5e64ae93af6e8e46434d2f221dadbf29e7d5f5167664161f5db7d1e686acef2a

Sharing

Copy URL Twitter E-mail

General

Target

5e64ae93af6e8e46434d2f221dadbf29e7d5f5167664161f5db7d1e686acef2a
Size

830KB
MD5

d0b8119b1dabd1b3993bd3082cb8a994
SHA1

59f3102b967d2c7896fbdf49b746a890722d7a2d
SHA256

5e64ae93af6e8e46434d2f221dadbf29e7d5f5167664161f5db7d1e686acef2a
SHA512

137f8e2afc103075b7afbf7f5c6c8d09b0e4e3f08bea47abe27dc561a8563129faafc6b69c90750c47b404a73a4972ed7912a8bb4e96ae84f6f0e402837ad776
SSDEEP

12288:9BYD3J+oJ1kEjl3zE1aMktb6JqIjASm9xHk8qyfemT/Zr2ElXkGi61ygMURmqK/k:90JPtame+xN+exfW1S12i

Score

1^/10

Malware Config

Signatures

Files

5e64ae93af6e8e46434d2f221dadbf29e7d5f5167664161f5db7d1e686acef2a
.exe windows x86

8f1549183f3ca4c5b7557c06842d17ba

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:99:ad:d1:4d:a3:a5:92:a5:3d:c5:db:44:58:f7:f7:11
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

05/06/2013, 17:11

Not After

06/06/2014, 17:11

Subject

CN=北京盛世创想科技发展有限公司,O=北京盛世创想科技发展有限公司,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

78:e6:8e:2a:b0:0d:16:cc:fc:59:b9:d0:b9:7d:d0:f4:17:4c:4a:5b
Signer

Actual PE Digest

78:e6:8e:2a:b0:0d:16:cc:fc:59:b9:d0:b9:7d:d0:f4:17:4c:4a:5b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
GetWindowsDirectoryW
ExpandEnvironmentStringsW
SearchPathW
GetSystemInfo
FreeResource
CreateFileA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileW
ReadFile
GetStartupInfoW
CreatePipe
CreateDirectoryA
SetFileAttributesA
GetFileAttributesA
WritePrivateProfileStringA
WriteFile
SetFilePointer
SetUnhandledExceptionFilter
SuspendThread
GetSystemDirectoryW
GetVersion
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
IsValidLocale
HeapFree
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
HeapReAlloc
HeapCreate
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCPInfo
LCMapStringW
LCMapStringA
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MulDiv
lstrcmpW
GlobalAlloc
GlobalLock
GlobalUnlock
DeviceIoControl
CreateProcessA
GetModuleFileNameA
CreateDirectoryW
TerminateThread
TerminateProcess
GetTickCount
GetPrivateProfileStringW
CreateThread
lstrlenA
OutputDebugStringW
DebugBreak
OpenEventW
CreateEventW
WaitForSingleObject
WideCharToMultiByte
SetEvent
GetLocalTime
GetCurrentProcessId
GetVersionExW
OpenProcess
lstrcmpiW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
InitializeCriticalSection
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
LocalFree
DeleteCriticalSection
RaiseException
GetCurrentThreadId
SetLastError
OpenMutexW
CreateMutexW
GetModuleFileNameW
CreateProcessW
WritePrivateProfileStringW
Sleep
GetPrivateProfileIntW
FindFirstFileW
DeleteFileW
CopyFileW
FindNextFileW
FindClose
RemoveDirectoryW
InterlockedIncrement
InterlockedDecrement
lstrlenW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
CloseHandle
GetLastError
LocalAlloc
EnumSystemLocalesA

