d6bc3f81f2c71d1ac3166f58ec777e06791c515f944a3e37e7ae39582e41043a

Sharing

Copy URL Twitter E-mail

General

Target

d6bc3f81f2c71d1ac3166f58ec777e06791c515f944a3e37e7ae39582e41043a
Size

1.3MB
MD5

5ad06defe6d642af8ff65e4a815026d2
SHA1

e3bcff26d01c0a1f7a4cbfc026a49c5d7684bf56
SHA256

d6bc3f81f2c71d1ac3166f58ec777e06791c515f944a3e37e7ae39582e41043a
SHA512

b7e2dc899ce43053e74bdfd17690048782e007c4996a82b6a870c3cc48c817b6c7cfbe095911578d70bf4129985472dca59399a50283273cdac9e55febf9188b
SSDEEP

24576:cEQ3G3eNNXUcWmt5WJd4myQ0lQHfQolLzQBp2yTHdzlyz73y9e:S0eNNXBsdhoolip/TH7Q73f

Score

1^/10

Malware Config

Signatures

Files

d6bc3f81f2c71d1ac3166f58ec777e06791c515f944a3e37e7ae39582e41043a
.exe windows:5 windows x86

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/11/2019, 00:00

Not After

04/02/2023, 12:00

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:b2:6f:2b:8d:ec:fa:61:66:a3:12:70:2c:3a:e6:88:56:3c:15:24:74:68:fd:ba:af:6a:29:2f:02:25:1f:90
Signer

Actual PE Digest

4f:b2:6f:2b:8d:ec:fa:61:66:a3:12:70:2c:3a:e6:88:56:3c:15:24:74:68:fd:ba:af:6a:29:2f:02:25:1f:90

Digest Algorithm

sha256

PE Digest Matches

false

e4:4f:bc:97:30:84:42:03:dd:9e:29:b6:22:91:75:0b:c1:12:95:ee
Signer

Actual PE Digest

e4:4f:bc:97:30:84:42:03:dd:9e:29:b6:22:91:75:0b:c1:12:95:ee

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetLongPathNameW
IsWow64Process
Process32NextW
Process32FirstW
GetPrivateProfileIntW
InterlockedExchange
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LocalAlloc
VirtualAlloc
lstrcmpA
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
WriteFile
GetTempFileNameW
DeleteFileW
GetFileSize
WritePrivateProfileStringW
GlobalFree
HeapWalk
HeapLock
HeapUnlock
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GlobalAlloc
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemWindowsDirectoryW
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
ExitProcess
VirtualQuery
VirtualProtect
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
lstrlenA
DeviceIoControl
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
GetSystemDirectoryW
HeapFree
GlobalReAlloc
FreeResource
MulDiv
LoadLibraryW
FlushInstructionCache
SetLastError
RaiseException
GlobalSize
GlobalLock
GetProcessHeap
GetDateFormatA
CreateEventW
GetTickCount
ResetEvent
CreateThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrcmpiA
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
InterlockedCompareExchange
Sleep
SetFilePointer
ReadFile
GetSystemInfo
GetWindowsDirectoryW
GetCommandLineW
GetLogicalDriveStringsW
lstrcmpiW
QueryDosDeviceW
lstrcpyW
lstrcatW
LocalFree
GetLastError
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
OpenProcess
SetUnhandledExceptionFilter
TerminateProcess
GetProcAddress
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringW
CreateDirectoryW
CreateProcessW
CloseHandle
GetModuleFileNameW
GetPrivateProfileStringW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
MultiByteToWideChar
FindResourceExW
LoadResource
LockResource
HeapAlloc
SizeofResource
FindResourceW
WideCharToMultiByte
lstrlenW
IsValidLocale
DebugBreak

