31947f42594ad9427c95b9c317a4b6c42677dbc9bfd058338b567676cb1c2f0f

Sharing

Copy URL Twitter E-mail

General

Target

31947f42594ad9427c95b9c317a4b6c42677dbc9bfd058338b567676cb1c2f0f
Size

99KB
MD5

d49edcdf782a122e7d1293792686365b
SHA1

a0ca9ba87990afd8e865d3daa5f47bf4e890e178
SHA256

31947f42594ad9427c95b9c317a4b6c42677dbc9bfd058338b567676cb1c2f0f
SHA512

ea4f7b0bcb9864191d3f8c8d721f55297a47f7fdfa674f5d903db470021d5b21fc690f23173739b2ca35ebf4d61129f73a2f128751f6a700f44552ece87b9d43
SSDEEP

1536:5MaNQMs7qWQS3i4fYJUlIriIXgW/aXnqtlb/333j:5MWxsmWjycYJUlIuIQW0qP/n3

Score

1^/10

Malware Config

Signatures

Files

31947f42594ad9427c95b9c317a4b6c42677dbc9bfd058338b567676cb1c2f0f
.exe windows:4 windows x86

512796b72e6e9f3059ff6d638fef17e5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3f:95:ff:61:a7:95:c3:d5:35:4b:d1:bb:9f:b1:0a:f6
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

11/03/2009, 00:00

Not After

10/03/2012, 23:59

Subject

CN=北京暴风网际科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京暴风网际科技有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

70:50:ef:31:0d:8e:6d:d2:33:b8:da:bc:18:ef:dc:5c:e5:ea:42:b5
Signer

Actual PE Digest

70:50:ef:31:0d:8e:6d:d2:33:b8:da:bc:18:ef:dc:5c:e5:ea:42:b5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetCPInfo
CompareStringW
CompareStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetModuleFileNameA
GetCommandLineA
InterlockedDecrement
lstrlenA
GetPrivateProfileStringA
CloseHandle
ReadFile
CreateFileA
lstrcatA
lstrcpyA
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
HeapReAlloc
VirtualAlloc
SetFilePointer
GetLastError
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetStartupInfoA
GetVersion
ExitProcess
SetEnvironmentVariableA
GetACP
GetOEMCP
HeapFree
WideCharToMultiByte
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile

shell32

SHGetFolderPathA

shlwapi

SHGetValueA
StrStrIA
PathFileExistsA
PathAppendA
PathAddBackslashA
PathRemoveFileSpecA

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

512796b72e6e9f3059ff6d638fef17e5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3f:95:ff:61:a7:95:c3:d5:35:4b:d1:bb:9f:b1:0a:f6Certificate

Extended Key Usages

Key Usages

70:50:ef:31:0d:8e:6d:d2:33:b8:da:bc:18:ef:dc:5c:e5:ea:42:b5Signer

Headers

File Characteristics

Imports

wininet

version

kernel32

shell32

shlwapi

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 43KB - Virtual size: 75KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3f:95:ff:61:a7:95:c3:d5:35:4b:d1:bb:9f:b1:0a:f6
Certificate

70:50:ef:31:0d:8e:6d:d2:33:b8:da:bc:18:ef:dc:5c:e5:ea:42:b5
Signer

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 43KB - Virtual size: 75KB