360sd_x64_std_7[.]0[.]0[.]1040E[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

360sd_x64_std_7.0.0.1040E.exe
Size

53.7MB
MD5

0bc6765d0f258d2f79efd7a68d8f97bf
SHA1

0803c2930dff97cf2aa39832e7b0d33c9d246c32
SHA256

84d5e479f1c3cead73af69402048bb55dc7b9595b9955268e921bde65e9dd87b
SHA512

3da702cc0e1bbfc31b443cf375a64b595e0456d4373f764a23d9a914caa1871cdc7a0314adfd281b1ed26b6bdfed8ccc1040c763e8cc6508d406b1a60d932a24
SSDEEP

1572864:J4IN12dCfG5owvfQ49HkDD2nDEvHIblgN0JLLb3d9:JN2cAowvIuHkDD1oZHVDd9

Score

1^/10

Malware Config

Signatures

Files

360sd_x64_std_7.0.0.1040E.exe
.exe windows x86

e85dd3214611ff80022e8e2097c2d409

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

05/01/2022, 09:58

Not After

06/01/2024, 09:58

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:ee:2b:7f:56:e0:f8:b6:3c:d5:df:37:3d:8c:0d:6e:37:7c:9b:71:09:62:22:a5:5c:bc:88:73:41:67:1e:3a
Signer

Actual PE Digest

b2:ee:2b:7f:56:e0:f8:b6:3c:d5:df:37:3d:8c:0d:6e:37:7c:9b:71:09:62:22:a5:5c:bc:88:73:41:67:1e:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

CreateProcessW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetTempPathW
GetLocalTime
GetCurrentProcessId
DeviceIoControl
FindClose
FindNextFileW
CopyFileW
FindFirstFileW
GetLogicalDriveStringsW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFileAttributesW
GetExitCodeProcess
RemoveDirectoryW
DeleteFileW
GetTempFileNameW
lstrcatW
InterlockedExchange
MoveFileExW
MoveFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetThreadPriority
ResumeThread
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
CreateMutexW
ReadFile
GetFileSize
TlsFree
ReleaseMutex
CreateMutexA
GetModuleHandleA
ProcessIdToSessionId
Thread32Next
SuspendThread
OpenThread
Thread32First
GlobalMemoryStatus
SystemTimeToFileTime
FileTimeToSystemTime
SetEnvironmentVariableW
WritePrivateProfileSectionW
QueryDosDeviceW
ReadProcessMemory
Module32NextW
Module32FirstW
GetPrivateProfileIntW
InterlockedCompareExchange
GetFileAttributesExW
TlsSetValue
TlsGetValue
GetCommandLineW
GetLongPathNameW
lstrcmpW
GetACP
TerminateProcess
GetPrivateProfileSectionW
GetTimeZoneInformation
GetCurrentProcess
GetFileTime
SetFilePointer
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetLocaleInfoW
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
ExitProcess
HeapCreate
FatalAppExitA
GetCurrentThread
TlsAlloc
GetModuleFileNameA
GetStdHandle
GetStartupInfoW
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CreateFileA
SetStdHandle
MultiByteToWideChar
FreeLibrary
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
FlushInstructionCache
SetEnvironmentVariableA
FreeResource
LocalFileTimeToFileTime
SetFilePointerEx
SetLastError
InterlockedDecrement
InterlockedIncrement
GetLastError
CreateFileMappingW
GetFileSizeEx
OutputDebugStringW
HeapUnlock
HeapLock
HeapWalk
MapViewOfFile
lstrlenW
lstrcpyW
AreFileApisANSI
WideCharToMultiByte
Sleep
FindResourceExW
FindResourceW
LoadResource
LockResource
UnmapViewOfFile
SetFileTime
LoadLibraryExW
GetCurrentThreadId
lstrcmpiW
CreateThread
WaitForSingleObject
TerminateThread
ExpandEnvironmentStringsW
CreateFileW
WriteFile
CloseHandle
GetDriveTypeW
GetDiskFreeSpaceExW
GetVersionExW
GetVersion
GetModuleHandleW
GetProcAddress
GetLocaleInfoA
SizeofResource
RaiseException
GetTickCount
CreateDirectoryW
SetFileAttributesW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CompareStringW
FileTimeToLocalFileTime
GetStringTypeW

