0967cb0e3dd5acd274dd5ab2ee353b9c76697508aab952666a33d09a78ffbfa1

Sharing

Copy URL Twitter E-mail

General

Target

0967cb0e3dd5acd274dd5ab2ee353b9c76697508aab952666a33d09a78ffbfa1
Size

3.8MB
MD5

3d858900ae916f466ce02f493e4e4ba5
SHA1

4c1a43b730d329c8256f9c17cc4f114750371dc0
SHA256

0967cb0e3dd5acd274dd5ab2ee353b9c76697508aab952666a33d09a78ffbfa1
SHA512

f8a6d39c07f81456349c08748c5ae61f24b4ef24d6a0fb096fa5a1d2777465f749735da16fd8872aed0a3a08f9865955dad506b1985856327b085f17129a2731
SSDEEP

98304:E9+JQZ9QM3u7gDdP4MBFy52fNGXUIPJaa19GB4pk5:E9+JcQgusDdP4MBFyUfNGXDPJaa198

Score

1^/10

Malware Config

Signatures

Files

0967cb0e3dd5acd274dd5ab2ee353b9c76697508aab952666a33d09a78ffbfa1
.exe windows:4 windows x86 arch:x86

5a096b0fd5ac7a24b65e1a709408cb93

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:f2:40:24:c2:80:0b:ad:37:11:bc:a7:be:4e:1f:7b
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

20/06/2012, 00:00

Not After

20/06/2014, 23:59

Subject

CN=上海瑞创网络科技股份有限公司,OU=Provided by TrustAsia,O=上海瑞创网络科技股份有限公司,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

41:be:a2:4d:5f:16:85:42:65:c6:8b:93:a4:64:36:1a:d8:10:e9:22
Signer

Actual PE Digest

41:be:a2:4d:5f:16:85:42:65:c6:8b:93:a4:64:36:1a:d8:10:e9:22

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFile
InternetConnectW
InternetOpenUrlW
HttpSendRequestW
InternetSetOptionW
InternetOpenW
InternetWriteFile
InternetCrackUrlW
HttpOpenRequestW
HttpEndRequestW
HttpSendRequestExW
HttpQueryInfoW
InternetCloseHandle

kernel32

GetTempFileNameW
GetExitCodeProcess
WriteFile
GetFileAttributesW
WaitForSingleObject
GetLongPathNameW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetUserDefaultLangID
LocalFree
LocalAlloc
lstrlenW
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
LoadLibraryW
ExpandEnvironmentStringsW
CopyFileW
LoadLibraryExW
GetCurrentProcessId
FindResourceW
lstrcmpiW
InterlockedIncrement
GetComputerNameW
LoadLibraryA
LoadResource
DeleteCriticalSection
SizeofResource
Process32FirstW
InitializeCriticalSection
CreateToolhelp32Snapshot
Process32NextW
FreeResource
LockResource
InterlockedDecrement
WideCharToMultiByte
GetACP
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
SetFilePointer
SetEndOfFile
ReadFile
GetFileSize
ReleaseMutex
CreateMutexW
GetTempPathW
WritePrivateProfileStringW
GetWindowsDirectoryW
SetFileAttributesW
GetFullPathNameW
MoveFileExW
MoveFileW
GetModuleFileNameA
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
HeapSize
HeapCreate
HeapDestroy
RtlUnwind
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetVersionExA
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
CloseHandle
GetCPInfo
OpenProcess
GetTickCount
Sleep
EnterCriticalSection
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
VirtualAllocEx
DeleteFileW
RemoveDirectoryW
GetLastError
GetPrivateProfileStringW
LeaveCriticalSection
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
LCMapStringA
LCMapStringW
GetConsoleCP
RaiseException
SetLastError
GetCurrentProcess
FlushInstructionCache
GetVersionExW
GetModuleHandleW
GetProcAddress
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetOEMCP

user32

MonitorFromWindow
GetActiveWindow
GetParent
SetDlgItemTextW
GetTopWindow
GetMonitorInfoW
GetDlgItem
GetWindowRect
MapWindowPoints
PostQuitMessage
BringWindowToTop
ShowWindow
EnableWindow
GetWindow
PeekMessageW
CharNextW
SetCursor
CreateDialogParamW
SetWindowTextW
UnregisterClassA
MessageBoxW
SetPropW
ScreenToClient
RegisterClassW
IsWindowVisible
EndPaint
TranslateMessage
DestroyWindow
GetWindowThreadProcessId
SystemParametersInfoW
DispatchMessageW
GetMessageW
BeginPaint
GetClassNameW
FindWindowExW
UnregisterClassW
SetWindowRgn
InvalidateRect
GetPropW
SetWindowPos
CallWindowProcW
GetClassInfoExW
GetDC
DefWindowProcW
SetMenuDefaultItem
TrackPopupMenu
LoadMenuW
SetWindowLongW
RegisterClassExW
SetForegroundWindow
LoadImageW
GetCursorPos
PostMessageW
GetSubMenu
RegisterWindowMessageW
LoadCursorW
CreateWindowExW
LoadIconW
GetDesktopWindow
KillTimer
SendMessageW
IsMenu
DestroyMenu
IsWindow
DestroyIcon
GetSystemMetrics
GetMenuDefaultItem
SetTimer
GetWindowLongW
EnumWindows
GetClientRect

gdi32

CreateFontIndirectW
GetObjectW
BitBlt
GetPixel
CreateRectRgn
CombineRgn
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC

advapi32

RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegSetValueExW
RegEnumKeyW
GetUserNameW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey

shell32

SHGetPathFromIDListW
Shell_NotifyIconW
SHGetSpecialFolderLocation
SHFileOperationW
ShellExecuteW
ShellExecuteExW

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

SHDeleteKeyW

comctl32

InitCommonControlsEx

iphlpapi

GetAdaptersInfo
GetPerAdapterInfo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

dnsapi

DnsRecordListFree
DnsQuery_W

Sections

.text
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a096b0fd5ac7a24b65e1a709408cb93

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

22:f2:40:24:c2:80:0b:ad:37:11:bc:a7:be:4e:1f:7bCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

41:be:a2:4d:5f:16:85:42:65:c6:8b:93:a4:64:36:1a:d8:10:e9:22Signer

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

iphlpapi

version

dnsapi

Sections

.text Size: 288KB - Virtual size: 288KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

22:f2:40:24:c2:80:0b:ad:37:11:bc:a7:be:4e:1f:7b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

41:be:a2:4d:5f:16:85:42:65:c6:8b:93:a4:64:36:1a:d8:10:e9:22
Signer

.text
Size: 288KB - Virtual size: 288KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB