General

Malware Config

Signatures

Files

• infected (2).rar

  .rar
• infected (2)/1/Application.exe

  .exe windows x86

  50744a0a61693b7f1394d0365708fbe2

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:ee:cc:f7:3f:05:11:35:54:88:70:d3:38:6e:4a:9c

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  24-12-2019 00:00

  Not After

  04-01-2023 12:00

  Subject

  CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=Shenzhen,ST=Guangdong,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:8b:b5:c7:e9:a7:cb:34:5e:78:d0:20:04:20:24:00

  Certificate

  Issuer

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  25-12-2019 00:00

  Not After

  04-01-2023 12:00

  Subject

  SERIALNUMBER=91440300746612636Q,CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

  Certificate

  Issuer

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  18-04-2012 12:00

  Not After

  18-04-2027 12:00

  Subject

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  28:9e:fc:5f:2c:c6:f4:82:35:55:3b:ce:76:bf:c7:e5:f3:d4:0c:9e:3d:6a:7c:3c:69:c7:ad:b7:f3:42:12:d5

  Signer

  Actual PE Digest

  28:9e:fc:5f:2c:c6:f4:82:35:55:3b:ce:76:bf:c7:e5:f3:d4:0c:9e:3d:6a:7c:3c:69:c7:ad:b7:f3:42:12:d5

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=91440300746612636Q,CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  20-12-2021 06:56

  Valid: true

  Chain 1

  SERIALNUMBER=91440300746612636Q,CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  8a:26:6e:03:ba:05:31:63:82:a9:0d:91:cd:e9:65:ff:e5:a5:55:7a

  Signer

  Actual PE Digest

  8a:26:6e:03:ba:05:31:63:82:a9:0d:91:cd:e9:65:ff:e5:a5:55:7a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=Shenzhen,ST=Guangdong,C=CN

  20-12-2021 06:56

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GlobalFindAtomW

  HeapAlloc

  DecodePointer

  HeapDestroy

  GetProcAddress

  GetFileSize

  DeleteCriticalSection

  GetProcessHeap

  CopyFileW

  WideCharToMultiByte

  OpenMutexW

  SetDllDirectoryW

  LoadLibraryExW

  SetLastError

  GetCurrentProcess

  TerminateProcess

  Sleep

  GetCurrentThread

  LocalFree

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  lstrlenW

  UnmapViewOfFile

  GetModuleHandleW

  lstrcpyW

  CreateFileMappingW

  CreateEventA

  MapViewOfFileEx

  GetFullPathNameW

  LoadLibraryExA

  FindResourceW

  WriteConsoleW

  SetEndOfFile

  SetFilePointerEx

  GetConsoleCP

  FlushFileBuffers

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  ReadConsoleW

  GetConsoleMode

  GetFileType

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  WriteFile

  GetStdHandle

  ExitProcess

  GetModuleHandleExW

  FreeLibraryAndExitThread

  ExitThread

  CreateThread

  LoadResource

  FindResourceExW

  LoadLibraryW

  RaiseException

  CloseHandle

  HeapReAlloc

  DeleteFileW

  LockResource

  SetEvent

  GetLastError

  GetPrivateProfileStringW

  MultiByteToWideChar

  CreateEventW

  HeapSize

  GlobalAddAtomW

  CreateFileW

  WaitForSingleObject

  FindClose

  InitializeCriticalSectionEx

  CreateMutexW

  GetTempPathW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetModuleFileNameW

