ee391709368ad85e4904851511af592502f1f33b70eb290c5842067eca13828a

Sharing

Copy URL Twitter E-mail

General

Target

ee391709368ad85e4904851511af592502f1f33b70eb290c5842067eca13828a
Size

7.5MB
MD5

089accda9b0c24396224db1c70c24cb3
SHA1

cbe44cd68bf5660755fcea4b17add32b8d5a0607
SHA256

ee391709368ad85e4904851511af592502f1f33b70eb290c5842067eca13828a
SHA512

5119957651615b5297b01b65f07ecc450852dcd4c3fbfcb56b30893c8a2f9a278786023cfcd20b980da500b43b53aa998f5dfcc593feb4cc3cb625dee1c78c9f
SSDEEP

98304:71nW5UuUxP8FH3VthPiG4xN/wKhSCafTzsrc4rFZV8g1uu724/2NC2rre:45sPYkG4bwcS6c4rmgzt/qCur

Score

1^/10

Malware Config

Signatures

Files

ee391709368ad85e4904851511af592502f1f33b70eb290c5842067eca13828a
.exe windows:5 windows x86 arch:x86

571c56be5e018260b2267f3b21bababe

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:03:60:a5:e2:fd:8c:f5:66:1e:d5:da
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

10/01/2023, 08:29

Not After

11/01/2024, 08:29

Subject

SERIALNUMBER=91110108MA01T5DY03,CN=Beijing Juliang Hesheng Technology Co.\, Ltd.,OU=技术部,O=Beijing Juliang Hesheng Technology Co.\, Ltd.,STREET=朝阳区五里桥一街1号院3号楼2层H1-2型研发中心,L=北京市,ST=北京市,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f1:4b:92:bf:0c:12:9e:16:3c:7e:e5:ee:6a:f1:91:0a:fa:16:87:2a
Signer

Actual PE Digest

f1:4b:92:bf:0c:12:9e:16:3c:7e:e5:ee:6a:f1:91:0a:fa:16:87:2a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundW

kernel32

GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
ResetEvent
SetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
EncodePointer
QueryPerformanceFrequency
QueryPerformanceCounter
GetStringTypeW
GetExitCodeThread
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
VirtualAlloc
VirtualFree
GlobalFree
SetLastError
GetProcessHeap
HeapFree
CreateFileA
UnregisterWaitEx
WaitForSingleObject
RtlUnwind
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetModuleHandleExW
GetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapAlloc
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetFilePointerEx
GetFileAttributesExW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapSize
WriteConsoleW
SetEndOfFile
InitializeCriticalSection
SleepEx
DeviceIoControl
GetVolumeInformationA
FindFirstVolumeA
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
VerifyVersionInfoW
VerSetConditionMask
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
FormatMessageW
GetFileAttributesW
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
ReleaseSemaphore
WriteFile
lstrcpyW
MulDiv
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetACP
GetCurrentDirectoryW
GetModuleHandleW
GetFileSize
CopyFileW
DeleteFileW
GetEnvironmentVariableA
lstrcmpiA
GetEnvironmentVariableW
ReadFile
GlobalUnlock
lstrcpynA
GlobalLock
GlobalAlloc
lstrcpynW
CreateDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
lstrcmpiW
GetCommandLineW
GetModuleFileNameA
GetDateFormatW
ExitProcess
GetLocalTime
GetDiskFreeSpaceExW
OutputDebugStringW
FreeLibrary
LocalFree
GetSystemDirectoryA
CompareFileTime
MoveFileExA
WaitForMultipleObjects
LoadLibraryA
GetLastError
GetModuleHandleA
FindClose
lstrlenA
lstrlenW
GetTickCount
WideCharToMultiByte
Sleep
MultiByteToWideChar
SetUnhandledExceptionFilter
GetCurrentProcessId
GetProcAddress
LoadLibraryW
CloseHandle
GetCurrentThreadId
CreateFileW
GetModuleFileNameW
GetCurrentProcess
GetSystemTime
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
FindFirstFileW
ConvertFiberToThread
ConvertThreadToFiber
VirtualProtect
HeapReAlloc

