:b3:36:9b:16:a4:91:7f:51:b5:26:7e:18:83:aa

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tenorshare Co.\,Ltd.,O=Tenorshare Co.\,Ltd.,L=Wan Chai,C=HK

24/02/2021, 08:23
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree

user32

EmptyClipboard

advapi32

GetUserNameA

wininet

InternetConnectA

Exports

Exports

Entry

Sections

KpcDOrKU
Size: - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

seEkaCQV
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

XvMocDQX
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vfEmIoJm
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5774734b3f34bc8eabac3f454f2a6852

Code Sign

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

42:57:04:a0:f4:af:34:3e:04:bb:0d:5c:da:dd:af:ad:8c:b4:ba:21:b2:3f:79:46:6b:e5:cd:47:09:13:cd:89Signer

Signature Validations

Verification

24/02/2021, 08:23 Valid: false

9f:f8:dc:40:62:90:b3:36:9b:16:a4:91:7f:51:b5:26:7e:18:83:aaSigner

Signature Validations

Verification

24/02/2021, 08:23 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

wininet

Exports

Exports

Sections

KpcDOrKU Size: - Virtual size: 136KB

seEkaCQV Size: - Virtual size: 64KB

XvMocDQX Size: 2KB - Virtual size: 4KB

vfEmIoJm Size: 1.6MB - Virtual size: 1.6MB

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:78:fe:14:2a:9b:29:35:58:d9:34:dd:93:b8:f3:a1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

42:57:04:a0:f4:af:34:3e:04:bb:0d:5c:da:dd:af:ad:8c:b4:ba:21:b2:3f:79:46:6b:e5:cd:47:09:13:cd:89
Signer

24/02/2021, 08:23
Valid: false

9f:f8:dc:40:62:90:b3:36:9b:16:a4:91:7f:51:b5:26:7e:18:83:aa
Signer

24/02/2021, 08:23
Valid: false

KpcDOrKU
Size: - Virtual size: 136KB

seEkaCQV
Size: - Virtual size: 64KB

XvMocDQX
Size: 2KB - Virtual size: 4KB

vfEmIoJm
Size: 1.6MB - Virtual size: 1.6MB