General

Malware Config

Signatures

Files

• 3ddde3e3ac0a5c7c59e6d426dfd2df4a127143b2b0726458f3aa97472d5a79a6

  .dll windows x86

  6533fa449b8ba4fd4a847e3a1fac95f1

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Not Before

  02-02-2021 15:35

  Not After

  06-03-2032 15:35

  Subject

  CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  20-06-2018 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  20-02-2019 00:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  04:00:00:00:00:01:21:58:53:08:a2

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  18-03-2009 10:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  3d:d0:49:fc:9e:2c:81:2d:09:5e:d9:ff:5d:b1:82:65:9b:4b:0b:c3:95:3b:bf:1e:e3:b9:d4:d4:33:79:ba:0c

  Signer

  Actual PE Digest

  3d:d0:49:fc:9e:2c:81:2d:09:5e:d9:ff:5d:b1:82:65:9b:4b:0b:c3:95:3b:bf:1e:e3:b9:d4:d4:33:79:ba:0c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  15-04-2021 12:59

  Valid: true

  Chain 1

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  e9:7d:2d:6f:15:6e:a1:94:03:1b:b8:27:e6:3f:2d:57:66:2a:f8:40

  Signer

  Actual PE Digest

  e9:7d:2d:6f:15:6e:a1:94:03:1b:b8:27:e6:3f:2d:57:66:2a:f8:40

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  15-04-2021 12:59

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetPrivateProfileStringW

  LocalAlloc

  InterlockedCompareExchange

  InterlockedExchange

  GetDiskFreeSpaceExW

  GetSystemDirectoryW

  GetLogicalDriveStringsW

  GetFileAttributesExW

  SetFilePointer

  GetEnvironmentVariableW

  LocalFree

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  RaiseException

  GetVersionExW

  GetTickCount

  CreateFileW

  ReadFile

  GetFileSize

  UnlockFile

  LockFile

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  CreateMutexW

  GetCurrentProcessId

  OpenProcess

  GetLongPathNameW

  MoveFileExW

  MoveFileW

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  GetFileAttributesW

  SetFileAttributesW

  GetFullPathNameW

  RemoveDirectoryW

  GetWindowsDirectoryW

  GetTempPathW

  lstrlenW

  FindClose

  SetLastError

  WideCharToMultiByte

  MultiByteToWideChar

  FindResourceExW

  FindResourceW

  GetModuleHandleW

  GetModuleFileNameW

  LoadLibraryW

  CreateEventW

  SizeofResource

  LoadResource

  SearchPathW

  FindFirstChangeNotificationW

  WriteFile

  FindCloseChangeNotification

  SetEndOfFile

  WriteConsoleW

  CompareFileTime

  GetFileInformationByHandle

  SwitchToThread

  GetShortPathNameW

  GetDriveTypeW

  WritePrivateProfileStringW

  GetCommandLineW

  LoadLibraryExW

  lstrcmpiW

  InterlockedDecrement

  InterlockedIncrement

  DecodePointer

  GlobalFindAtomW

  GlobalAddAtomW

  GetStartupInfoW

  CreateProcessW

  SetFileTime

  Sleep

  GetCurrentDirectoryW

  WaitForMultipleObjects

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  GetLastError

  GetCurrentProcess

  GetProcessHeap

  HeapSize

  HeapFree

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  SetFilePointerEx

  ReadConsoleW

  SetStdHandle

  SetConsoleCtrlHandler

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  IsValidCodePage

  FindNextFileA

  FindFirstFileExW

  FindFirstFileExA

  GetConsoleMode

  GetConsoleCP

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  GetTempFileNameW

  FormatMessageW

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetStringTypeW

  GetFileType

  GetStdHandle

  GetACP

  GetCurrentThread

