General

Malware Config

Signatures

Files

• 1007c86086853e273164a3a16e282c2e0ba55984d4c9925e821fdc5c19fad12c

  .zip
• 2/LxBase.dll

  .dll windows:6 windows x86

  c385a1349b490d18b3059975945d55c4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleHandleA

  GetProcAddress

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  UnhandledExceptionFilter

  user32

  MessageBoxA

  shlwapi

  PathStripPathA

  vcruntime140

  __std_type_info_destroy_list

  _except_handler4_common

  memset

  api-ms-win-crt-runtime-l1-1-0

  _cexit

  _configure_narrow_argv

  _execute_onexit_table

  _initialize_narrow_environment

  _initialize_onexit_table

  _initterm

  _initterm_e

  _seh_filter_dll

  exit

  api-ms-win-crt-heap-l1-1-0

  calloc

  free

  malloc

  api-ms-win-crt-string-l1-1-0

  strlen

  Exports

  Exports

  AheadLib_allocString

  AheadLib_allocStringFromUTF8

  AheadLib_allocStringFromWideChars

  AheadLib_createChannel

  AheadLib_logger_add

  AheadLib_logger_flush

  AheadLib_logger_write

  AheadLib_open_file_logger

  AheadLib_open_ipc_logger

  AheadLib_pathAppend

  AheadLib_pathFileExists

  AheadLib_uuidString

  allocString

  allocStringFromUTF8

  allocStringFromWideChars

  createChannel

  logger_add

  logger_flush

  logger_write

  open_file_logger

  open_ipc_logger

  pathAppend

  pathFileExists

  uuidString

  Sections

  .text

  Size: 686KB - Virtual size: 686KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 110KB - Virtual size: 110KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .00cfg

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .ndata

  Size: 118KB - Virtual size: 117KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 2/spc.exe

  .exe windows:5 windows x86

  713e051daf412e69ecc6700d197515cd

  
  

  Code Sign

  04:00:00:00:00:01:2f:4e:e1:52:d7

  Certificate

  Issuer

  CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

  Not Before

  13-04-2011 10:00

  Not After

  28-01-2028 12:00

  Subject

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  24-05-2016 00:00

  Not After

  24-06-2027 00:00

  Subject

  CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:ce:30:03:38:39:86:bc:95:44:87:e5:c8:6c:6f:1f

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  03-07-2019 00:00

  Not After

  06-07-2022 12:00

  Subject

  CN=Blueix Mobile Technology Co.\,Ltd.,OU=运维中心,O=Blueix Mobile Technology Co.\,Ltd.,L=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:c9:7a:8d:30:ef:42:a1:a1:09:8c:d2:c6:7c:2b:58

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  28-06-2019 00:00

  Not After

  06-07-2022 12:00

  Subject

  CN=Blueix Mobile Technology Co.\,Ltd.,OU=运维中心,O=Blueix Mobile Technology Co.\,Ltd.,L=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  a3:89:f5:9b:73:93:49:b4:7a:62:c5:95:cb:67:49:35:b6:bb:a6:30:98:e5:e2:5e:c3:f5:3c:82:c7:64:30:d2

  Signer

  Actual PE Digest

  a3:89:f5:9b:73:93:49:b4:7a:62:c5:95:cb:67:49:35:b6:bb:a6:30:98:e5:e2:5e:c3:f5:3c:82:c7:64:30:d2

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  74:a7:67:c9:e3:77:ec:fe:d3:b2:9e:5f:b4:68:b2:8e:ad:78:d8:76

  Signer

  Actual PE Digest

  74:a7:67:c9:e3:77:ec:fe:d3:b2:9e:5f:b4:68:b2:8e:ad:78:d8:76

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetModuleFileNameW

  CreateMutexW

  GetLastError

  LoadLibraryW

  GetCurrentProcess

  TerminateProcess

  GetProcAddress

  GetModuleHandleW

  ReleaseMutex

  CloseHandle

  GetShortPathNameW

  InitializeCriticalSectionAndSpinCount

  RaiseException

  DecodePointer

  DeleteCriticalSection

  SetErrorMode

  CreateFileW

  WriteConsoleW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetStringTypeW

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetProcessHeap

  HeapAlloc

  HeapFree

  HeapReAlloc

  HeapSize

  HeapDestroy

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetOEMCP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  FindClose

  LCMapStringW

  IsDebuggerPresent

  OutputDebugStringW

  EnterCriticalSection

  LeaveCriticalSection

  TryEnterCriticalSection

  GetCurrentThreadId

  WideCharToMultiByte

  QueryPerformanceCounter

  SetLastError

  CreateEventW

  Sleep

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetTickCount

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetStartupInfoW

  GetCurrentProcessId

  InitializeSListHead

  SignalObjectAndWait

  SwitchToThread

  CreateThread

  SetThreadPriority

  GetThreadPriority

  GetLogicalProcessorInformation

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  GetNumaHighestNodeNumber

  GetProcessAffinityMask

  SetThreadAffinityMask

  RegisterWaitForSingleObject

  UnregisterWait

  EncodePointer

  GetCurrentThread

  GetThreadTimes

  FreeLibrary

  FreeLibraryAndExitThread

  GetModuleHandleA

  LoadLibraryExW

  GetVersionExW

  VirtualAlloc

  VirtualFree

  VirtualProtect

  DuplicateHandle

  ReleaseSemaphore

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  InterlockedFlushSList

  QueryDepthSList

  UnregisterWaitEx

  CreateTimerQueue

  RtlUnwind

  ExitProcess

  GetModuleHandleExW

  MultiByteToWideChar

  GetStdHandle

  WriteFile

  GetACP

  GetFileType

  user32

  GetActiveWindow

  MessageBoxW

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  ole32

  CoInitialize

  CoUninitialize

  shlwapi

  PathFindFileNameW

  PathAppendW

  PathRemoveFileSpecW

  PathFileExistsW

  lxbase

  pathFileExists

  open_ipc_logger

  logger_add

  open_file_logger

  createChannel

  uuidString

  allocStringFromWideChars

  allocString

  pathAppend

  allocStringFromUTF8

  logger_write

  logger_flush

  Sections

  .text

  Size: 206KB - Virtual size: 205KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 75KB - Virtual size: 74KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 171KB - Virtual size: 171KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