347cdae9de263f6610eac81547a7783161aa42f17525412fa5f8b1c43827d9fb

Sharing

Copy URL Twitter E-mail

General

Target

347cdae9de263f6610eac81547a7783161aa42f17525412fa5f8b1c43827d9fb
Size

209KB
MD5

156f7d421512628dd31ac7ea79b9ea95
SHA1

3338c6039126aa5045cf12e40b1c5e5144dae775
SHA256

347cdae9de263f6610eac81547a7783161aa42f17525412fa5f8b1c43827d9fb
SHA512

6cc42af71db93446d331580d64a6412e31cc2cde415aaece7aab393bab8cbd2c0b476aa699b967328e8a3cff58d35a9d574de37a117c1bf5cf7becb933803c49
SSDEEP

3072:BOgw9iQYWyUHUo7XYozRii6KJwS/tM/x3kKjhIZoaOEOCJ:Yp94n8oo1h3JwSlMZ35jsdxJ

Score

1^/10

Malware Config

Signatures

Files

347cdae9de263f6610eac81547a7783161aa42f17525412fa5f8b1c43827d9fb
.exe windows:4 windows x86

6f5d5b45f88d3c5fb2e62c85ea6bb665

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

15/02/2009, 00:00

Not After

15/02/2010, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tencent,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

12:f6:f2:4c:4a:45:8d:48:0c:3c:32:d1:b8:2a:77:6e:c4:9a:a7:e1
Signer

Actual PE Digest

12:f6:f2:4c:4a:45:8d:48:0c:3c:32:d1:b8:2a:77:6e:c4:9a:a7:e1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
InterlockedIncrement
CreateThread
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
lstrcmpiA
ReadFile
CreateFileW
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
LoadLibraryW
LCMapStringA
GetCPInfo
LoadLibraryA
OpenMutexW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetStdHandle
SetUnhandledExceptionFilter
GetCommandLineA
GetProcAddress
WideCharToMultiByte
lstrlenW
ReleaseMutex
lstrlenA
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
LCMapStringW
CreateMutexW
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
UnhandledExceptionFilter
SetLastError
TlsAlloc
WriteFile
SetFilePointer
GetStartupInfoA
GetFileType
GetStdHandle
UnmapViewOfFile
Sleep
WaitForMultipleObjects
CreateEventW
ResetEvent
SetEvent
GetTickCount
OpenProcess
OpenEventW
GetLastError
WaitForSingleObject
TerminateThread
EnterCriticalSection
CloseHandle
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetStringTypeW
SetHandleCount
HeapSize
TerminateProcess
RaiseException
ExitProcess
GetVersion
GetStartupInfoW
GetModuleHandleA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
TlsGetValue
TlsSetValue
ResumeThread
RtlUnwind
InterlockedExchange
LocalFree

user32

SetWindowLongW
GetWindowLongW
CallWindowProcW
CreateWindowExW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
KillTimer
PostThreadMessageW
CharNextW
GetMessageW
IsChild
GetFocus
EndPaint
GetClientRect
BeginPaint
SendMessageW
LoadStringW
DefWindowProcW
PostMessageW
IsWindow
DestroyWindow
SetTimer
SetRectEmpty

gdi32

SetWindowOrgEx
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetViewportOrgEx
DeleteDC
RestoreDC

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID
CoLoadLibrary
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString
SysStringLen
VariantClear
SysAllocString
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
LoadRegTypeLi
VariantCopy
VariantInit
VariantChangeType

atl

ord57
ord18
ord17
ord20
ord21
ord16
ord11
ord10
ord43
ord45
ord30
ord32
ord58
ord26
ord27
ord23
ord44

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shlwapi

PathFileExistsW

wininet

InternetSetCookieW
InternetCrackUrlA

ws2_32

htons
recvfrom
ntohl
gethostname
inet_addr
inet_ntoa
WSAStartup
WSACleanup
closesocket
sendto
bind
WSAGetLastError
htonl
gethostbyname
socket

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f5d5b45f88d3c5fb2e62c85ea6bb665

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20Certificate

Extended Key Usages

Key Usages

12:f6:f2:4c:4a:45:8d:48:0c:3c:32:d1:b8:2a:77:6e:c4:9a:a7:e1Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl

version

shlwapi

wininet

ws2_32

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 20KB - Virtual size: 22KB

.rsrc Size: 37KB - Virtual size: 40KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

12:f6:f2:4c:4a:45:8d:48:0c:3c:32:d1:b8:2a:77:6e:c4:9a:a7:e1
Signer

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 20KB - Virtual size: 22KB

.rsrc
Size: 37KB - Virtual size: 40KB