General

Malware Config

Signatures

Files

• 专业正式版 (VS2013 MSDN原版完整ISO镜像)[email protected]

  .exe windows x86

  
  

  Code Sign

  6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47

  Certificate

  Issuer

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Not Before

  15-08-2017 07:55

  Not After

  15-08-2028 07:55

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2039 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2b:6b:d6:54:59:d7:0c:d8:e2:13:b1:c4:11:3b:e2:13

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  18-04-2015 00:58

  Not After

  18-04-2025 00:58

  Subject

  CN=WoSign EV Code Signing CA,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-04-2015 00:58

  Not After

  08-04-2025 00:58

  Subject

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  19:db:57:1a:e7:52:5a:9e:7b:c8:ad:60:e4:3e:cd:34

  Certificate

  Issuer

  CN=WoSign EV Code Signing CA,O=WoSign CA Limited,C=CN

  Not Before

  21-10-2016 07:02

  Not After

  21-12-2019 07:02

  Subject

  SERIALNUMBER=91110108680483375H,CN=Riyue Tongxing Information Technology (Beijing) Co.\, Ltd.,O=Riyue Tongxing Information Technology (Beijing) Co.\, Ltd.,POSTALCODE=100192,STREET=Suite B801A\, 8/F\, Block B of Technology & Fortune Center\, No.8\, Xueqing Road\, Haidian District,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  19:c2:85:30:e9:3b:36

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  17-09-2006 22:46

  Not After

  31-12-2019 23:59

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47

  Certificate

  Issuer

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Not Before

  15-08-2017 07:55

  Not After

  15-08-2028 07:55

  Subject

  CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-04-2015 00:58

  Not After

  08-04-2025 00:58

  Subject

  CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2039 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  db:76:f0:d4:31:eb:3d:ae:f8:4c:a9:56:bb:9e:b6:20:14:03:8c:ea:ef:4f:f7:58:d9:dd:ef:ac:65:cf:6b:64

  Signer

  Actual PE Digest

  db:76:f0:d4:31:eb:3d:ae:f8:4c:a9:56:bb:9e:b6:20:14:03:8c:ea:ef:4f:f7:58:d9:dd:ef:ac:65:cf:6b:64

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  SERIALNUMBER=91110108680483375H,CN=Riyue Tongxing Information Technology (Beijing) Co.\, Ltd.,O=Riyue Tongxing Information Technology (Beijing) Co.\, Ltd.,POSTALCODE=100192,STREET=Suite B801A\, 8/F\, Block B of Technology & Fortune Center\, No.8\, Xueqing Road\, Haidian District,L=Beijing,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  21-06-2018 08:45

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  UPX0

  Size: - Virtual size: 1.1MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 849KB - Virtual size: 852KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 29KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 149KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 1024B - Virtual size: 806B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 60B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 98KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 474KB - Virtual size: 474KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