  GetModuleFileNameA

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ResumeThread

  ExitThread

  CreateThread

  TlsFree

  TlsSetValue

  TlsGetValue

  GetProcAddress

  FreeLibrary

  LockResource

  TlsAlloc

  RtlUnwind

  InterlockedFlushSList

  GetSystemWindowsDirectoryW

  FreeResource

  lstrcmpiA

  lstrcmpA

  GetSystemTimeAsFileTime

  QueryPerformanceCounter

  WaitForSingleObjectEx

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  OpenEventW

  CreateDirectoryW

  CreateFileMappingW

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  FlushFileBuffers

  LoadLibraryExA

  VirtualFree

  VirtualAlloc

  IsProcessorFeaturePresent

  FlushInstructionCache

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  DeleteFileA

  CreateFileA

  GetTempFileNameA

  GetTempPathA

  CloseHandle

  GetVersion

  InitializeSListHead

  EncodePointer

  IsDebuggerPresent

  TerminateProcess

  GetExitCodeProcess

  CopyFileW

  OutputDebugStringA

  OutputDebugStringW

  GetFileSizeEx

  GetLocalTime

  ResetEvent

  GetSystemInfo

  MapViewOfFile

  UnmapViewOfFile

  DeviceIoControl

  user32

  GetWindowThreadProcessId

  GetClassInfoExW

  CreateWindowExW

  IsWindow

  ShowWindow

  UpdateLayeredWindow

  RegisterClassExW

  IsWindowVisible

  GetDC

  ReleaseDC

  UnregisterClassW

  FindWindowExW

  PostMessageW

  SetWindowRgn

  EndPaint

  SetWindowPos

  DefWindowProcW

  KillTimer

  SetTimer

  CharNextW

  CallWindowProcW

  GetClientRect

  IsDialogMessageW

  MessageBoxW

  wsprintfW

  RegisterWindowMessageW

  SendMessageTimeoutW

  SendNotifyMessageW

  FindWindowW

  UnionRect

  EqualRect

  PtInRect

  SetCursor

  DrawFocusRect

  DestroyCursor

  MoveWindow

  UnregisterClassA

  OffsetRect

  GetActiveWindow

  EndDialog

  DialogBoxParamW

  GetMonitorInfoW

  MonitorFromWindow

  LoadImageW

  GetWindow

  MapWindowPoints

  SetForegroundWindow

  GetSystemMetrics

  IsIconic

  PostQuitMessage

  GetWindowRect

  BringWindowToTop

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  GetParent

  FillRect

  ScreenToClient

  GetWindowTextLengthW

  SetWindowTextW

  InvalidateRect

  DrawTextW

  ReleaseCapture

  SetCapture

  GetAsyncKeyState

  GetFocus

  DestroyWindow

  UnhookWinEvent

  SetWinEventHook

  GetWindowTextW

  WaitForInputIdle

  SendMessageW

  GetShellWindow

  SystemParametersInfoW

  LoadCursorW

  SetWindowLongW

  GetWindowLongW

  CopyRect

  BeginPaint

  gdi32

  SetTextColor

  GetObjectW

  CreateDIBSection

  EnumFontFamiliesW

  SetBkMode

  SelectClipRgn

  SaveDC

  RestoreDC

  GetStockObject

  CreateRectRgnIndirect

  SetViewportOrgEx

  SelectObject

  DeleteObject

  DeleteDC

  CreateRectRgn

  CreateCompatibleDC

  CreateCompatibleBitmap

  CombineRgn

  BitBlt

  CreateFontW

  RectVisible

  OffsetViewportOrgEx

  advapi32

  SetNamedSecurityInfoW

  RegQueryValueExA

  RegOpenKeyExA

  RegEnumKeyExA

  CryptContextAddRef

  CryptDecrypt

  CryptEncrypt

  CryptImportKey

  CryptGenRandom

  CryptSetKeyParam

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegQueryValueExW

  RegOpenKeyExW

  RegEnumValueW

  RegCloseKey

  DuplicateTokenEx

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  OpenProcessToken

  GetUserNameW

  AllocateAndInitializeSid

  FreeSid

  CheckTokenMembership

  EqualSid

  DeleteAce

  LookupAccountSidW

  LookupAccountNameW

  SetEntriesInAclW

