e8b262c7051bc8764eecf91ea9653036c6a90de77bedf7f3f297b478a6a2bf9b

Sharing

Copy URL Twitter E-mail

General

Target

e8b262c7051bc8764eecf91ea9653036c6a90de77bedf7f3f297b478a6a2bf9b
Size

1.1MB
MD5

be3cfb6fb6c66f247a37d28f88eb2639
SHA1

ec3d7580243be9401a992894c99dc85aa6de2544
SHA256

e8b262c7051bc8764eecf91ea9653036c6a90de77bedf7f3f297b478a6a2bf9b
SHA512

9f9386a100b3f63ef8d6ee8d3739088864e14af09f32ac18aaa6859725236ec5332870ac63905b87ac735743513a076908a7c445a7b8dcda0ff0dc5d565cb16c
SSDEEP

24576:429aryZhwStTmvc7JezM7PztfTlcZBkF9XB:BaruiSf7wzsPlTiZBmXB

Score

1^/10

Malware Config

Signatures

Files

e8b262c7051bc8764eecf91ea9653036c6a90de77bedf7f3f297b478a6a2bf9b
.exe windows x86

67de31dd9dc6c8d2cdc0b51abddc22de

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:e9:30:d9:d6:de:2c:93:b1:0d:f5:9d:8e:dd:68:47
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

25/08/2021, 00:00

Not After

22/08/2023, 23:59

Subject

SERIALNUMBER=91120116MA06R2NL3B,CN=Tianjin Xundu Technology Co.\,Ltd,OU=IT,O=Tianjin Xundu Technology Co.\,Ltd,ST=天津市,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c0ce6bba8e6b5b7e696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5a4a9e6b4a5e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:aa:04:6a:7f:50:36:55:f2:a3:01:28:e1:7c:e6:5c:3c:43:32:29:f9:8a:40:d7:ad:57:9a:9f:ee:d1:bc:9b
Signer

Actual PE Digest

f9:aa:04:6a:7f:50:36:55:f2:a3:01:28:e1:7c:e6:5c:3c:43:32:29:f9:8a:40:d7:ad:57:9a:9f:ee:d1:bc:9b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetUnhandledExceptionFilter
GetLocalTime
IsBadReadPtr
VirtualProtect
ExitProcess
LocalFree
UnmapViewOfFile
SetEndOfFile
CreateFileMappingW
MapViewOfFile
RemoveDirectoryW
GetLongPathNameW
DeviceIoControl
lstrcmpA
OpenEventW
OpenFileMappingW
GetThreadLocale
SetThreadLocale
SetErrorMode
GlobalAlloc
GetFileSize
LoadLibraryW
GetExitCodeProcess
CreateDirectoryW
DeleteFileW
Sleep
WriteConsoleW
WaitForSingleObject
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
MoveFileExW
GetTimeZoneInformation
GetConsoleCP
SetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
QueryPerformanceFrequency
RtlUnwind
QueryPerformanceCounter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
SetEnvironmentVariableA
SetFileAttributesW
CreateMutexW
GetQueuedCompletionStatus
InterlockedExchange
CreateIoCompletionPort
CreateEventW
GetExitCodeThread
GetSystemInfo
WideCharToMultiByte
ReadFile
CreateProcessW
GetStartupInfoW
CreatePipe
SetProcessShutdownParameters
WriteFile
OutputDebugStringW
CloseHandle
SetFilePointer
CreateFileW
TerminateProcess
DecodePointer
PostQueuedCompletionStatus
SetEvent
ResetEvent
GetNativeSystemInfo
lstrlenA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesExW
lstrlenW
CreateThread
TerminateThread
InitializeCriticalSection
GetVersionExW
GetTempPathW
MulDiv
GetCurrentProcessId
OpenProcess
GetVersion
FindFirstFileExW
GlobalFree
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
FreeLibrary
GetCurrentProcess
GetProcAddress
GetModuleHandleW
SetLastError
RaiseException
GetCurrentThreadId
GetPrivateProfileStringW
GetLastError
GetTickCount
WritePrivateProfileStringW
GetPrivateProfileIntW
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetModuleFileNameW
FlushFileBuffers