user32

CreateWindowExW
GetShellWindow
GetWindowThreadProcessId
RegisterClassW
DefWindowProcW
PostQuitMessage
KillTimer
ShowWindow
SetTimer
IntersectRect
UnregisterClassA
GetWindowLongW
SetWindowPos
SetWindowRgn
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
LoadImageW
GetSystemMetrics
SetWindowLongW
RedrawWindow
MoveWindow
InvalidateRect
DestroyIcon
EndDialog
SendMessageW
PtInRect
GetActiveWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetForegroundWindow
SystemParametersInfoW
PostMessageW
FindWindowW
IsWindow
SendMessageTimeoutW
AdjustWindowRectEx
CharNextW
GetMessageW
GetClassInfoW
MessageBoxW
EnumWindows
RegisterClassExW
GetClassInfoExW
GetDlgItem
CallWindowProcW
DrawTextW
DrawIconEx
WindowFromPoint
IsWindowVisible
FindWindowExW
ScreenToClient
GetDlgCtrlID
SetFocus
GetCursorPos
GetClassLongW
FillRect
UpdateLayeredWindow
EndPaint
BeginPaint
OffsetRect
UpdateWindow
ReleaseCapture
GetCapture
SetCapture
ReleaseDC
IsRectEmpty
CopyRect
SetRect
DestroyWindow
CreateDialogIndirectParamW
DialogBoxIndirectParamW
GetDesktopWindow
GetDC
LoadCursorW
SetCursor
IsDialogMessageW

gdi32

GetDIBits
CreateCompatibleBitmap
CreateRectRgnIndirect
IntersectClipRect
CreateDIBSection
SetViewportOrgEx
BitBlt
ExcludeClipRect
SetBkColor
ExtTextOutW
StretchBlt
CreateCompatibleDC
GetObjectW
DeleteDC
GetStockObject
CreateSolidBrush
DeleteObject
SelectObject
TextOutW
SetBkMode
GetTextColor
GetClipBox
SetTextColor
SetStretchBltMode
GetObjectA
CreateRoundRectRgn
GetTextExtentPoint32W
CreateRectRgn
CombineRgn
GetDeviceCaps
CreatePolygonRgn
CreateFontIndirectW
CreateDCW
OffsetViewportOrgEx

advapi32

RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertSidToStringSidW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
DuplicateTokenEx

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW

ole32

GetHGlobalFromStream
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathFindFileNameW
PathRemoveFileSpecW
StrStrIW
StrChrW
StrCmpNW
PathIsDirectoryW
PathCombineW
StrCmpNIA
StrRChrIW
PathFindExtensionW
StrCmpNIW
StrCmpW
StrChrIW
SHSetValueW
SHGetValueW
StrStrIA
StrCmpIW

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdiplusStartup
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipStringFormatGetGenericTypographic
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCloneStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

crypt32

CertGetNameStringW
CertFreeCertificateContext
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CertFindCertificateInStore

imm32

ImmDisableIME

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Sections

.text
Size: 1002KB - Virtual size: 1002KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7eCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:deCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

4f:b2:6f:2b:8d:ec:fa:61:66:a3:12:70:2c:3a:e6:88:56:3c:15:24:74:68:fd:ba:af:6a:29:2f:02:25:1f:90Signer

e4:4f:bc:97:30:84:42:03:dd:9e:29:b6:22:91:75:0b:c1:12:95:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

psapi

iphlpapi

crypt32

imm32

wintrust

Sections

.text Size: 1002KB - Virtual size: 1002KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 22KB - Virtual size: 57KB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 33KB - Virtual size: 32KB

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

4f:b2:6f:2b:8d:ec:fa:61:66:a3:12:70:2c:3a:e6:88:56:3c:15:24:74:68:fd:ba:af:6a:29:2f:02:25:1f:90
Signer

e4:4f:bc:97:30:84:42:03:dd:9e:29:b6:22:91:75:0b:c1:12:95:ee
Signer

.text
Size: 1002KB - Virtual size: 1002KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 22KB - Virtual size: 57KB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 33KB - Virtual size: 32KB