  RemoveDirectoryW

  VirtualAlloc

  FindNextFileW

  VirtualFree

  ReadFile

  HeapFree

  WritePrivateProfileStringW

  FindFirstFileW

  RtlUnwind

  InitializeSListHead

  GetCurrentProcessId

  QueryPerformanceCounter

  GetStartupInfoW

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  ResetEvent

  OutputDebugStringW

  IsDebuggerPresent

  GetCPInfo

  SizeofResource

  LoadLibraryA

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  GetSystemTimeAsFileTime

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  EncodePointer

  GetFileAttributesW

  GetVersionExA

  GetCurrentThreadId

  SuspendThread

  ResumeThread

  GetThreadContext

  SetThreadContext

  FlushInstructionCache

  VirtualProtect

  VirtualQuery

  FreeLibrary

  lstrcatA

  GetFileAttributesA

  lstrcpyA

  WritePrivateProfileStringA

  CreateDirectoryA

  GetPrivateProfileStringA

  SetPriorityClass

  DeviceIoControl

  GetVolumeInformationA

  CreateFileA

  user32

  FindWindowW

  GetMessageW

  SendMessageW

  DispatchMessageW

  PeekMessageW

  TranslateMessage

  PostThreadMessageW

  GetWindowLongW

  DefWindowProcW

  PostMessageW

  DestroyWindow

  CreateWindowExW

  RegisterClassExW

  IsWindow

  ChangeWindowMessageFilter

  SetWindowLongW

  advapi32

  GetSecurityDescriptorGroup

  GetSecurityDescriptorSacl

  GetSecurityDescriptorDacl

  GetSecurityDescriptorControl

  GetSecurityDescriptorOwner

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  GetSecurityDescriptorLength

  MakeSelfRelativeSD

  shell32

  SHGetSpecialFolderPathA

  SHCreateDirectoryExW

  CommandLineToArgvW

  ShellExecuteExW

  SHGetFolderPathW

  ole32

  CoInitialize

  CoUninitialize

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  iphlpapi

  GetAdaptersInfo

  ws2_32

  socket

  WSAStartup

  closesocket

  libexpat

  ord16

  ord25

  ord48

  ord52

  ord20

  ord50

  ord21

  ord35

  shlwapi

  StrCmpNIW

  StrCmpIW

  PathAppendW

  PathFileExistsW

  PathCombineW

  PathRemoveFileSpecW

  PathAddBackslashW

  StrStrIW

  PathFindExtensionW

  Sections

  .text

  Size: 255KB - Virtual size: 255KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 72KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .detourc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .detourd

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 201KB - Virtual size: 200KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• infected (2)/1/XLGameUpdate.exe

  .exe windows x86

  a5b8c71c00cf895efd87915ccf4e0402

  
  

  Code Sign

  47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  16-03-2016 00:00

  Not After

  16-03-2024 00:00

  Subject

  CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageOCSPSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:b9:e7:0d:5f:46:0f:e8:49:e8:72:ab

  Certificate

  Issuer

  CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

  Not Before

  18-11-2019 10:31

  Not After

  14-11-2022 12:05

  Subject

  CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  29-03-2022 00:00

  Not After

  14-03-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  19-09-2018 00:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  15-06-2016 00:00

  Not After

  15-06-2024 00:00

  Subject

  CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageOCSPSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2c:59:62:6e:dd:71:d6:09:dc:c2:7c:ec

  Certificate

  Issuer

  CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

  Not Before

  15-11-2019 09:38

  Not After

  15-11-2022 09:38

  Subject

  CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  11-05-2022 00:00

  Not After

  10-08-2033 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3d:8f:e2:2b:b4:75:32:7e:43:4b:04:09:25:86:c0:12:70:99:ec:86:d9:93:15:ee:9a:a3:7f:b6:cc:61:42:87

  Signer

  Actual PE Digest

  3d:8f:e2:2b:b4:75:32:7e:43:4b:04:09:25:86:c0:12:70:99:ec:86:d9:93:15:ee:9a:a3:7f:b6:cc:61:42:87

