fce4af406cb5165db680af67e7d711a5c37796e91e2f939ecb75b9d8b492e92b

Sharing

Copy URL Twitter E-mail

General

Target

fce4af406cb5165db680af67e7d711a5c37796e91e2f939ecb75b9d8b492e92b
Size

288KB
MD5

23042ce00408cab5858e62f4d476ccba
SHA1

696c22e4b8960b340bcbb69ba6696ffdfb04e847
SHA256

fce4af406cb5165db680af67e7d711a5c37796e91e2f939ecb75b9d8b492e92b
SHA512

bf05890334d7a2a7bebba1d9b3a10bfab047cf716abd58dba5467fdef9852c587b18f3ee883c015449057d74c10c748de0a94635e0303672e033f4ba4bf83d21
SSDEEP

3072:8vm79o6AFulZ4wUr9RoW2NtXe+2x0BKD+6rm8you00v5l2decuwhrJ+FDLadcmpL:8l8ZLwyLXeHK6LyouMZS6Q7

Score

1^/10

Malware Config

Signatures

Files

fce4af406cb5165db680af67e7d711a5c37796e91e2f939ecb75b9d8b492e92b
.exe windows:4 windows x86

7be4940d9fe06a092194af1882f91f41

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:2c:b5:cb:e6:93:76:ab:cf:1f:df:d5:aa:ba:ca:0b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

07/07/2010, 00:00

Not After

05/08/2012, 23:59

Subject

CN=福建网龙计算机网络信息技术有限公司,O=福建网龙计算机网络信息技术有限公司,L=Fu Zhou,ST=Fu Jian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:3f:86:43:8c:5f:67:c8:4f:97:ae:19:ba:e7:8f:3c:bc:ed:de:31
Signer

Actual PE Digest

2a:3f:86:43:8c:5f:67:c8:4f:97:ae:19:ba:e7:8f:3c:bc:ed:de:31

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RaiseException
GetStartupInfoA
GetCommandLineA
ExitProcess
ExitThread
GetACP
SetStdHandle
GetFileType
HeapReAlloc
HeapSize
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetCurrentDirectoryA
GetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
WritePrivateProfileStringA
GetProfileStringA
InterlockedExchange
SetErrorMode
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
SizeofResource
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
SuspendThread
SetThreadPriority
ResumeThread
GlobalAlloc
lstrcmpA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DuplicateHandle
CreateFileA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
lstrcpynA
GetFileTime
GetFileSize
MulDiv
SetLastError
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
GetDriveTypeA
TerminateThread
GetFileAttributesExA
FormatMessageA
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
CreateProcessA
GetExitCodeProcess
GetShortPathNameA
CreateDirectoryA
ResetEvent
CreateToolhelp32Snapshot
Process32First
Module32First
Module32Next
GetSystemDefaultLangID
Process32Next
OpenProcess
TerminateProcess
GetCurrentThread
LocalAlloc
LocalFree
GetVersionExA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
Sleep
CopyFileA
GetModuleFileNameA
lstrlenA
WaitForSingleObject
SetEvent
CloseHandle
WaitForMultipleObjects
MoveFileExA
GetLastError
SetFileAttributesA
DeleteFileA
CreateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
GetTickCount
SetHandleCount

user32

InflateRect
LoadCursorA
GetSysColorBrush
InvalidateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
GetSysColor
DispatchMessageA
SetFocus
AdjustWindowRectEx
ScreenToClient
IsWindowVisible
GetTopWindow
MessageBoxA
GetCapture
PtInRect
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
GetWindowRect
EnableWindow
FillRect
UnregisterClassA
HideCaret
ShowCaret
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
GetDC
ReleaseDC
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetParent
GetWindowLongA
GetDlgItem
IsWindowEnabled
PeekMessageA
IsWindow
KillTimer
GetClassNameA
DestroyMenu
GetMessageA
TranslateMessage
ValidateRect
GetCursorPos
SetCursor
PostQuitMessage
WaitMessage
CharUpperA
IsIconic
GetSystemMetrics
DrawIcon
SendMessageA
GetSystemMenu
EnableMenuItem
LoadIconA
SetTimer
PostMessageA
wsprintfA
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
CharNextA
IsWindowUnicode
GrayStringA
DrawTextA
WinHelpA
TabbedTextOutA
GetClientRect
LoadStringA
GetFocus

gdi32

DeleteObject
GetDeviceCaps
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
IntersectClipRect
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
PatBlt
CreateFontA
SelectObject
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
GetTextExtentPoint32A

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteExA

comctl32

ImageList_Destroy
ord17

ole32

CoUninitialize
CoInitialize

urlmon

URLDownloadToFileA

shlwapi

PathIsDirectoryA
PathFileExistsA

wsock32

gethostbyname
recv
send
WSAAsyncSelect
inet_ntoa
closesocket
recvfrom
sendto
connect
htonl
htons
bind
ioctlsocket
accept
WSAGetLastError
WSACleanup
WSAStartup
socket
WSASetLastError

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

timeKillEvent
timeSetEvent

Sections

.text
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7be4940d9fe06a092194af1882f91f41

Code Sign

0aCertificate

Extended Key Usages

Key Usages

4d:2c:b5:cb:e6:93:76:ab:cf:1f:df:d5:aa:ba:ca:0bCertificate

Extended Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2a:3f:86:43:8c:5f:67:c8:4f:97:ae:19:ba:e7:8f:3c:bc:ed:de:31Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

urlmon

shlwapi

wsock32

version

winmm

Sections

.text Size: 204KB - Virtual size: 204KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 12KB - Virtual size: 29KB

.rsrc Size: 20KB - Virtual size: 20KB

0a
Certificate

4d:2c:b5:cb:e6:93:76:ab:cf:1f:df:d5:aa:ba:ca:0b
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2a:3f:86:43:8c:5f:67:c8:4f:97:ae:19:ba:e7:8f:3c:bc:ed:de:31
Signer

.text
Size: 204KB - Virtual size: 204KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 12KB - Virtual size: 29KB

.rsrc
Size: 20KB - Virtual size: 20KB