860e97a0cb3f418c7d5b8ff934690186fd85175a17d0e435bf8d15a0336aa7f1

Sharing

Copy URL Twitter E-mail

General

Target

860e97a0cb3f418c7d5b8ff934690186fd85175a17d0e435bf8d15a0336aa7f1
Size

171KB
MD5

0cb321e8feae2f9d43f08cc1fa13f813
SHA1

20daffcee8ac9b7fe655df24d73cf76f159b5e8f
SHA256

860e97a0cb3f418c7d5b8ff934690186fd85175a17d0e435bf8d15a0336aa7f1
SHA512

6b610f691835ce35ebf38b5c7418141d95d405fef301b60e256e1de07705b03b6cff18f22db446f8ab4547ae30f9fccea6a3fc0d7c7cefd11b6a5c9b4c6e7e66
SSDEEP

3072:2XdQyTOo+EhdBxpX19fN+poc/HVOTSeuZY/y/jPGHrIsw1foGSGEdrx3SiXLbVh:RyyGRLfN+oc/HV8SeupGHrIr1fjSTWiP

Score

1^/10

Malware Config

Signatures

Files

860e97a0cb3f418c7d5b8ff934690186fd85175a17d0e435bf8d15a0336aa7f1
.exe windows:4 windows x86

a37ece43e1f48d2720a82d600f539a7b

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

2f:38:f4:92:e9:4c:87:56:52:8e:f7:74:28:9d:ee:91
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

07/03/2008, 00:00

Not After

07/03/2009, 23:59

Subject

CN=北京暴风网际科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京暴风网际科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:58:99:4f:6a:fe:e5:77:d5:e2:e0:de:32:02:33:b0:2b:58:94:09
Signer

Actual PE Digest

d4:58:99:4f:6a:fe:e5:77:d5:e2:e0:de:32:02:33:b0:2b:58:94:09

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CLSIDFromString
CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree

shlwapi

StrCmpIW
StrCmpNIW
StrCpyW
PathRemoveFileSpecA
PathAddBackslashA
StrStrIA
StrTrimA
PathRemoveBackslashA

kernel32

GetLastError
GetStartupInfoA
lstrlenW
CreateProcessA
GetExitCodeProcess
InterlockedDecrement
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
lstrcpyA
lstrcpynA
GetCommandLineA
WriteFile
CreateFileA
Sleep
OutputDebugStringA
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrcatA
GetModuleFileNameA
CreateEventA
WaitForSingleObject
CloseHandle
InterlockedCompareExchange
LocalAlloc
LocalFree
SetEvent
GlobalAlloc
GlobalFree
SetEndOfFile
SetFilePointer
ReadFile
GetFileAttributesA
GetFileSize
FindClose
FindFirstFileA

user32

RegisterClassExA
LoadStringA
GetMessageA
LoadCursorA
DispatchMessageA
LoadIconA
CreateWindowExA
PostMessageA
PostQuitMessage
DefWindowProcA
RegisterWindowMessageA
PostThreadMessageA
PeekMessageA
GetParent
TranslateMessage

oleaut32

SysAllocStringLen
SysStringLen
VariantInit
SysAllocString
VariantCopy
SysFreeString
VariantClear

msvcp60

?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

msvcrt

__getmainargs
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_onexit
__dllonexit
_initterm
calloc
_snprintf
fopen
fprintf
fclose
_stricmp
_beginthreadex
sprintf
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_except_handler3
memmove
realloc
_controlfp
??1type_info@@UAE@XZ
__set_app_type
_CxxThrowException
free
__CxxFrameHandler
wcslen
malloc
_purecall

ws2_32

__WSAFDIsSet
select
sendto
htonl
getsockname
recvfrom
htons
bind
closesocket
socket
WSAGetLastError
WSAStartup
ntohl
setsockopt
ntohs

advapi32

RegQueryValueExA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
QueryServiceStatus
RegCloseKey

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a37ece43e1f48d2720a82d600f539a7b

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

2f:38:f4:92:e9:4c:87:56:52:8e:f7:74:28:9d:ee:91Certificate

Extended Key Usages

Key Usages

d4:58:99:4f:6a:fe:e5:77:d5:e2:e0:de:32:02:33:b0:2b:58:94:09Signer

Headers

File Characteristics

Imports

ole32

shlwapi

kernel32

user32

oleaut32

msvcp60

msvcrt

ws2_32

advapi32

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 68KB - Virtual size: 71KB

.rsrc Size: 11KB - Virtual size: 11KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

2f:38:f4:92:e9:4c:87:56:52:8e:f7:74:28:9d:ee:91
Certificate

d4:58:99:4f:6a:fe:e5:77:d5:e2:e0:de:32:02:33:b0:2b:58:94:09
Signer

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 68KB - Virtual size: 71KB

.rsrc
Size: 11KB - Virtual size: 11KB