user32

LoadStringW
LoadAcceleratorsW
PostMessageW
FindWindowW
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
SetWindowLongW
UpdateWindow
ShowWindow
GetClassInfoExW
LoadCursorW
ReleaseDC
GetDC
CreateAcceleratorTableW
ReleaseCapture
SetCapture
InvalidateRgn
GetDlgItem
CharLowerW
LoadImageW
GetWindowDC
CopyRect
InflateRect
BeginPaint
EndPaint
DestroyAcceleratorTable
GetFocus
SetFocus
IsChild
FillRect
IsWindow
RedrawWindow
GetClassNameW
DestroyWindow
GetDesktopWindow
RegisterClassExW
GetWindowThreadProcessId
wvsprintfW
SystemParametersInfoW
GetWindowTextLengthW
RegisterWindowMessageW
KillTimer
GetSysColor
SetWindowRgn
LoadIconW
PostQuitMessage
SetTimer
wsprintfW
ScreenToClient
UnregisterClassA
TrackMouseEvent
MessageBoxW
SetForegroundWindow
SendMessageW
TrackPopupMenu
GetCursorPos
GetMessagePos
AppendMenuW
CreatePopupMenu
DestroyIcon
ClientToScreen
SetWindowTextW
GetWindowTextW
DrawTextW
MoveWindow
SetWindowPos
GetClientRect
InvalidateRect
EnableWindow
ExitWindowsEx
GetWindowLongW
GetParent
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
EndDialog
DialogBoxParamW
CallWindowProcW
DefWindowProcW
DrawIcon
GetWindow
GetWindowRect

gdi32

CreateRectRgn
SetBkMode
ExtTextOutW
SetBkColor
BitBlt
DeleteDC
SelectObject
DeleteObject
CreateCompatibleBitmap
CreateSolidBrush
GetDeviceCaps
GetObjectW
CreateFontIndirectW
ExtCreateRegion
SetTextColor
SetViewportOrgEx
GetStockObject
CreateCompatibleDC
GetTextExtentPoint32W

comdlg32

GetFileTitleW

advapi32

CheckTokenMembership
FreeSid
DuplicateTokenEx
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetUserNameW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
GetExplicitEntriesFromAclW
DeleteAce
LookupAccountNameW
LookupAccountSidW
GetTokenInformation
RegEnumValueW
OpenSCManagerA
ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
CloseServiceHandle
RegCreateKeyW
RegSetKeySecurity
GetLengthSid
RegEnumKeyW
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
AllocateAndInitializeSid
RegOpenKeyW
CopySid
GetSidSubAuthority

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ExtractIconW
Shell_NotifyIconW
ShellExecuteW
SHGetMalloc

ole32

CoUninitialize
CoInitialize
OleLockRunning
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
DispCallFunc
VariantClear
SysAllocString
VariantInit
VarUI4FromStr
SysFreeString

shlwapi

StrCpyW
PathFileExistsW
PathAppendW
PathAppendA
SHDeleteKeyW
PathIsDirectoryW
PathFileExistsA
PathRemoveExtensionW
SHSetValueW
StrCatW
SHDeleteValueW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

gdiplus

GdipBitmapUnlockBits
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipBitmapLockBits
GdipLoadImageFromFileICM

urlmon

URLDownloadToFileA
URLDownloadToFileW

netapi32

Netbios

wininet

HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
DeleteUrlCacheEntryW
InternetSetFilePointer
InternetReadFile
InternetConnectW

Sections

.text
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f1549183f3ca4c5b7557c06842d17ba

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:99:ad:d1:4d:a3:a5:92:a5:3d:c5:db:44:58:f7:f7:11Certificate

Extended Key Usages

Key Usages

78:e6:8e:2a:b0:0d:16:cc:fc:59:b9:d0:b9:7d:d0:f4:17:4c:4a:5bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

gdiplus

urlmon

netapi32

wininet

Sections

.text Size: 491KB - Virtual size: 490KB

.rdata Size: 113KB - Virtual size: 112KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 208KB - Virtual size: 207KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:99:ad:d1:4d:a3:a5:92:a5:3d:c5:db:44:58:f7:f7:11
Certificate

78:e6:8e:2a:b0:0d:16:cc:fc:59:b9:d0:b9:7d:d0:f4:17:4c:4a:5b
Signer

.text
Size: 491KB - Virtual size: 490KB

.rdata
Size: 113KB - Virtual size: 112KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 208KB - Virtual size: 207KB