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

  30-03-2023 11:03

  Valid: false

  6c:88:91:5a:31:dc:25:58:5a:7a:6d:65:e4:15:c4:83:fa:c4:a1:54

  Signer

  Actual PE Digest

  6c:88:91:5a:31:dc:25:58:5a:7a:6d:65:e4:15:c4:83:fa:c4:a1:54

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

  17-08-2022 09:12

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  ProcessIdToSessionId

  OutputDebugStringW

  RemoveDirectoryW

  MoveFileExW

  GetFileAttributesW

  QueryPerformanceCounter

  FindNextFileW

  CreateDirectoryW

  SetFileAttributesW

  SetFilePointer

  SystemTimeToFileTime

  GetCurrentDirectoryW

  LocalFileTimeToFileTime

  LoadLibraryExW

  LocalFree

  InitializeCriticalSection

  DeleteCriticalSection

  SetEnvironmentVariableA

  GetPrivateProfileIntW

  GetSystemTimeAsFileTime

  OpenFileMappingW

  GetTickCount

  CreateEventW

  GetCurrentProcess

  GetCurrentThreadId

  GetModuleFileNameW

  WaitForSingleObject

  SetEvent

  DecodePointer

  GetModuleHandleW

  InitializeCriticalSectionAndSpinCount

  RaiseException

  WideCharToMultiByte

  CreateFileMappingW

  UnmapViewOfFile

  MapViewOfFile

  SetNamedPipeHandleState

  MultiByteToWideChar

  GetVersionExW

  LoadLibraryW

  GetSystemDirectoryW

  FreeLibrary

  DeleteFileW

  FindClose

  ReadFile

  CopyFileW

  FindFirstFileW

  GetFileSize

  CloseHandle

  WriteFile

  CreateFileW

  GetLastError

  GetModuleHandleExW

  GetProcAddress

  InterlockedExchange

  SetLastError

  MoveFileW

  GetLocalTime

  LeaveCriticalSection

  EnterCriticalSection

  WriteConsoleW

  ReadConsoleW

  SetEndOfFile

  SetStdHandle

  SetFilePointerEx

  FlushFileBuffers

  GetConsoleMode

  GetConsoleCP

  GetTimeZoneInformation

  HeapReAlloc

  GetOEMCP

  GetACP

  IsValidCodePage

  GetCommandLineW

  GetFullPathNameW

  PeekNamedPipe

  GetFileInformationByHandle

  FileTimeToLocalFileTime

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetFileType

  GetStdHandle

  GetProcessHeap

  HeapSize

  AreFileApisANSI

  DeviceIoControl

  GetCurrentProcessId

  GetStringTypeW

  EncodePointer

  GetSystemInfo

  GetModuleFileNameA

  HeapFree

  FindFirstFileExW

  GetDriveTypeW

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapAlloc

  RtlUnwind

  GetCPInfo

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  ExitProcess

  user32

  PostQuitMessage

  IsWindow

  TranslateMessage

  GetMessageW

  SendMessageTimeoutW

  DispatchMessageW

  FindWindowA

  advapi32

  RegOpenKeyExA

  RegCloseKey

  RegOpenKeyExW

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  SetEntriesInAclW

  GetSecurityDescriptorDacl

  ConvertStringSidToSidW

  RegSetKeySecurity

  RegGetKeySecurity

  RegSetValueExW

  RegQueryValueExW

  RegCreateKeyExW

  RegQueryValueExA

  shell32

  CommandLineToArgvW

  ord165

  SHGetSpecialFolderPathW

  SHGetFolderPathW

  ole32

  CLSIDFromString

  CoTaskMemFree

  netapi32

  Netbios

  shlwapi

  PathFileExistsW

  PathRelativePathToW

  basicnetutils

  ?ReleaseNetManager@basic_net@@YAHPAVINetManager@1@@Z

  ?GetNetManager@basic_net@@YAPAVINetManager@1@H@Z

  Sections

  .text

  Size: 307KB - Virtual size: 307KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 71KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• infected (2)/1/libexpat.dll

  .dll windows x86

  b8a82892ba244ad91efe22d229623ec3

  
  

  Code Sign

  04:00:00:00:00:01:2f:4e:e1:52:d7

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  24-05-2016 00:00

  Not After

  24-06-2027 00:00

  Subject

  CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  04-03-2014 00:00

  Not After

  03-03-2024 23:59

  Subject

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:71:dd:fd:2e:98:d4:c3:c9:fd:c2:c8:b4:52:c6:fc

  Certificate

  Issuer

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  29-03-2018 00:00

  Not After

  28-03-2020 23:59

  Subject

  SERIALNUMBER=91440300746612636Q,CN=ShenZhen Thunder Networking Technologies Ltd.,OU=IT,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e5a68656e,1.3.6.1.4.1.311.60.2.1.2=#13084775616e446f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  26:75:54:07:3f:c5:03:a4:14:1f:2e:e9:cc:f4:ea:33:c7:d9:10:e2

