4c0f6f04158c7f90ea1689ccd5038385b975b7604ec10c696b6da046fe818203

Sharing

Copy URL Twitter E-mail

General

Target

4c0f6f04158c7f90ea1689ccd5038385b975b7604ec10c696b6da046fe818203
Size

1.0MB
MD5

d7d35b6b2977b54f898a1b5e9356ba14
SHA1

6fb197bf968c676a682f0d12d13e9e14515b55fc
SHA256

4c0f6f04158c7f90ea1689ccd5038385b975b7604ec10c696b6da046fe818203
SHA512

95ea12f2aa4a3b476f5683504db08c09ab36b63624db48748b455a611520d0b6291ac1071fc0770f74dceaf0c88a2ec5d4f9ff7ac44e01f698ea0d88790077f9
SSDEEP

12288:1Tf7whLHD5u2OkAgYfU2KKQNwBzfTEgFbGj3mQT9qZNhgypIk5:R7C5OkAgYaKrBsgFqzDT9qZYyOa

Score

1^/10

Malware Config

Signatures

Files

4c0f6f04158c7f90ea1689ccd5038385b975b7604ec10c696b6da046fe818203
.exe windows:4 windows x86

a670f72011b9114fb69c8daf0611a761

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/07/2008, 00:00

Not After

11/07/2009, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D Center,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpAddRequestHeadersW
HttpEndRequestW
InternetWriteFile
InternetQueryOptionW
HttpSendRequestExW
InternetSetCookieW
InternetConnectW
HttpOpenRequestW
InternetQueryDataAvailable
HttpSendRequestW
HttpQueryInfoW

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon

shlwapi

StrToIntW
StrStrIW
StrCmpIW
StrToIntA

ws2_32

inet_ntoa
WSAStartup
gethostbyname

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
GetTempPathW
FreeLibrary
SetUnhandledExceptionFilter
lstrcmpiW
GetModuleFileNameW
SizeofResource
LoadLibraryExW
InterlockedIncrement
FindResourceW
LoadResource
InterlockedDecrement
lstrlenW
GetDriveTypeA
SetEndOfFile
CreateFileA
GetStringTypeW
GetStringTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCurrentDirectoryA
GetFullPathNameW
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
FindNextFileW
GetConsoleMode
GetConsoleCP
HeapSize
GetModuleFileNameA
GetStdHandle
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetDriveTypeW
FileTimeToLocalFileTime
RtlUnwind
GetStartupInfoW
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FindFirstFileW
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetVersionExA
LCMapStringW
GetTickCount
WaitNamedPipeW
OpenEventW
LocalAlloc
CreateMutexW
ReleaseMutex
OpenMutexW
RemoveDirectoryW
CreateFileMappingW
GetSystemDirectoryW
MultiByteToWideChar
GetCurrentProcessId
HeapAlloc
FormatMessageW
TerminateProcess
InitializeCriticalSection
WideCharToMultiByte
TerminateThread
CreateProcessW
GetProcessHeap
LocalFree
GetCommandLineW
SetLastError
SetThreadPriority
GetCurrentThreadId
GetCurrentProcess
ResumeThread
RaiseException
Sleep
SuspendThread
FlushInstructionCache
HeapFree
CloseHandle
GetExitCodeProcess
WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
GetSystemInfo
GetLocalTime
GetLastError
GetVersionExW
CompareStringA
CompareStringW
SetEnvironmentVariableA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
InterlockedCompareExchange
FlushFileBuffers
ReadFile
GetFileSize
CreateThread
SetFilePointer
ExitThread
DuplicateHandle
WaitForMultipleObjects
WriteFile
CreateEventW
CreateDirectoryW
MoveFileExW
CreateFileW
VirtualAlloc
FileTimeToSystemTime
FindClose
SetFileAttributesW
GetTimeZoneInformation
CopyFileW
DeleteFileW
GetFileTime
GlobalFree
GlobalAlloc

user32

InvalidateRect
GetWindowRect
SetCursor
GetWindow
ScreenToClient
UnregisterClassA
PostQuitMessage
PeekMessageW
CharNextW
TranslateMessage
DestroyWindow
GetMessageW
DispatchMessageW
GetSysColor
DialogBoxParamW
FillRect
GetWindowLongW
GetWindowTextW
SetWindowPos
GetSystemMenu
ShowWindow
RegisterClassW
SetWindowTextW
RegisterClassExW
SetWindowLongW
DefWindowProcW
FindWindowW
IsWindow
CreateWindowExW
GetSystemMetrics
SendMessageW
SetTimer
GetParent
BeginPaint
IntersectRect
SystemParametersInfoW
IsIconic
PostMessageW
PtInRect
GetClientRect
EndPaint
LoadIconW
EndDialog
LoadCursorW
MapWindowPoints
CallWindowProcW
DrawTextW
GetCursorPos
LoadImageW
KillTimer
SubtractRect
UpdateWindow
MessageBoxW
GetDlgItem
EnableWindow
EnableMenuItem

gdi32

SetTextColor
CreateRectRgn
GetStockObject
CreatePen
MoveToEx
LineTo
SelectObject
CreateSolidBrush
CreateFontIndirectW
SelectClipRgn
GetROP2
SetBkMode
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExW
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
RegQueryValueExW
AllocateAndInitializeSid
EqualSid
GetTokenInformation
LookupAccountSidW
GetSidLengthRequired
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
FreeSid

shell32

SHFileOperationW
CommandLineToArgvW
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
OleInitialize
OleCreate
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
CoTaskMemFree
OleSetContainedObject

oleaut32

SysFreeString
SysAllocString
VarUI4FromStr
VariantClear
VariantInit

imm32

ImmDisableIME

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

hwsignature

GenHWID

Sections

.text
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a670f72011b9114fb69c8daf0611a761

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

wininet

comctl32

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

version

hwsignature

Sections

.text Size: 487KB - Virtual size: 487KB

.rdata Size: 173KB - Virtual size: 173KB

.data Size: 18KB - Virtual size: 49KB

.rsrc Size: 350KB - Virtual size: 350KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5b
Certificate

.text
Size: 487KB - Virtual size: 487KB

.rdata
Size: 173KB - Virtual size: 173KB

.data
Size: 18KB - Virtual size: 49KB

.rsrc
Size: 350KB - Virtual size: 350KB