d9130585ad2ba1646b9f20653d94531eb057dd39d2feba086fdae2723490799d

Sharing

Copy URL Twitter E-mail

General

Target

d9130585ad2ba1646b9f20653d94531eb057dd39d2feba086fdae2723490799d
Size

1007KB
MD5

d600b678ad5b5f1709041d93cabd2490
SHA1

6bf2870307ae6e44824b49812a7428edad28a522
SHA256

d9130585ad2ba1646b9f20653d94531eb057dd39d2feba086fdae2723490799d
SHA512

c4a31410412030ff88886e4ed2a2aa81b342a76b962c75353d1a0b2a482d40633729cad57af849941a346d0f03aa96de40688e47f623ca937fa80160d550fb32
SSDEEP

12288:50XWTOmbDbOJJ0TR4u7Tgw3wonQCKrbxsoDasprSFB/gmDYYsLPpKfBjvrEH7h:50TmbD+J0lTbMTnVeFB/gAlrEH7h

Score

1^/10

Malware Config

Signatures

Files

d9130585ad2ba1646b9f20653d94531eb057dd39d2feba086fdae2723490799d
.exe windows:5 windows x86

820b9bdb0b66659f8f66b12aaa27076a

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:1f:a0:81:02:56:68:8f:df:45:bf:ae
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

02/08/2019, 02:40

Not After

27/10/2022, 08:59

Subject

CN=ShangHai ZhangZheng Network Technology Co.\, Ltd.,O=ShangHai ZhangZheng Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:0d:c5:fd:c1:5d:6c:b0:12:d7:d6:86:04:3c:c1:0d:29:4c:4b:41
Signer

Actual PE Digest

02:0d:c5:fd:c1:5d:6c:b0:12:d7:d6:86:04:3c:c1:0d:29:4c:4b:41

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
InitializeCriticalSection
LocalFree
lstrlenW
CreateMutexW
GetCommandLineW
GetLastError
GetTickCount
GetACP
ExitProcess
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetFileType
DuplicateHandle
DosDateTimeToFileTime
SetFileTime
MulDiv
InterlockedIncrement
InterlockedDecrement
HeapFree
HeapAlloc
DecodePointer
EncodePointer
ExitThread
SystemTimeToFileTime
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
HeapReAlloc
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetStdHandle
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
LCMapStringW
GetLocaleInfoW
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetHandleCount
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
GetStringTypeW
GetConsoleCP
GetConsoleMode
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileA
SetEndOfFile
GetProcessHeap
GetLocalTime
UnmapViewOfFile
WriteFile
MapViewOfFile
CreateFileMappingW
CreateFileW
ReadFile
SetFilePointer
GetFileSize
GetFileInformationByHandle
FileTimeToSystemTime
GetCurrentProcess
GetProcAddress
GetModuleHandleW
CloseHandle
CreateProcessW
OutputDebugStringA
WideCharToMultiByte
SetEnvironmentVariableW
GetEnvironmentVariableW
MultiByteToWideChar
CreateDirectoryW
ResumeThread
GetModuleFileNameW

user32

GetMessageW
wsprintfW
DefWindowProcW
EnableWindow
LoadImageW
GetSystemMetrics
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
RegisterClassW
RegisterClassExW
GetClassInfoExW
CharNextW
MoveWindow
IntersectRect
DrawTextW
FillRect
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
DrawIconEx
InvalidateRgn
CreateAcceleratorTableW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
GetUpdateRect
BeginPaint
EndPaint
TranslateMessage
UpdateLayeredWindow
MapWindowPoints
CreateWindowExW
GetFocus
SetFocus
DestroyWindow
ReleaseDC
PtInRect
ReleaseCapture
SetCapture
KillTimer
SetTimer
InvalidateRect
GetDC
GetKeyState
SendMessageW
SetWindowLongW
MessageBoxW
IsWindow
GetWindowRect
SetWindowRgn
GetWindowLongW
IsZoomed
GetMonitorInfoW
IsIconic
LoadCursorW
SetCursor
UnionRect
InflateRect
OffsetRect
SetWindowPos
PostMessageW
PostQuitMessage
ScreenToClient
GetClientRect
DispatchMessageW
ShowWindow
GetParent
GetCursorPos
IsRectEmpty
GetWindow
MonitorFromWindow

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitialize
CLSIDFromString

shlwapi

PathRemoveFileSpecW
PathFileExistsW

wininet

HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW

msimg32

AlphaBlend

gdi32

StretchBlt
CreateDIBSection
SetBkMode
SetBkColor
SetTextColor
SetStretchBltMode
RestoreDC
ExtTextOutW
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
CombineRgn
BitBlt
Rectangle
SetWindowOrgEx
GetTextExtentPoint32W
GetCharABCWidthsW
GdiFlush
CreateRoundRectRgn
GetTextMetricsW
SelectObject
GetDeviceCaps
GetObjectA
DeleteDC
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
CreateCompatibleDC
CreateCompatibleBitmap
SaveDC
TextOutW
DeleteObject
CreateFontIndirectW
GetObjectW
GetStockObject
CreatePen

oleaut32

SysAllocString
VariantInit
VariantClear
SysFreeString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

comctl32

ord17
_TrackMouseEvent

gdiplus

GdiplusShutdown
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipDeleteFont
GdiplusStartup
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDrawString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush

Sections

.text
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

820b9bdb0b66659f8f66b12aaa27076a

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

33:1f:a0:81:02:56:68:8f:df:45:bf:aeCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

02:0d:c5:fd:c1:5d:6c:b0:12:d7:d6:86:04:3c:c1:0d:29:4c:4b:41Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

msimg32

gdi32

oleaut32

comctl32

gdiplus

Sections

.text Size: 548KB - Virtual size: 548KB

.rdata Size: 119KB - Virtual size: 118KB

.data Size: 11KB - Virtual size: 22KB

.rsrc Size: 211KB - Virtual size: 211KB

.reloc Size: 33KB - Virtual size: 32KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

33:1f:a0:81:02:56:68:8f:df:45:bf:ae
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

02:0d:c5:fd:c1:5d:6c:b0:12:d7:d6:86:04:3c:c1:0d:29:4c:4b:41
Signer

.text
Size: 548KB - Virtual size: 548KB

.rdata
Size: 119KB - Virtual size: 118KB

.data
Size: 11KB - Virtual size: 22KB

.rsrc
Size: 211KB - Virtual size: 211KB

.reloc
Size: 33KB - Virtual size: 32KB