360freeap_beta_setup_freewifi[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

360freeap_beta_setup_freewifi.exe
Size

14.5MB
MD5

140db64f7f7269a902fa78d56eae9e9f
SHA1

28b9d6b79abde4bf9ade73e0fb016edec829b8d6
SHA256

e842ab527ebbf6de66d801a5de241522c452f918087e44f0cf6b96fa2468d38b
SHA512

60fa9998a58171988f5d34d4486c7e320d26d13e145cad30ab7690237bc0935a87aeae136a55adc1d38ecc714fca2e3eae0672e0fd0fc2a97c151f2d1a54acef
SSDEEP

393216:8p/S6d/4ChkRygLRd2IMJC2YN0Zzh5BEgOsm:8P9hHgLRd2I2C2VzKDP

Score

1^/10

Malware Config

Signatures

Files

360freeap_beta_setup_freewifi.exe
.exe windows:5 windows x86

af152bfd0c628bfba40398430ae5ac96

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28-09-2018 00:00

Not After

01-02-2020 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a5:2d:17:2f:e9:85:d9:bf:9c:e6:bc:63:70:be:88:84:2e:c4:b7:f5:25:54:87:e2:cc:8b:50:23:fb:8d:27:04
Signer

Actual PE Digest

a5:2d:17:2f:e9:85:d9:bf:9c:e6:bc:63:70:be:88:84:2e:c4:b7:f5:25:54:87:e2:cc:8b:50:23:fb:8d:27:04

Digest Algorithm

sha256

PE Digest Matches

true

cc:1d:7f:23:f3:0f:b6:76:92:63:31:54:46:1a:5f:5b:85:bf:06:76
Signer

Actual PE Digest

cc:1d:7f:23:f3:0f:b6:76:92:63:31:54:46:1a:5f:5b:85:bf:06:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

GetFileAttributesW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
CreateProcessW
GetTickCount
GetTempPathW
WriteFile
ReleaseMutex
CreateMutexA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
LoadLibraryW
DeviceIoControl
GetCurrentProcessId
SetFilePointer
ReadFile
FreeLibrary
DeleteFileA
WritePrivateProfileStringW
CreateThread
TerminateThread
CopyFileW
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryExW
GetModuleFileNameW
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemWindowsDirectoryW
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedCompareExchange
GetSystemDirectoryW
GetPrivateProfileStringW
GetStdHandle
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetWindowsDirectoryW
GetShortPathNameW
GetFullPathNameW
GetCurrentDirectoryW
SearchPathW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
GetFileInformationByHandle
SetEndOfFile
CompareFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
GetTempFileNameW
lstrcmpiW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
SetLastError
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
GetModuleFileNameA
FatalAppExitA
HeapCreate
GetCurrentThread
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
TlsFree
TlsAlloc
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
CreateMutexW
GetSystemTime
LocalFree
GetLocalTime
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetCurrentThreadId
CompareStringW
lstrlenW
lstrcpyW
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetModuleHandleW
MulDiv
FlushInstructionCache
VirtualAlloc
VirtualFree
CreateDirectoryW
GetLastError
OpenProcess
lstrlenA
MoveFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
CloseHandle
DeleteFileW
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetVersionExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CompareStringA

user32

SetWindowTextW
GetMenu
SetWindowPos
GetClientRect
UnregisterClassA
GetDlgItem
IsDialogMessageW
AdjustWindowRectEx
IsWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
SendMessageW
InflateRect
GetWindowTextW
GetWindowTextLengthW
MoveWindow
CreateWindowExW
GetWindowLongW
InvalidateRect
SetTimer
KillTimer
EndDialog
EnableWindow
MessageBoxW
DestroyWindow
GetClassInfoExW
LoadCursorW
DrawTextW
ShowWindow
SetWindowLongW
GetWindowRgn
CharToOemW
CharUpperW
DialogBoxParamW
CreateDialogParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
wsprintfW
FindWindowW
GetWindowThreadProcessId
LoadImageW
LoadStringW
SystemParametersInfoW
ClientToScreen
GetSysColor
GetFocus
GetCapture
ReleaseCapture
GetCursorPos
SetCursor
DrawFocusRect
FillRect
PtInRect
GetDlgCtrlID
SetFocus
SetCapture
IsWindowEnabled
UpdateWindow
ScreenToClient
GetClassNameW
RegisterClassExW
SetRectEmpty
CallWindowProcW
PostMessageW
OffsetRect
ReleaseDC
GetDC
EndPaint
BeginPaint
CharNextW
DefWindowProcW
PostQuitMessage

gdi32

CreateRectRgn
PtInRegion
CreateFontIndirectW
BitBlt
DeleteDC
SetTextColor
GetObjectW
CreateCompatibleBitmap
SetViewportOrgEx
SelectObject
CreateCompatibleDC
DeleteObject
SetBkMode
GetStockObject
GetDeviceCaps
StretchBlt
SetStretchBltMode
CreateDIBSection

advapi32

RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW
RegCloseKey

shell32

ShellExecuteW
SHChangeNotify
ShellExecuteExW
ord680
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

VariantCopy
VariantClear
VarUI4FromStr
SysAllocString
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
VariantInit
SysFreeString
SysAllocStringByteLen

shlwapi

PathFileExistsA
StrStrIW
PathAppendW
SHGetValueW
SHSetValueW
PathFileExistsW
SHGetValueA
SHSetValueA
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW
PathIsDirectoryW
StrToIntExW

comctl32

InitCommonControlsEx
_TrackMouseEvent
ImageList_Destroy
ImageList_GetIconSize

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

gdiplus

GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToStream
GdipSetInterpolationMode
GdipFree
GdiplusStartup
GdipDrawArcI
GdipSetSmoothingMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipDrawImageRectRectI
GdipDisposeImage
GdipCloneImage
GdipAlloc

setupapi

SetupIterateCabinetW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetCloseHandle
HttpQueryInfoW

netapi32

Netbios

msimg32

AlphaBlend

Sections

.text
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.8MB - Virtual size: 13.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af152bfd0c628bfba40398430ae5ac96

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:daCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dcCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

a5:2d:17:2f:e9:85:d9:bf:9c:e6:bc:63:70:be:88:84:2e:c4:b7:f5:25:54:87:e2:cc:8b:50:23:fb:8d:27:04Signer

cc:1d:7f:23:f3:0f:b6:76:92:63:31:54:46:1a:5f:5b:85:bf:06:76Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

gdiplus

setupapi

wintrust

crypt32

wininet

netapi32

msimg32

Sections

.text Size: 577KB - Virtual size: 577KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 18KB - Virtual size: 29KB

.rsrc Size: 13.8MB - Virtual size: 13.8MB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

a5:2d:17:2f:e9:85:d9:bf:9c:e6:bc:63:70:be:88:84:2e:c4:b7:f5:25:54:87:e2:cc:8b:50:23:fb:8d:27:04
Signer

cc:1d:7f:23:f3:0f:b6:76:92:63:31:54:46:1a:5f:5b:85:bf:06:76
Signer

.text
Size: 577KB - Virtual size: 577KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 18KB - Virtual size: 29KB

.rsrc
Size: 13.8MB - Virtual size: 13.8MB