b3cde97f7fbdbb0a6b536e80061719c1bd83d365c8717adf4559882de56ce459

Sharing

Copy URL Twitter E-mail

General

Target

b3cde97f7fbdbb0a6b536e80061719c1bd83d365c8717adf4559882de56ce459
Size

15.9MB
MD5

c9ddaa2c769449ba20f57885fd60a76e
SHA1

679ee0a81e27fea7e58befcde4dbf72dd63bae8a
SHA256

b3cde97f7fbdbb0a6b536e80061719c1bd83d365c8717adf4559882de56ce459
SHA512

0d11abeadbbf0eaf8d615f48fa0047946ef928001da8eae657d6a3fcb894c432dd3621eafff944032fbe2be13c32c9f21b9c0a2205039b88893671308558eb32
SSDEEP

393216:jqT+Saq8ga5Xn9yBZh8YZAz2JmP4jr6QkXHektlg:+X8ga5XnE+YZc20Pkr6QkXHek

Score

1^/10

Malware Config

Signatures

Files

b3cde97f7fbdbb0a6b536e80061719c1bd83d365c8717adf4559882de56ce459
.exe windows:5 windows x86

1f81de4e1cfbca095629638d3261a869

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c4:e7:29:42:d4:53:f8:65:85:73:ce:fc:26:55:cd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/10/2021, 00:00

Not After

09/12/2022, 23:59

Subject

CN=天津迅读科技有限公司,O=天津迅读科技有限公司,ST=天津市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:55:83:a3:4b:b6:9c:7c:ea:9b:63:e0:d1:22:ca:23:a3:dd:9e:9f:81:20:bf:13:7b:e5:21:d3:3d:5d:d8:b9
Signer

Actual PE Digest

4a:55:83:a3:4b:b6:9c:7c:ea:9b:63:e0:d1:22:ca:23:a3:dd:9e:9f:81:20:bf:13:7b:e5:21:d3:3d:5d:d8:b9

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
LocalAlloc
LoadLibraryExW
lstrcmpiW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetErrorMode
GetFullPathNameW
GetCommandLineW
GetSystemTimeAsFileTime
LocalFree
DecodePointer
FormatMessageW
GetFileAttributesW
GetCurrentProcess
FileTimeToSystemTime
MulDiv
FlushFileBuffers
LoadLibraryA
MoveFileW
GetVersion
GetProcessId
ExitProcess
Process32NextW
Process32FirstW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
CreateToolhelp32Snapshot
TerminateProcess
GlobalFree
SetFilePointer
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalAlloc
GlobalUnlock
GlobalLock
FreeLibrary
LoadLibraryW
GetProcAddress
ResetEvent
GetLocalTime
CreateDirectoryW
MoveFileExW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetTempFileNameW
GetTempPathW
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
CreatePipe
WriteFile
GetModuleHandleW
OutputDebugStringW
WaitForMultipleObjects
SetEvent
CreateEventW
SetStdHandle
CreateProcessA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
ReadConsoleW
SetLastError
MultiByteToWideChar
CreateThread
InterlockedIncrement
InterlockedDecrement
OpenProcess
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetCurrentProcessId
SystemTimeToFileTime
GetSystemTime
ReleaseMutex
RemoveDirectoryW
lstrlenW
CreateMutexW
WaitForSingleObject
WideCharToMultiByte
GetTickCount
GetModuleFileNameW
GetVersionExW
GetCurrentThreadId
Sleep
CopyFileW
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileW
InitializeCriticalSectionAndSpinCount
GetLastError
DeleteCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteConsoleW
GetCurrentDirectoryA
GetSystemDirectoryA
SetEnvironmentVariableA
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetFilePointerEx
SetConsoleCtrlHandler
FindFirstFileExW
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
UnhandledExceptionFilter
LCMapStringW
CompareStringW
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStringTypeW
WaitForSingleObjectEx
DuplicateHandle
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetCurrentThread
ReadDirectoryChangesW
QueueUserAPC
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
AllocConsole
SetCurrentDirectoryW
GetCurrentDirectoryW
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetLocaleInfoW
GetFileInformationByHandle
GetVolumePathNameW
GetShortPathNameW
SetThreadExecutionState
GetLogicalDrives
GetDateFormatW
GetTimeFormatW
RaiseException
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GlobalAddAtomW
GlobalDeleteAtom
lstrcpynW
GetFullPathNameA
CreateEventA
InterlockedCompareExchange
QueryPerformanceFrequency
GetUserDefaultUILanguage
GetACP
TryEnterCriticalSection
GetFileTime
HeapDestroy
FlushConsoleInputBuffer
GlobalMemoryStatus
QueryPerformanceCounter
FindNextFileA
VerifyVersionInfoW
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
FormatMessageA
GetWindowsDirectoryA
SetCurrentDirectoryA
GetModuleHandleA
GetFileType
GetStdHandle
SleepEx
CreateFileA
GetFileAttributesExW
SystemTimeToTzSpecificLocalTime
lstrlenA
GetThreadLocale
SetThreadLocale
SetEndOfFile
GetFileSizeEx
GetLongPathNameW
IsBadReadPtr
DeviceIoControl
GetDriveTypeW
GetNativeSystemInfo
PostQueuedCompletionStatus
GetExitCodeThread
TerminateThread
CreateIoCompletionPort
InterlockedExchange
GetQueuedCompletionStatus
OutputDebugStringA
lstrcmpA
GetWindowsDirectoryW
GetSystemDirectoryW
GetEnvironmentVariableW
SetUnhandledExceptionFilter
InitializeCriticalSection
GetFileAttributesExA