user32

GetActiveWindow
GetUserObjectInformationW
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
EqualRect
SetRect
FillRect
DrawTextW
CharPrevW
GetWindowRgn
IsWindowEnabled
UpdateLayeredWindow
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
MoveWindow
SetWindowRgn
UpdateWindow
InflateRect
SetCursor
PtInRect
IsRectEmpty
OffsetRect
GetProcessWindowStation
IntersectRect
GetSysColor
MapWindowPoints
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
GetFocus
UnionRect
CharNextW
IsZoomed
IsWindowVisible
GetMonitorInfoW
MonitorFromWindow
LoadImageW
LoadCursorW
GetWindow
GetParent
GetPropW
SetPropW
GetSystemMetrics
EnableWindow
SetFocus
ShowWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBoxA
SetForegroundWindow
GetCursorPos
DestroyWindow
PostQuitMessage
FlashWindow
PostMessageA
GetWindowLongW
SetWindowLongW
IsIconic
ScreenToClient
GetClientRect
KillTimer
SetTimer
SetWindowPos
ClientToScreen
GetWindowRect
wsprintfA
MessageBoxW

gdi32

GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
GetTextExtentPointA
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
GetBitmapBits
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetTextMetricsW
PlayEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetObjectW
SetBitmapBits
CreatePatternBrush
CombineRgn
SetStretchBltMode
GetEnhMetaFileHeader

advapi32

ReportEventW
RegQueryValueExA
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExA
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExA
SHGetSpecialFolderPathW
DragQueryFileW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoSetProxyBlanket
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

VariantClear
SysFreeString
VariantInit
SysAllocString

shlwapi

PathFileExistsW
StrCpyW
StrCpyNW
PathStripPathA
PathRemoveExtensionA
PathAppendW
PathCombineW
PathAddExtensionW
PathRemoveFileSpecW

gdiplus

GdipSetPenEndCap
GdipSetPenStartCap
GdipDeletePen
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLine
GdipDrawImageI
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipCreatePen1
GdipSetPenMode
GdipSetPenDashStyle
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipReleaseDC
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetWorldTransform
GdipResetWorldTransform
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipDrawImageRectRect
GdipCreateBitmapFromScan0
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipCreatePen2
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipGetImageGraphicsContext
GdipCreateFontFromDC
GdipRotateWorldTransform
GdipCreateFromHDC

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

ws2_32

gethostbyname
gethostname
WSAStartup
bind
shutdown
ioctlsocket
htonl
select
__WSAFDIsSet
freeaddrinfo
getaddrinfo
sendto
recvfrom
listen
accept
WSACleanup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
getnameinfo
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenSystemStoreA
CertGetCertificateContextProperty
CertOpenStore

wldap32

ord46
ord211
ord60
ord217
ord33
ord45
ord301
ord200
ord30
ord79
ord35
ord143
ord32
ord27
ord26
ord22
ord41
ord50

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 678KB - Virtual size: 677KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

571c56be5e018260b2267f3b21bababe

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

1d:03:60:a5:e2:fd:8c:f5:66:1e:d5:daCertificate

Extended Key Usages

Key Usages

f1:4b:92:bf:0c:12:9e:16:3c:7e:e5:ee:6a:f1:91:0a:fa:16:87:2aSigner

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

imm32

ws2_32

crypt32

wldap32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 678KB - Virtual size: 677KB

.data Size: 34KB - Virtual size: 62KB

.rsrc Size: 176KB - Virtual size: 176KB

.reloc Size: 121KB - Virtual size: 121KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

1d:03:60:a5:e2:fd:8c:f5:66:1e:d5:da
Certificate

f1:4b:92:bf:0c:12:9e:16:3c:7e:e5:ee:6a:f1:91:0a:fa:16:87:2a
Signer

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 678KB - Virtual size: 677KB

.data
Size: 34KB - Virtual size: 62KB

.rsrc
Size: 176KB - Virtual size: 176KB

.reloc
Size: 121KB - Virtual size: 121KB