  Signer

  Actual PE Digest

  26:75:54:07:3f:c5:03:a4:14:1f:2e:e9:cc:f4:ea:33:c7:d9:10:e2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  SERIALNUMBER=91440300746612636Q,CN=ShenZhen Thunder Networking Technologies Ltd.,OU=IT,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e5a68656e,1.3.6.1.4.1.311.60.2.1.2=#13084775616e446f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

  16-04-2019 11:13

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  InterlockedPushEntrySList

  InterlockedFlushSList

  RtlUnwind

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  GetModuleFileNameW

  MultiByteToWideChar

  WideCharToMultiByte

  HeapFree

  HeapAlloc

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  HeapReAlloc

  GetCurrentThread

  FindClose

  FindFirstFileExA

  FindFirstFileExW

  FindNextFileA

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetEnvironmentVariableW

  GetProcessHeap

  GetStdHandle

  GetFileType

  SetConsoleCtrlHandler

  GetStringTypeW

  HeapSize

  SetStdHandle

  WriteFile

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  OutputDebugStringA

  OutputDebugStringW

  CloseHandle

  WaitForSingleObjectEx

  CreateThread

  WriteConsoleW

  EncodePointer

  DecodePointer

  CreateFileW

  RaiseException

  Exports

  Exports

  XML_DefaultCurrent

  XML_ErrorString

  XML_ExpatVersion

  XML_ExpatVersionInfo

  XML_ExternalEntityParserCreate

  XML_FreeContentModel

  XML_GetBase

  XML_GetBuffer

  XML_GetCurrentByteCount

  XML_GetCurrentByteIndex

  XML_GetCurrentColumnNumber

  XML_GetCurrentLineNumber

  XML_GetErrorCode

  XML_GetFeatureList

  XML_GetIdAttributeIndex

  XML_GetInputContext

  XML_GetParsingStatus

  XML_GetSpecifiedAttributeCount

  XML_MemFree

  XML_MemMalloc

  XML_MemRealloc

  XML_Parse

  XML_ParseBuffer

  XML_ParserCreate

  XML_ParserCreateNS

  XML_ParserCreate_MM

  XML_ParserFree

  XML_ParserReset

  XML_ResumeParser

  XML_SetAttlistDeclHandler

  XML_SetBase

  XML_SetCdataSectionHandler

  XML_SetCharacterDataHandler

  XML_SetCommentHandler

  XML_SetDefaultHandler

  XML_SetDefaultHandlerExpand

  XML_SetDoctypeDeclHandler

  XML_SetElementDeclHandler

  XML_SetElementHandler

  XML_SetEncoding

  XML_SetEndCdataSectionHandler

  XML_SetEndDoctypeDeclHandler

  XML_SetEndElementHandler

  XML_SetEndNamespaceDeclHandler

  XML_SetEntityDeclHandler

  XML_SetExternalEntityRefHandler

  XML_SetExternalEntityRefHandlerArg

  XML_SetNamespaceDeclHandler

  XML_SetNotStandaloneHandler

  XML_SetNotationDeclHandler

  XML_SetParamEntityParsing

  XML_SetProcessingInstructionHandler

  XML_SetReturnNSTriplet

  XML_SetSkippedEntityHandler

  XML_SetStartCdataSectionHandler

  XML_SetStartDoctypeDeclHandler

  XML_SetStartElementHandler

  XML_SetStartNamespaceDeclHandler

  XML_SetUnknownEncodingHandler

  XML_SetUnparsedEntityDeclHandler

  XML_SetUserData

  XML_SetXmlDeclHandler

  XML_StopParser

  XML_UseForeignDTD

  XML_UseParserAsHandlerArg

  Sections

  .text

  Size: 312KB - Virtual size: 311KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 356B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• infected (2)/1/templateG.txt
• infected (2)/2/Console.exe

  .exe windows x86

  995887191b2ad4c495f6de8fb0a85e94

  
  

  Code Sign

  78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  28-07-2020 00:00

  Not After

  18-03-2029 00:00

  Subject

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  28-07-2020 00:00

  Not After

  28-07-2030 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  13:ed:bc:ee:b6:90:9b:9f:37:61:38:77