user32

PostMessageW
GetActiveWindow
InvalidateRect
IsWindowVisible
IsRectEmpty
EqualRect
SetTimer
SetRectEmpty
UpdateWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetFocus
GetCursorPos
ReleaseDC
GetDesktopWindow
BringWindowToTop
SetCapture
ReleaseCapture
SetWindowsHookExW
UnhookWindowsHookEx
GetSystemMetrics
CallNextHookEx
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
SetActiveWindow
PtInRect
ClientToScreen
SetWindowTextW
SystemParametersInfoW
ShowWindow
DestroyWindow
CreateAcceleratorTableW
DestroyAcceleratorTable
UnregisterClassW
IsIconic
GetWindow
MonitorFromWindow
GetMonitorInfoW
OffsetRect
EnableWindow
GetCapture
IntersectRect
ScreenToClient
CopyRect
SetCursor
SendMessageTimeoutW
IsZoomed
CopyImage
SetRect
RegisterWindowMessageW
OpenClipboard
GetClipboardData
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
MoveWindow
FindWindowW
GetKeyState
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
GetDlgItem
IsWindow
KillTimer
GetDC
CloseClipboard
RegisterClipboardFormatW
DrawTextW
LoadIconW
TranslateAcceleratorW
GetFocus
IsClipboardFormatAvailable
CreateCaret
CreateIconIndirect
MonitorFromRect
MsgWaitForMultipleObjects
wsprintfW
GetWindowTextLengthW
GetWindowTextW
EmptyClipboard
SetClipboardData
PostQuitMessage
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
BeginPaint
EndPaint
TrackMouseEvent
SetLayeredWindowAttributes
LoadImageW
GetIconInfo
DrawIconEx
GetDoubleClickTime
FillRect
UpdateLayeredWindow
MonitorFromPoint
GetCaretBlinkTime
GetSysColor
GetUpdateRect
ValidateRect
InvalidateRgn
CharLowerW
IsCharAlphaNumericW
UnpackDDElParam
IsWindowUnicode
ShowWindowAsync
ReuseDDElParam
GetScrollInfo
GetCursor
GetWindowDC
DestroyIcon
CreateMenu
AppendMenuW
InsertMenuW
SetMenuItemInfoW
TrackPopupMenu
CreatePopupMenu
GetMenuItemCount
GetMenuItemID
CheckMenuRadioItem
ModifyMenuW
GetMenuItemInfoW
IsDlgButtonChecked
SetDlgItemTextW
CheckRadioButton
SetClassLongW
HideCaret
RedrawWindow
GetMessagePos
DrawFrameControl
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
GetSystemMenu
DdeFreeStringHandle
DdeDisconnect
CheckMenuItem
EndDeferWindowPos
DdeFreeDataHandle
DdeClientTransaction
DdeUninitialize
DdeInitializeW
GetWindowInfo
DdeConnect
DdeCreateStringHandleW
BeginDeferWindowPos
EnumDisplayMonitors
AdjustWindowRectEx
DeferWindowPos
GetMessageW
AllowSetForegroundWindow
FindWindowExW
DispatchMessageW
PeekMessageW
LoadBitmapW
CharNextW
TranslateMessage
SetParent
SetScrollInfo
ShowScrollBar
MapVirtualKeyW
MessageBoxW
GetScrollPos
SetMenu
EnumWindows
DestroyMenu
GetClassNameW
CharLowerBuffW
GetAncestor
IsCharUpperW
SetWindowRgn
DestroyCaret
ShowCaret
SetCaretPos

