64b0d4ff01dc13572b748c0caa19d797aa6841994a90e5643d23dd5c692c0f17

Sharing

Copy URL

Twitter E-mail

General

Target

64b0d4ff01dc13572b748c0caa19d797aa6841994a90e5643d23dd5c692c0f17
Size

2.3MB
MD5

93b9f5bf918b7e5de262a85214aa8fea
SHA1

0b7dfbb9266942356dfecdd0c76c5eb4bb5c0422
SHA256

64b0d4ff01dc13572b748c0caa19d797aa6841994a90e5643d23dd5c692c0f17
SHA512

f0623a3821f41671e68d5a66ffa3ee61512525878855b13061912c173f9d4c437e7d16867b9f6a59bca8be8b6992aff63f3f54c05e1b9c33ae4530a0679491a9
SSDEEP

24576:6122eyR3deGLPN5MaifsiDeMlJvtaBZ8X45FlkhkaSQ8I7IC+jLq38OHD:0h0GLPN5Ma3ebMZ8X45FO6Q8S+jLq3j

Score

1^/10

Malware Config

Signatures

Files

64b0d4ff01dc13572b748c0caa19d797aa6841994a90e5643d23dd5c692c0f17
.exe windows x86

85a54fad2bd6b77afdc3a0e3e1364550

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

04-09-2020 00:00

Not After

04-10-2023 23:59

Subject

CN=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,OU=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,O=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

04-09-2020 00:00

Not After

04-10-2023 23:59

Subject

CN=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,OU=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,O=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:25:a7:7a:48:3f:9e:57:ae:37:df:59:1b:f4:b3:e8:d8:ef:c5:56:8c:47:4f:de:b4:d7:0e:bc:33:bf:72:7a
Signer

Actual PE Digest

b8:25:a7:7a:48:3f:9e:57:ae:37:df:59:1b:f4:b3:e8:d8:ef:c5:56:8c:47:4f:de:b4:d7:0e:bc:33:bf:72:7a

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,OU=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,O=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN

27-05-2021 02:54
Valid: false

4d:f3:03:3e:a0:5f:f1:0b:d3:0c:d4:ff:52:90:fb:9c:88:17:46:ac
Signer

Actual PE Digest

4d:f3:03:3e:a0:5f:f1:0b:d3:0c:d4:ff:52:90:fb:9c:88:17:46:ac

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,OU=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,O=Xiamen Tiaozhiting Software Technology Co.\, Ltd.,L=Xiamen,ST=Fujian,C=CN

23-03-2023 16:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreateMutexA
CreateNamedPipeW
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
DeleteFileW
DeviceIoControl
DuplicateHandle
ExitProcess
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetWindowsDirectoryW
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RemoveDirectoryW
RtlCaptureContext
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnmapViewOfFile
VirtualProtect
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WriteConsoleW
WriteFileEx
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetHandleInformation
GetProcessAffinityMask
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
OutputDebugStringA
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SuspendThread
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualQuery

ole32

CoCreateGuid

oleaut32

GetErrorInfo
SetErrorInfo
SysAllocStringLen
SysFreeString
SysStringLen

userenv

GetUserProfileDirectoryW

ws2_32

WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown

msvcrt

__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_fmode
_fpreset
_initterm
_iob
_lock
_onexit
_setjmp3
_strdup
_ultoa
_unlock
abort
calloc
exit
fprintf
free
fwrite
longjmp
malloc
memcmp
memcpy
memmove
memset
printf
realloc
signal
strlen
strncmp
vfprintf
wcslen

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 310KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85a54fad2bd6b77afdc3a0e3e1364550

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

b8:25:a7:7a:48:3f:9e:57:ae:37:df:59:1b:f4:b3:e8:d8:ef:c5:56:8c:47:4f:de:b4:d7:0e:bc:33:bf:72:7aSigner

Signature Validations

Verification

27-05-2021 02:54 Valid: false

4d:f3:03:3e:a0:5f:f1:0b:d3:0c:d4:ff:52:90:fb:9c:88:17:46:acSigner

Signature Validations

Verification

23-03-2023 16:09 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ole32

oleaut32

userenv

ws2_32

msvcrt

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.data Size: 512B - Virtual size: 252B

.rdata Size: 310KB - Virtual size: 309KB

.eh_fram Size: 378KB - Virtual size: 377KB

.bss Size: - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 64B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 364KB - Virtual size: 363KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

43:89:37:16:8c:35:67:18:f7:08:63:00:c5:78:34:35
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

b8:25:a7:7a:48:3f:9e:57:ae:37:df:59:1b:f4:b3:e8:d8:ef:c5:56:8c:47:4f:de:b4:d7:0e:bc:33:bf:72:7a
Signer

27-05-2021 02:54
Valid: false

4d:f3:03:3e:a0:5f:f1:0b:d3:0c:d4:ff:52:90:fb:9c:88:17:46:ac
Signer

23-03-2023 16:09
Valid: false

.text
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 512B - Virtual size: 252B

.rdata
Size: 310KB - Virtual size: 309KB

.eh_fram
Size: 378KB - Virtual size: 377KB

.bss
Size: - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 64B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 364KB - Virtual size: 363KB