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  20-09-2021 02:47

  Not After

  21-09-2022 02:47

  Subject

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  36:25:56:69:64:6f:0d:b2:58:13:13:87:03:c5:7c:74:4a:27:87:8a:ce:9f:a7:4d:c2:ef:3f:2b:9c:89:4b:9d

  Signer

  Actual PE Digest

  36:25:56:69:64:6f:0d:b2:58:13:13:87:03:c5:7c:74:4a:27:87:8a:ce:9f:a7:4d:c2:ef:3f:2b:9c:89:4b:9d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  12-02-2022 05:28

  Valid: true

  Chain 1

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  akconsolepacket

  PacketOpenAdapter

  PacketCloseAdapter

  PacketRequest

  akconsolewpcap

  pcap_dump_flush

  pcap_dump_close

  pcap_dump

  pcap_freealldevs

  pcap_dump_open

  pcap_compile

  pcap_setfilter

  pcap_dispatch

  pcap_close

  pcap_open_live

  pcap_sendpacket

  pcap_breakloop

  pcap_findalldevs

  pcap_lookupnet

  ws2_32

  ntohs

  ioctlsocket

  getsockname

  bind

  __WSAFDIsSet

  htons

  closesocket

  ntohl

  WSACleanup

  WSAStartup

  inet_ntoa

  setsockopt

  send

  recv

  connect

  freeaddrinfo

  getaddrinfo

  inet_addr

  WSAGetLastError

  socket

  sendto

  select

  recvfrom

  htonl

  getsockopt

  shlwapi

  PathFileExistsA

  kernel32

  GetVersionExW

  GetModuleHandleA

  GetThreadTimes

  UnregisterWait

  RegisterWaitForSingleObject

  GetProcessAffinityMask

  GetNumaHighestNodeNumber

  DeleteTimerQueueTimer

  ChangeTimerQueueTimer

  CreateTimerQueueTimer

  GetLogicalProcessorInformation

  GetThreadPriority

  SetThreadPriority

  SwitchToThread

  SignalObjectAndWait

  CreateTimerQueue

  SetEndOfFile

  HeapSize

  WriteConsoleW

  CreateFileW

  GetTimeZoneInformation

  OutputDebugStringW

  OutputDebugStringA

  GetProcessHeap

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  VirtualAlloc

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  FreeLibrary

  LocalFree

  SetThreadAffinityMask

  GetLastError

  TryEnterCriticalSection

  WaitForSingleObject

  CloseHandle

  FormatMessageA

  LoadLibraryExA

  InitializeCriticalSection

  GetModuleFileNameA

  GetCurrentThread

  SetThreadExecutionState

  SetEvent

  GetSystemInfo

  lstrcmpiA

  CreateEventA

  GetModuleFileNameW

  CreateProcessA

  GetVersionExA

  CreateToolhelp32Snapshot

  Process32First

  Process32Next

  GetEnvironmentStringsW

  GetOEMCP

  VirtualFree

  VirtualProtect

  SetProcessAffinityMask

  ReleaseSemaphore

  InterlockedPopEntrySList

  QueryDepthSList

  UnregisterWaitEx

  WaitForMultipleObjectsEx

  LoadLibraryW

  EnterCriticalSection

  IsProcessorFeaturePresent

  IsValidCodePage

  FindNextFileW

  FindNextFileA

  FindFirstFileExW

  FindFirstFileExA

  FindClose

  SetConsoleCtrlHandler

  GetFileAttributesExW

  GetStdHandle

  TlsAlloc

  QueryPerformanceCounter

  QueryPerformanceFrequency

  PeekConsoleInputA

  ReadConsoleInputA

