20a4e7c07865d3c754a557d63d4ca87959c9b35513f1e4ba43ca91fdffd97440

Sharing

Copy URL Twitter E-mail

General

Target

20a4e7c07865d3c754a557d63d4ca87959c9b35513f1e4ba43ca91fdffd97440
Size

15.6MB
MD5

858db0febd5d57d5c7df7ddc797940dc
SHA1

02a89cb1ad708e3a5d6ca51223fc625c2c84c572
SHA256

20a4e7c07865d3c754a557d63d4ca87959c9b35513f1e4ba43ca91fdffd97440
SHA512

8bf89e290012942871eeab9df1feec0acebd24248928b6fa2efdba768b78ac26ca4b41e9fc6a1052ae8fa3e4165f1e4e1711faf378d8bb30223477ec353a67bc
SSDEEP

393216:psi/Cv1/ilj4wnetXHsmw5AWaqhbwZyM9Tp66fp0x:RCt24wevSDa8bwAMp66f+x

Score

1^/10

Malware Config

Signatures

Files

20a4e7c07865d3c754a557d63d4ca87959c9b35513f1e4ba43ca91fdffd97440
.exe windows:6 windows x86

a96dfcd36f8902d453f1536e67add757

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

28/01/2021, 11:08

Not After

01/03/2032, 11:08

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ca:e6:c5:a6:e9:b3:ff:bd:33:33:e4:0f:14:77:df:68:a9:84:d1:f4:7d:68:37:76:52:93:a4:2a:11:79:ec:d1
Signer

Actual PE Digest

ca:e6:c5:a6:e9:b3:ff:bd:33:33:e4:0f:14:77:df:68:a9:84:d1:f4:7d:68:37:76:52:93:a4:2a:11:79:ec:d1

Digest Algorithm

sha256

PE Digest Matches

false

f2:8d:53:bd:1e:c1:63:33:64:bc:a4:fd:0e:32:fa:87:d8:3d:fc:db
Signer

Actual PE Digest

f2:8d:53:bd:1e:c1:63:33:64:bc:a4:fd:0e:32:fa:87:d8:3d:fc:db

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW

user32

EndDeferWindowPos

gdi32

MoveToEx

advapi32

RegSetValueExW

shell32

ShellExecuteW

ole32

OleDuplicateData

oleaut32

LHashValOfNameSys

comctl32

ImageList_AddMasked

msimg32

TransparentBlt

shlwapi

PathFindFileNameW

uxtheme

DrawThemeText

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromHBITMAP

ws2_32

WSACleanup

oleacc

LresultFromObject

imm32

ImmReleaseContext

winmm

PlaySoundW

winspool.drv

ClosePrinter

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uEk
Size: 8.5MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.8\{
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Uj=
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a96dfcd36f8902d453f1536e67add757

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7eCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:deCertificate

Extended Key Usages

Key Usages

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

ca:e6:c5:a6:e9:b3:ff:bd:33:33:e4:0f:14:77:df:68:a9:84:d1:f4:7d:68:37:76:52:93:a4:2a:11:79:ec:d1Signer

f2:8d:53:bd:1e:c1:63:33:64:bc:a4:fd:0e:32:fa:87:d8:3d:fc:dbSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

shlwapi

uxtheme

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

winspool.drv

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 350KB - Virtual size: 349KB

.data Size: 24KB - Virtual size: 42KB

.uEk Size: 8.5MB - Virtual size: 8.5MB

.8\{ Size: 512B - Virtual size: 168B

.Uj= Size: 4.8MB - Virtual size: 4.8MB

.reloc Size: 139KB - Virtual size: 139KB

.rsrc Size: 163KB - Virtual size: 163KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

ca:e6:c5:a6:e9:b3:ff:bd:33:33:e4:0f:14:77:df:68:a9:84:d1:f4:7d:68:37:76:52:93:a4:2a:11:79:ec:d1
Signer

f2:8d:53:bd:1e:c1:63:33:64:bc:a4:fd:0e:32:fa:87:d8:3d:fc:db
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 350KB - Virtual size: 349KB

.data
Size: 24KB - Virtual size: 42KB

.uEk
Size: 8.5MB - Virtual size: 8.5MB

.8\{
Size: 512B - Virtual size: 168B

.Uj=
Size: 4.8MB - Virtual size: 4.8MB

.reloc
Size: 139KB - Virtual size: 139KB

.rsrc
Size: 163KB - Virtual size: 163KB