General

Malware Config

Signatures

Files

• 0dcc7d923a310e7b6d3c23cec0f48517eb5a74eabf344bf4936b6bcf41736d8d.exe

  .exe windows x86

  31f806fb4545c3a3fff561605c32d5c8

  
  

  Code Sign

  25:1c:a0:1d:b0:5d:dd:48:bc:67:f4:24:96:a0:bf:c1

  Certificate

  Issuer

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  Not Before

  24-06-2021 14:00

  Not After

  30-12-2099 16:00

  Subject

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  1c:e3:77:6c:cd:ef:8b:d3:f3:42:ae:45:39:84:1a:1c:f1:8f:ad:e5

  Signer

  Actual PE Digest

  1c:e3:77:6c:cd:ef:8b:d3:f3:42:ae:45:39:84:1a:1c:f1:8f:ad:e5

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  30-03-2023 11:00

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  midiStreamOut

  ws2_32

  socket

  rasapi32

  RasHangUpA

  kernel32

  GetFileSize

  LoadLibraryA

  VirtualProtect

  GetModuleFileNameA

  ExitProcess

  user32

  WinHelpA

  MessageBoxA

  gdi32

  GetViewportExtEx

  winspool.drv

  OpenPrinterA

  advapi32

  RegQueryValueExA

  shell32

  SHGetSpecialFolderPathA

  ole32

  CLSIDFromProgID

  oleaut32

  VariantChangeType

  comctl32

  ImageList_Add

  wininet

  InternetCanonicalizeUrlA

  comdlg32

  ChooseColorA

  Sections

  .text

  Size: - Virtual size: 960KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 623KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 395KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 68KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .vmp0

  Size: - Virtual size: 192KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_WRITE

  .vmp1

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 96B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