gdi32

SetStretchBltMode
SetBitmapBits
SetBkMode
SetTextColor
DeleteObject
SetBkColor
GetTextColor
GetCurrentObject
SetTextCharacterExtra
Rectangle
ExtSelectClipRgn
CreateRectRgnIndirect
SaveDC
RestoreDC
GetViewportOrgEx
ExtTextOutW
SelectClipRgn
GetTextExtentPoint32W
SetWorldTransform
IntersectClipRect
GetObjectType
CreateHatchBrush
AbortDoc
SetViewportOrgEx
GetClipBox
GetCharWidthW
MoveToEx
GetRegionData
GetTextFaceA
PolyBezierTo
WidenPath
StrokePath
StrokeAndFillPath
SetMiterLimit
SelectClipPath
SetPixel
EndPath
CloseFigure
BeginPath
GetTextMetricsW
SetPolyFillMode
GetFontData
GetClipRgn
ExtEscape
CreateFontA
CreateFontIndirectA
EnumFontFamiliesExA
TextOutW
SetLayout
SetDIBits
LineTo
CreatePen
GetStockObject
CreateDCW
StartDocW
GetDeviceCaps
SetMapMode
EndPage
StartPage
EndDoc
StretchBlt
CreateCompatibleDC
GetObjectW
CreateFontIndirectW
CreateRoundRectRgn
ExtCreatePen
CreateCompatibleBitmap
BitBlt
SelectPalette
RealizePalette
GetDIBits
CreateDIBSection
GetBitmapBits
CreateBitmapIndirect
CreateRectRgn
CombineRgn
GetObjectA
GetPixel
SetDIBitsToDevice
StretchDIBits
DeleteDC
EnumFontFamiliesExW
FillPath
SelectObject
CreateSolidBrush
GetOutlineTextMetricsW
SetBrushOrgEx
PatBlt
CreatePatternBrush
CreateBitmap
SetROP2
GetDIBColorTable
SetDIBColorTable
SetGraphicsMode

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
DeviceCapabilitiesW
SetPrinterW
GetPrinterW
EnumPrintersW
ord203

comdlg32

GetSaveFileNameW
ChooseColorW
GetOpenFileNameW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegEnumKeyW
CloseServiceHandle
ControlService
StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
CryptDecrypt
CryptEncrypt
CryptDeriveKey
CryptHashData
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
GetUserNameW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
LookupAccountNameW
ConvertSidToStringSidW
DeregisterEventSource
RegisterEventSourceA
ReportEventA

shell32

DragQueryFileW
DragAcceptFiles
ShellExecuteExW
SHBindToParent
DragFinish
SHGetFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHCreateDirectoryExW
SHChangeNotify
SHFileOperationW
ord165
SHAddToRecentDocs
SHGetFileInfoW
SHGetSpecialFolderPathW

ole32

StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
OleUninitialize
StgCreateDocfile
CoCreateInstance
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
ReleaseStgMedium
OleInitialize
CoTaskMemFree
StringFromCLSID
CoGetMalloc

oleaut32

VarBstrCmp
SysAllocStringLen
VariantClear
LoadRegTypeLi
SysAllocStringByteLen
SysStringByteLen
SafeArrayCreateVector
SafeArrayPutElement
SysAllocString
VarUI4FromStr
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
LoadTypeLi
VariantInit
SysStringLen
SysFreeString

ws2_32

WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
shutdown
htonl
socket
getservbyname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
gethostbyname

psapi

GetModuleFileNameExW

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

winmm

mciSendCommandW
mciGetErrorStringW

wldap32

ord145
ord46
ord133
ord147
ord14
ord216
ord142
ord41
ord167
ord118
ord26
ord79
ord127
ord301
ord208
ord27

netapi32

Netbios

iphlpapi

GetAdaptersInfo
GetIpAddrTable

secur32

GetUserNameExW

riched20

ord4

Sections

.text
Size: 7.9MB - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data:
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 347KB - Virtual size: 523KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 976KB - Virtual size: 976KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 351KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1f81de4e1cfbca095629638d3261a869

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:c4:e7:29:42:d4:53:f8:65:85:73:ce:fc:26:55:cdCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4a:55:83:a3:4b:b6:9c:7c:ea:9b:63:e0:d1:22:ca:23:a3:dd:9e:9f:81:20:bf:13:7b:e5:21:d3:3d:5d:d8:b9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

psapi

crypt32

winmm

wldap32

netapi32

iphlpapi

secur32

riched20

Sections

.text Size: 7.9MB - Virtual size: 7.9MB

.data: Size: 733KB - Virtual size: 733KB

.rdata Size: 4.6MB - Virtual size: 4.6MB

.data Size: 347KB - Virtual size: 523KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 976KB - Virtual size: 976KB

.reloc Size: 351KB - Virtual size: 352KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:c4:e7:29:42:d4:53:f8:65:85:73:ce:fc:26:55:cd
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4a:55:83:a3:4b:b6:9c:7c:ea:9b:63:e0:d1:22:ca:23:a3:dd:9e:9f:81:20:bf:13:7b:e5:21:d3:3d:5d:d8:b9
Signer

.text
Size: 7.9MB - Virtual size: 7.9MB

.data:
Size: 733KB - Virtual size: 733KB

.rdata
Size: 4.6MB - Virtual size: 4.6MB

.data
Size: 347KB - Virtual size: 523KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 976KB - Virtual size: 976KB

.reloc
Size: 351KB - Virtual size: 352KB