General

Malware Config

Signatures

Files

• 07d8e00f08e74c5ec43b6e7f547c3213f8a9d24a0891267abc80e032cf1f7d8e.exe

  .exe windows x86

  31f806fb4545c3a3fff561605c32d5c8

  
  

  Code Sign

  25:1c:a0:1d:b0:5d:dd:48:bc:67:f4:24:96:a0:bf:c1

  Certificate

  Issuer

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  Not Before

  24-06-2021 14:00

  Not After

  30-12-2099 16:00

  Subject

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  b2:44:5f:28:14:92:bb:9a:fc:e4:16:30:df:e3:8a:99:93:1b:18:76

  Signer

  Actual PE Digest

  b2:44:5f:28:14:92:bb:9a:fc:e4:16:30:df:e3:8a:99:93:1b:18:76

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

  30-03-2023 10:56

  Valid: false

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  midiStreamOut

  ws2_32

  socket

  rasapi32

  RasHangUpA

  kernel32

  GetFileSize

  LoadLibraryA

  VirtualProtect

  GetModuleFileNameA

  ExitProcess

  user32

  WinHelpA

  MessageBoxA

  gdi32

  GetViewportExtEx

  winspool.drv

  OpenPrinterA

  advapi32

  RegQueryValueExA

  shell32

  SHGetSpecialFolderPathA

  ole32

  CLSIDFromProgID

  oleaut32

  VariantChangeType

  comctl32

  ImageList_Add

  wininet

  InternetCanonicalizeUrlA

  comdlg32

  ChooseColorA

  Sections

  .text

  Size: - Virtual size: 960KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: - Virtual size: 623KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 395KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 68KB - Virtual size: 80KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .vmp0

  Size: - Virtual size: 192KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_WRITE

  .vmp1

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 96B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