  GetExplicitEntriesFromAclW

  GetNamedSecurityInfoW

  CryptDestroyKey

  BuildExplicitAccessWithNameW

  GetTrusteeNameW

  ChangeServiceConfigW

  ChangeServiceConfig2W

  CloseServiceHandle

  ControlService

  CreateServiceW

  DeleteService

  LockServiceDatabase

  OpenSCManagerW

  OpenServiceW

  QueryServiceConfigW

  QueryServiceConfig2W

  QueryServiceLockStatusW

  QueryServiceStatus

  StartServiceW

  UnlockServiceDatabase

  CryptAcquireContextW

  CryptReleaseContext

  GetTokenInformation

  shell32

  SHGetFolderPathW

  SHChangeNotify

  SHCreateDirectoryExW

  CommandLineToArgvW

  SHLoadInProc

  SHGetPathFromIDListW

  SHBrowseForFolderW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderPathW

  ShellExecuteExW

  ord165

  ole32

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoUninitialize

  CoInitialize

  StringFromGUID2

  CoCreateInstance

  CoCreateGuid

  CoInitializeSecurity

  OleRun

  CoSetProxyBlanket

  CreateStreamOnHGlobal

  CoInitializeEx

  oleaut32

  VarUI4FromStr

  SysAllocString

  SysStringByteLen

  SysAllocStringByteLen

  VariantClear

  SysFreeString

  VariantInit

  GetErrorInfo

  VariantChangeType

  SetErrorInfo

  CreateErrorInfo

  SysStringLen

  VariantCopy

  shlwapi

  PathCombineW

  PathFindFileNameA

  StrTrimA

  StrCmpNIW

  SHGetValueA

  StrToIntExW

  StrCmpIW

  StrStrIA

  PathRenameExtensionA

  wnsprintfW

  PathIsPrefixW

  PathIsDirectoryW

  SHSetValueW

  SHDeleteValueW

  StrStrIW

  PathAppendW

  SHSetValueA

  PathIsRootW

  PathIsRelativeW

  PathRemoveFileSpecW

  SHGetValueW

  PathFindFileNameW

  PathFindExtensionW

  PathFileExistsW

  AssocQueryStringW

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  gdiplus

  GdipDrawImageRectRectI

  GdipDrawImagePointRectI

  GdipCreateBitmapFromFileICM

  GdipCreateBitmapFromStreamICM

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromStream

  GdipDisposeImage

  GdipCloneImage

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdiplusStartup

  GdiplusShutdown

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipAlloc

  GdipFree

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipCreatePen1

  GdipDeletePen

  GdipCreateImageAttributes

  GdipDisposeImageAttributes

  GdipSetImageAttributesColorMatrix

  GdipSetTextRenderingHint

  GdipDrawRectangleI

  GdipFillRectangleI

  GdipDrawImageRectRect

  GdipCreateFontFamilyFromName

  GdipDeleteFontFamily

  GdipCreateFont

  GdipDeleteFont

  GdipDrawString

  GdipMeasureString

  GdipCreateStringFormat

  GdipDeleteStringFormat

  GdipSetStringFormatFlags

  GdipSetStringFormatAlign

  psapi

  GetModuleFileNameExW

  EnumProcesses

  iphlpapi

  GetAdaptersInfo

  wininet

  InternetGetConnectedState

  urlmon

  URLDownloadToFileW

  URLDownloadToCacheFileW

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  setupapi

  SetupIterateCabinetW

  secur32

  GetUserNameExW

  crypt32

  CertGetNameStringW

  CryptStringToBinaryA

  CryptStringToBinaryW

  CryptBinaryToStringA

  CryptBinaryToStringW

  wintrust

  WinVerifyTrust

  WTHelperProvDataFromStateData

  Exports

  Exports

  BasicEntry

  Dll_Entry

  Start

  Sections

  .text

  Size: 977KB - Virtual size: 977KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 216KB - Virtual size: 215KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 50KB - Virtual size: 50KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