OFFICE2007兼容包[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

OFFICE2007兼容包.exe
Size

27.6MB
MD5

8a34b707f4ac4a8a222af0ae4f31273e
SHA1

ff2fb1337543093cc28e98641fb66f28e12a812d
SHA256

b9ccb4d0f2954343be5205bd8215ca07f1236faa55d73a808824c18419e8da85
SHA512

0ed90d00c8e31f5851970889307c945ef123097991d8e010e65638378b64fab0d18ffb893ceb8f65da2a42260d9efb099418f42411f0709926f1fba632522e02
SSDEEP

786432:dxtv0RuHYEPkSbpkeRRD2zrlW3MR3dtDQyhq:ZcROYYjbpkP/lW8Rttbq

Score

1^/10

Malware Config

Signatures

Files

OFFICE2007兼容包.exe
.exe windows x86

c261979d0623d9d5245bed4e21fd0160

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2f:97:53:e2:39:16:65:51:55:98:1d:04:9c:34:0a:8d:3a:cd:4f:8d
Signer

Actual PE Digest

2f:97:53:e2:39:16:65:51:55:98:1d:04:9c:34:0a:8d:3a:cd:4f:8d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenW
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
MultiByteToWideChar
lstrlenA
GetFileSize
CreateFileA
CreateDirectoryA
DeleteFileA
GetTempFileNameA
GetTempPathA
GetFullPathNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CopyFileA
MoveFileA
ReadFile
ExpandEnvironmentStringsA
SetEvent
CreateEventA
SetFilePointer
LockResource
LoadResource
FindResourceA
GetSystemDirectoryA
GetUserDefaultLangID
GetSystemDefaultLangID
GetVersionExA
WriteFile
GlobalFree
GlobalAlloc
CompareStringA
GetCurrentProcess
WritePrivateProfileStringA
GetWindowsDirectoryA
SetCurrentDirectoryA
CreateProcessA
GetDiskFreeSpaceExA
GetModuleFileNameA
SetLastError
WideCharToMultiByte
SetFileTime
DosDateTimeToFileTime
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetOEMCP
GetCPInfo
HeapSize
Sleep
VirtualAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetFileType
GetCurrentDirectoryA
GetLastError
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LocalFree
GetFileAttributesA
LocalAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapReAlloc
RtlUnwind
ExitThread
GetCurrentThreadId
CreateThread
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
GetErrorInfo
VariantCopy
VariantChangeType
SysStringLen
SysFreeString

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ole32

CLSIDFromProgID
CoInitialize
CoTaskMemFree
OleRun
CLSIDFromString
CoCreateInstance

user32

SetWindowLongA
SendMessageA
GetWindowLongA
DestroyWindow
PostQuitMessage
DispatchMessageA
EnableMenuItem
EnableWindow
ShowWindow
UpdateWindow
GetDlgItem
PostMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
EndDialog
IsDlgButtonChecked
DialogBoxParamA
CreateDialogParamA
ExitWindowsEx
MessageBoxA
SetWindowTextA
SystemParametersInfoA
GetSystemMenu
CharNextA
PeekMessageA

gdi32

CreateFontIndirectA

Sections

.text
Size: 511KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c261979d0623d9d5245bed4e21fd0160

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

2f:97:53:e2:39:16:65:51:55:98:1d:04:9c:34:0a:8d:3a:cd:4f:8dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

version

ole32

user32

gdi32

Sections

.text Size: 511KB - Virtual size: 510KB

.data Size: 16KB - Virtual size: 37KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 31KB - Virtual size: 31KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

2f:97:53:e2:39:16:65:51:55:98:1d:04:9c:34:0a:8d:3a:cd:4f:8d
Signer

.text
Size: 511KB - Virtual size: 510KB

.data
Size: 16KB - Virtual size: 37KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 31KB - Virtual size: 31KB