ESSvcMgr[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ESSvcMgr.exe
Size

99KB
MD5

06f923061ebcac0eb1e78e2c196691e5
SHA1

214700e888ff6b9c3bcf97890d2942fc2363416e
SHA256

68afd265ace42f68cb818004191b0e9ed6eab7bfc136eff9e0884da3cc0ed253
SHA512

455186f8e3bc4a9b083d092b4ba044249a5f03f948c20e5308ed2a0549c36d5ed7ba34116d2bc2f44ea3e01ffac7cd8d2293839168a6d9bfcf514d380653cf41
SSDEEP

3072:uyJpvZLzDqaWFdx2F+Giosk/btPqhPkde:/ZqaWFijhd

Score

1^/10

Malware Config

Signatures

Files

ESSvcMgr.exe
.exe windows:4 windows x86

6c2028fa34c62eeec1ebd3fe6a7bdc72

Code Sign

38:24:bf:9f:7e:08:ca:b6:a0:16:64:34:9d:82:38:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/05/2016, 00:00

Not After

10/06/2019, 23:59

Subject

CN=北京勤哲软件技术有限责任公司,O=北京勤哲软件技术有限责任公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:c7:45:8f:92:9c:6e:5c:6b:e3:1b:75:b9:4c:ce:00:83:09:88:e6
Signer

Actual PE Digest

fd:c7:45:8f:92:9c:6e:5c:6b:e3:1b:75:b9:4c:ce:00:83:09:88:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaFreeObjList
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
__vbaResume
__vbaStrCat
__vbaForEachCollAd
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
ord591
__vbaLateMemSt
__vbaExitProc
__vbaForEachCollObj
ord300
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord306
ord520
__vbaBoolVarNull
__vbaRefVarAry
_CIsin
ord631
ord632
__vbaLateMemStAd
__vbaNextEachCollObj
__vbaChkstk
ord526
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaCyI2
__vbaStrCmp
__vbaVarTstEq
__vbaCyI4
__vbaI2I4
ord561
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
__vbaCastObjVar
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
__vbaFPException
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord536
__vbaI2Var
ord644
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaVarLateMemCallLdRf
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaVarLateMemCallLd
ord616
__vbaFpI4
ord617
__vbaLateMemCallLd
_CIatan
__vbaCastObj
__vbaStrMove
_allmul
__vbaLateIdSt
__vbaLateMemCallSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaI4ErrVar
__vbaFreeStr
ord581

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c2028fa34c62eeec1ebd3fe6a7bdc72

Code Sign

38:24:bf:9f:7e:08:ca:b6:a0:16:64:34:9d:82:38:e1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

fd:c7:45:8f:92:9c:6e:5c:6b:e3:1b:75:b9:4c:ce:00:83:09:88:e6Signer

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 76KB - Virtual size: 75KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 12KB - Virtual size: 9KB

38:24:bf:9f:7e:08:ca:b6:a0:16:64:34:9d:82:38:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

fd:c7:45:8f:92:9c:6e:5c:6b:e3:1b:75:b9:4c:ce:00:83:09:88:e6
Signer

.text
Size: 76KB - Virtual size: 75KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 12KB - Virtual size: 9KB