user32

RegisterClipboardFormatW
GetSysColor
SetCaretPos
LoadCursorW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
wsprintfW
SendMessageW
DestroyWindow
IsWindow
DefWindowProcW
CreateCaret
GetCaretBlinkTime
CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
CharNextW
ShowWindow
PostQuitMessage
IsWindowVisible
SetRectEmpty
SystemParametersInfoW
MoveWindow
GetDlgItem
KillTimer
SetTimer
FindWindowW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
EqualRect
SetCursor
ClientToScreen
ScreenToClient
GetDoubleClickTime
GetParent
IsClipboardFormatAvailable
IntersectRect
IsRectEmpty
GetIconInfo
DrawTextW
BeginPaint
EndPaint
IsIconic
GetClientRect
InvalidateRect
TrackMouseEvent
SetFocus
SetCapture
ReleaseCapture
GetWindowRect
SetWindowRgn
SetWindowPos
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
EnableWindow
GetForegroundWindow
GetWindowTextW
SetForegroundWindow
IsZoomed
MonitorFromRect
OffsetRect
SetLayeredWindowAttributes
PtInRect
GetCursorPos
UpdateWindow
FillRect
GetFocus
GetWindowTextLengthW
SetWindowTextW
UpdateLayeredWindow
GetDC
ReleaseDC
GetWindowThreadProcessId
CopyRect
MessageBoxW
PostMessageW
AttachThreadInput
BringWindowToTop
SetActiveWindow

gdi32

CreateFontIndirectW
RestoreDC
ExtSelectClipRgn
CreateRectRgnIndirect
SaveDC
GetDeviceCaps
CreateRectRgn
CombineRgn
CreateRoundRectRgn
SetTextColor
SetBkMode
GetBitmapBits
GetTextColor
SetStretchBltMode
DeleteDC
BitBlt
SetPixel
CreateCompatibleDC
GetObjectW
CreateDIBSection
Rectangle
SelectObject
CreatePen
DeleteObject
GetStockObject
GetCurrentObject
SetTextCharacterExtra
SetBitmapBits
SetBkColor
CreateSolidBrush
GetViewportOrgEx
StretchBlt

advapi32

GetUserNameW
RegEnumKeyW
RegQueryValueExW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

shell32

ord165
ShellExecuteW
ShellExecuteExW
SHCreateDirectoryExW
SHChangeNotify
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderPathW
SHGetMalloc

ole32

CoInitializeSecurity
RegisterDragDrop
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
OleRun
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree

oleaut32

LoadRegTypeLi
SysFreeString
VariantCopy
VariantClear
VariantInit
VarBstrCmp
SysAllocString
VarUI4FromStr
LoadTypeLi
GetErrorInfo
SysStringLen

shlwapi

PathIsPrefixW
PathRemoveExtensionW
PathRemoveBackslashW
PathCanonicalizeW
PathFileExistsW
PathFindExtensionW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW
PathIsDirectoryW
StrStrIW
PathSearchAndQualifyW
SHDeleteValueW
SHGetValueW

comctl32

ord17

msimg32

AlphaBlend

wininet

InternetCrackUrlW
InternetConnectW
InternetOpenW
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetCloseHandle
InternetReadFile

gdiplus

GdipGetImagePixelFormat
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipDeleteBrush
GdipCloneBrush
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipDrawString
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdiplusStartup
GdipCreateBitmapFromHICON

riched20

ord4

crypt32

CertGetNameStringW
CryptBinaryToStringW
CryptStringToBinaryW

netapi32

Netbios

version

VerQueryValueW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

iphlpapi

GetAdaptersInfo
GetIpAddrTable

psapi

EnumProcessModules

secur32

GetUserNameExW

Sections

.text
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 19KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67de31dd9dc6c8d2cdc0b51abddc22de

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0a:e9:30:d9:d6:de:2c:93:b1:0d:f5:9d:8e:dd:68:47Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f9:aa:04:6a:7f:50:36:55:f2:a3:01:28:e1:7c:e6:5c:3c:43:32:29:f9:8a:40:d7:ad:57:9a:9f:ee:d1:bc:9bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

wininet

gdiplus

riched20

crypt32

netapi32

version

wintrust

iphlpapi

psapi

secur32

Sections

.text Size: 799KB - Virtual size: 799KB

.rdata Size: 187KB - Virtual size: 186KB

.data Size: 19KB - Virtual size: 100KB

.gfids Size: 1024B - Virtual size: 604B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 45KB - Virtual size: 48KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0a:e9:30:d9:d6:de:2c:93:b1:0d:f5:9d:8e:dd:68:47
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f9:aa:04:6a:7f:50:36:55:f2:a3:01:28:e1:7c:e6:5c:3c:43:32:29:f9:8a:40:d7:ad:57:9a:9f:ee:d1:bc:9b
Signer

.text
Size: 799KB - Virtual size: 799KB

.rdata
Size: 187KB - Virtual size: 186KB

.data
Size: 19KB - Virtual size: 100KB

.gfids
Size: 1024B - Virtual size: 604B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 45KB - Virtual size: 48KB