福昕阅读器V4[.]3[.]1[.]0218[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

福昕阅读器V4.3.1.0218.exe
Size

4.9MB
MD5

984e4a604e24a570b3946a9f0785bddb
SHA1

106fb9bb870d03355ef5ea67fb962899695cdb63
SHA256

a8dc3c6688cc8c848982c1f2ddfd625dfb9814d8a3416a1edbbc82f746e8eb50
SHA512

62c52875d563675c63920aed4d9ca23c73117a7fa917d12bff029a9a309c7a78d79bad8e77a670f4041fd82322472cdfc1ab36aeece2a6dc9601cf85e4e1543f
SSDEEP

98304:CufarvmR2cC6E1JuNnNM1++p0eXeYGca4TecZ2pKWjM/VoNtW0:C6Am3NnNMkAXe1cSK2pKOMmN40

Score

1^/10

Malware Config

Signatures

Files

福昕阅读器V4.3.1.0218.exe
.exe windows x86

98155b5453ae34761bbeb81314a8d3d1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:a7:a0:38:a7:b2
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2010, 20:33

Not After

03/05/2013, 20:33

Subject

CN=Foxit Corporation,O=Foxit Corporation,L=Fremont,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

87:b9:06:7d:4d:42:0b:d9:a6:62:c9:21:73:20:04:2d:03:f6:f6:32
Signer

Actual PE Digest

87:b9:06:7d:4d:42:0b:d9:a6:62:c9:21:73:20:04:2d:03:f6:f6:32

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

CopyIcon

gdi32

PolyBezierTo

comdlg32

ReplaceTextW

winspool.drv

GetPrinterDataExW

advapi32

RegSetValueExA

shell32

SHGetSpecialFolderLocation

comctl32

ImageList_DrawIndirect

oledlg

OleUIBusyW

ole32

OleLockRunning

olepro32

ord253

oleaut32

LoadTypeLi

urlmon

HlinkSimpleNavigateToString

wininet

InternetSetStatusCallback

wsock32

WSAGetLastError

shlwapi

PathIsRelativeW

oleacc

LresultFromObject

netapi32

Netbios

version

GetFileVersionInfoSizeW

imm32

ImmGetCompositionStringA

msvfw32

MCIWndCreateW

msimg32

TransparentBlt

odbc32

ord31

rpcrt4

RpcStringFreeW

Sections

Powered
Size: 4.4MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

By
Size: 498KB - Virtual size: 500KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

D4llower
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

98155b5453ae34761bbeb81314a8d3d1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

03:01Certificate

Key Usages

64:a7:a0:38:a7:b2Certificate

Extended Key Usages

Key Usages

87:b9:06:7d:4d:42:0b:d9:a6:62:c9:21:73:20:04:2d:03:f6:f6:32Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

urlmon

wininet

wsock32

shlwapi

oleacc

netapi32

version

imm32

msvfw32

msimg32

odbc32

rpcrt4

Sections

Powered Size: 4.4MB - Virtual size: 11.3MB

By Size: 498KB - Virtual size: 500KB

D4llower Size: 512B - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

03:01
Certificate

64:a7:a0:38:a7:b2
Certificate

87:b9:06:7d:4d:42:0b:d9:a6:62:c9:21:73:20:04:2d:03:f6:f6:32
Signer

Powered
Size: 4.4MB - Virtual size: 11.3MB

By
Size: 498KB - Virtual size: 500KB

D4llower
Size: 512B - Virtual size: 4KB