  Sleep

  GetSystemTimeAsFileTime

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  GetModuleHandleW

  GetProcAddress

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  RtlCaptureStackBackTrace

  IsDebuggerPresent

  GetStartupInfoW

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  FormatMessageW

  WideCharToMultiByte

  DuplicateHandle

  GetExitCodeThread

  GetNativeSystemInfo

  SetLastError

  TlsGetValue

  TlsSetValue

  TlsFree

  GetTickCount

  MultiByteToWideChar

  EncodePointer

  DecodePointer

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  RaiseException

  RtlUnwind

  LoadLibraryExW

  InterlockedPushEntrySList

  InterlockedFlushSList

  CreateThread

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  ReadFile

  ExitProcess

  WriteFile

  GetCommandLineA

  GetCommandLineW

  GetACP

  HeapAlloc

  HeapFree

  HeapReAlloc

  GetFileType

  GetDateFormatW

  GetTimeFormatW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleCP

  DeleteFileW

  MoveFileExW

  FlushFileBuffers

  SetStdHandle

  user32

  PostMessageA

  advapi32

  CryptGenRandom

  CryptHashData

  CryptCreateHash

  CryptDecrypt

  CryptEncrypt

  CryptGetKeyParam

  CryptDestroyKey

  CryptDeriveKey

  CryptReleaseContext

  CryptAcquireContextA

  CryptDestroyHash

  Sections

  .text

  Size: 753KB - Virtual size: 752KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 132KB - Virtual size: 131KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 13KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 130KB - Virtual size: 130KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• infected (2)/2/ZM.log
• infected (2)/2/akconsolepacket.dll

  .dll windows x86

  1b48cc9513704002b890dbf12168f5c5

  
  

  Code Sign

  78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  28-07-2020 00:00

  Not After

  18-03-2029 00:00

  Subject

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  28-07-2020 00:00

  Not After

  28-07-2030 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  13:ed:bc:ee:b6:90:9b:9f:37:61:38:77

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  20-09-2021 02:47

  Not After

  21-09-2022 02:47

  Subject

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  f6:dc:f9:49:71:f6:ae:cb:51:8d:c9:d9:96:7f:86:4b:4a:0d:66:fe:fe:b9:a3:51:f8:23:a6:41:9e:1b:a4:d4

  Signer

  Actual PE Digest

  f6:dc:f9:49:71:f6:ae:cb:51:8d:c9:d9:96:7f:86:4b:4a:0d:66:fe:fe:b9:a3:51:f8:23:a6:41:9e:1b:a4:d4

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  12-02-2022 05:28

  Valid: true

  Chain 1

  SERIALNUMBER=91510100MAACMR9234,CN=四川征云网络科技有限公司,OU=研发部,O=四川征云网络科技有限公司,STREET=自由贸易试验区成都高新区德华路333号1号楼16层1606号,L=Chengdu,ST=Sichuan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13074348454e474455,1.3.6.1.4.1.311.60.2.1.2=#13075349434855414e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  ws2_32