user32

RegisterClassExW
MoveWindow
GetWindowRgn
EnumThreadWindows
WindowFromPoint
GetSystemMetrics
SwitchToThisWindow
SetForegroundWindow
BringWindowToTop
UnregisterClassA
SendMessageTimeoutW
FindWindowW
ClientToScreen
GetSysColor
SetCursor
FillRect
CallWindowProcW
GetDlgCtrlID
SetCapture
IsWindowEnabled
UpdateWindow
ReleaseCapture
PtInRect
CreateDialogParamW
WaitForInputIdle
CharLowerBuffW
LoadCursorW
SetRectEmpty
DestroyCursor
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadImageW
GetClassNameW
CreateCursor
PostQuitMessage
OffsetRect
CharNextW
GetCursorPos
LoadStringW
DrawTextW
GetWindow
SystemParametersInfoW
MapWindowPoints
IsWindow
AdjustWindowRectEx
IsDialogMessageW
MessageBoxW
GetDlgItem
GetParent
ChildWindowFromPoint
SetDlgItemTextW
GetDlgItemTextW
SetFocus
EnableWindow
KillTimer
SetTimer
ShowWindow
InvalidateRect
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ScreenToClient
GetWindowRect
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
PostMessageW
GetWindowLongW
CreateWindowExW
SetWindowLongW
DestroyWindow
SendMessageW
ExitWindowsEx
SetWindowPos
GetClientRect
GetCapture

gdi32

GetPixel
DeleteDC
Rectangle
SetTextColor
SetBkMode
GetStockObject
CreateFontIndirectW
GetObjectW
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
CreatePen
CreateBrushIndirect
PtInRegion
CreateRectRgn
CreateDIBSection
BitBlt
SetStretchBltMode

advapi32

EqualSid
OpenProcessToken
RegQueryValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
IsValidSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
GetUserNameW
RegCreateKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupPrivilegeValueW
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHFileOperationW
ord165
SHGetFolderPathW
SHCreateDirectoryExW
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathAppendW
StrCmpNIW
SHDeleteKeyW
SHDeleteValueW
StrCmpNW
PathRemoveFileSpecW
SHSetValueW
PathFindFileNameW
StrStrIW
PathCombineW
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW
PathRemoveBackslashW
SHGetValueW

comctl32

_TrackMouseEvent
ImageList_Destroy
InitCommonControlsEx
ImageList_GetIconSize

ws2_32

closesocket
htons
socket
gethostbyname
connect
WSAStartup

setupapi

SetupIterateCabinetW

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

msimg32

AlphaBlend

Sections

.text
Size: 642KB - Virtual size: 641KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53.0MB - Virtual size: 53.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e85dd3214611ff80022e8e2097c2d409

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

b2:ee:2b:7f:56:e0:f8:b6:3c:d5:df:37:3d:8c:0d:6e:37:7c:9b:71:09:62:22:a5:5c:bc:88:73:41:67:1e:3aSigner

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

setupapi

psapi

wintrust

crypt32

wininet

msimg32

Sections

.text Size: 642KB - Virtual size: 641KB

.rdata Size: 118KB - Virtual size: 117KB

.data Size: 15KB - Virtual size: 27KB

.rsrc Size: 53.0MB - Virtual size: 53.0MB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

b2:ee:2b:7f:56:e0:f8:b6:3c:d5:df:37:3d:8c:0d:6e:37:7c:9b:71:09:62:22:a5:5c:bc:88:73:41:67:1e:3a
Signer

.text
Size: 642KB - Virtual size: 641KB

.rdata
Size: 118KB - Virtual size: 117KB

.data
Size: 15KB - Virtual size: 27KB

.rsrc
Size: 53.0MB - Virtual size: 53.0MB