  inet_addr

  iphlpapi

  GetAdaptersInfo

  kernel32

  SetLastError

  GetFullPathNameW

  WriteFile

  DeviceIoControl

  GetModuleFileNameW

  CreateMutexW

  GetVersion

  CreateEventW

  GlobalLock

  GetLastError

  CreateFileA

  ReadFile

  QueryPerformanceFrequency

  CloseHandle

  GetProcAddress

  GetModuleHandleW

  WideCharToMultiByte

  QueryPerformanceCounter

  GlobalFree

  GlobalAlloc

  ReleaseMutex

  WaitForSingleObject

  GlobalHandle

  SetEvent

  GlobalUnlock

  RaiseException

  MultiByteToWideChar

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  CreateFileW

  InterlockedFlushSList

  RtlUnwind

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  HeapFree

  HeapAlloc

  GetACP

  GetStdHandle

  GetFileType

  LCMapStringW

  FindClose

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetStringTypeW

  SetStdHandle

  HeapSize

  HeapReAlloc

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  FlushFileBuffers

  DecodePointer

  WriteConsoleW

  advapi32

  QueryServiceStatus

  CloseServiceHandle

  OpenSCManagerW

  ControlService

  StartServiceW

  RegOpenKeyExA

  OpenServiceA

  RegCloseKey

  RegEnumKeyW

  RegQueryValueExA

  RegOpenKeyExW

  RegQueryValueExW

  CreateServiceA

  Exports

  Exports

  PacketAllocatePacket

  PacketCloseAdapter

  PacketFreePacket

  PacketGetAdapterNames

  PacketGetAirPcapHandle

  PacketGetDriverVersion

  PacketGetNetInfoEx

  PacketGetNetType

  PacketGetReadEvent

  PacketGetStats

  PacketGetStatsEx

  PacketGetVersion

  PacketInitPacket

  PacketIsDumpEnded

  PacketLibraryVersion

  PacketOpenAdapter

  PacketReceivePacket

  PacketRequest

  PacketSendPacket

  PacketSendPackets

  PacketSetBpf

  PacketSetBuff

  PacketSetDumpLimits

  PacketSetDumpName

  PacketSetHwFilter

  PacketSetLoopbackBehavior

  PacketSetMinToCopy

  PacketSetMode

  PacketSetNumWrites

  PacketSetReadTimeout

  PacketSetSnapLen

  PacketStopDriver

  Sections

  .text

  Size: 77KB - Virtual size: 76KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 160B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• infected (2)/2/akconsolewpcap.dll

  .dll windows x86

  a0b70540250f3166417320aa24b1ac74

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenA

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCommandLineA

  HeapAlloc

  HeapFree

  RtlUnwind

  RaiseException

  HeapSize

  HeapReAlloc

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  LCMapStringA

  LCMapStringW

  SetHandleCount

  GetStdHandle

  GetStartupInfoA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  HeapCreate

  HeapDestroy

  VirtualFree

  QueryPerformanceCounter

  GetTickCount

  GetSystemTimeAsFileTime

  VirtualAlloc

  InitializeCriticalSectionAndSpinCount

  GetConsoleCP

  GetConsoleMode

  GetStringTypeA

  GetStringTypeW

  GetLocaleInfoA

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CreateFileA

  FlushFileBuffers

  SetFilePointer

  WriteFile

  GlobalFindAtomW

  LoadLibraryA

  GetVersionExA

  InterlockedIncrement

  FormatMessageW

  GlobalFlags

  WritePrivateProfileStringW

  SetErrorMode

  lstrlenW

  TlsFree

  GlobalFree

  DeleteCriticalSection

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  InitializeCriticalSection

  GlobalHandle

  GlobalUnlock

  GlobalReAlloc

  EnterCriticalSection

  TlsGetValue

  LeaveCriticalSection

  InterlockedDecrement

  GetCurrentProcessId

  GetLastError

  SetLastError

  GlobalAddAtomW

  CloseHandle

  GlobalDeleteAtom

  GetCurrentThread

  GetCurrentThreadId

  ConvertDefaultLocale

  EnumResourceLanguagesW

  lstrcmpA

  GetLocaleInfoW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  InterlockedExchange

  GlobalLock

  lstrcmpW

  GlobalAlloc

  FreeLibrary

  Sleep

  IsBadReadPtr

  LocalFree

  LocalAlloc

  GetModuleHandleW

  GetModuleFileNameW

  GetModuleFileNameA

  MultiByteToWideChar

  WideCharToMultiByte

  LoadLibraryW

  ExitProcess

  ReadFile

  GetFileSize

  OpenFile

  IsDebuggerPresent

  GlobalMemoryStatusEx

  GetSystemInfo

  GetCurrentProcess

  GetModuleHandleA

  GetFileType

  GetProcAddress

  user32

  DestroyMenu

  LoadCursorW

  GetSysColorBrush

  RegisterWindowMessageW

  LoadIconW

  WinHelpW

  GetCapture

  GetClassLongW

  SetPropW

  GetPropW

  RemovePropW

  IsWindow

  GetForegroundWindow

  GetDlgItem

  GetTopWindow

  DestroyWindow

  GetMessageTime

  GetMessagePos

  MapWindowPoints

  SetMenu

  SetForegroundWindow

  GetClientRect

  CreateWindowExW

  GetClassInfoExW

  GetClassInfoW

  RegisterClassW

  AdjustWindowRectEx

  DefWindowProcW

  CallWindowProcW

  CopyRect

  GetMenu

  SetWindowLongW

  SetWindowPos

  SystemParametersInfoA

  IsIconic

  GetWindowPlacement

  GetSystemMetrics

  GetMenuItemID

  GetSubMenu

  GetWindow

  GetDlgCtrlID

  GetWindowRect

  GetClassNameW

  PtInRect

  GetWindowTextW

  SetWindowTextW

  GetSysColor

  FindWindowW

  ShowWindow

  ReleaseDC

  GetDC

  ClientToScreen

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  MessageBoxW

  MessageBoxA

  PostQuitMessage

  PostMessageW

  CheckMenuItem

  EnableMenuItem

  GetMenuState

  ModifyMenuW

  SendMessageW

  GetParent

  GetFocus

  LoadBitmapW

  GetMenuCheckMarkDimensions

  SetMenuItemBitmaps

  ValidateRect

  GetCursorPos

  PeekMessageW

  GetKeyState

  IsWindowVisible

  GetActiveWindow

  GetMenuItemCount

  UnregisterClassW

  UnhookWindowsHookEx

  GetWindowThreadProcessId

  GetWindowLongW

  GetLastActivePopup

  IsWindowEnabled

  EnableWindow

  SetCursor

  SetWindowsHookExW

  CallNextHookEx

  GetMessageW

  TranslateMessage

  DispatchMessageW

  gdi32

  DeleteDC

  GetStockObject

  GetDeviceCaps

  SelectObject

  ScaleWindowExtEx

  SetWindowExtEx

  ScaleViewportExtEx

  SetViewportExtEx

  OffsetViewportOrgEx

  CreateBitmap

  Escape

  ExtTextOutW

  TextOutW

  RectVisible

  PtVisible

  DeleteObject

  GetClipBox

  SetMapMode

  SetTextColor

  SetBkColor

  RestoreDC

  SaveDC

  SetViewportOrgEx

  winspool.drv

  DocumentPropertiesW

  OpenPrinterW

  ClosePrinter

  advapi32

  RegSetValueExW

  RegCreateKeyExW

  RegQueryValueW

  RegOpenKeyW

  RegEnumKeyW

  RegDeleteKeyW

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  shlwapi

  PathFindFileNameW

  PathFindExtensionW

  oleaut32

  VariantClear

  VariantChangeType

  VariantInit

  Exports

  Exports

  bpf_dump

  bpf_filter

  bpf_image

  bpf_validate

  endservent

  eproto_db

  getservent

  install_bpf_program

  pcap_activate

  pcap_breakloop

  pcap_close

  pcap_compile

  pcap_compile_nopcap

  pcap_create

  pcap_createsrcstr

  pcap_datalink

  pcap_datalink_name_to_val

  pcap_datalink_val_to_description

  pcap_datalink_val_to_name

  pcap_dispatch

  pcap_dump

  pcap_dump_close

  pcap_dump_file

  pcap_dump_flush

  pcap_dump_ftell

  pcap_dump_open

  pcap_file

  pcap_fileno

  pcap_findalldevs

  pcap_findalldevs_ex

  pcap_free_datalinks

  pcap_freealldevs

  pcap_freecode

  pcap_get_airpcap_handle

  pcap_geterr

  pcap_getevent

  pcap_getnonblock

  pcap_hopen_offline

  pcap_is_swapped

  pcap_lib_version

  pcap_list_datalinks

  pcap_live_dump

  pcap_live_dump_ended

  pcap_lookupdev

  pcap_lookupnet

  pcap_loop

  pcap_major_version

  pcap_minor_version

  pcap_next

  pcap_next_etherent

  pcap_next_ex

  pcap_offline_filter

  pcap_offline_read

  pcap_open

  pcap_open_dead

  pcap_open_live

  pcap_open_offline

  pcap_parsesrcstr

  pcap_perror

  pcap_read

  pcap_remoteact_accept

  pcap_remoteact_cleanup

  pcap_remoteact_close

  pcap_remoteact_list

  pcap_sendpacket

  pcap_sendqueue_alloc

  pcap_sendqueue_destroy

  pcap_sendqueue_queue

  pcap_sendqueue_transmit

  pcap_set_buffer_size

  pcap_set_datalink

  pcap_set_promisc

  pcap_set_snaplen

  pcap_set_timeout

  pcap_setbuff

  pcap_setdirection

  pcap_setfilter

  pcap_setmintocopy

  pcap_setmode

  pcap_setnonblock

  pcap_setsampling

  pcap_setuserbuffer

  pcap_snapshot

  pcap_stats

  pcap_stats_ex

  pcap_strerror

  wsockinit

  Sections

  .text

  Size: 135KB - Virtual size: 134KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 9KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