f7967bcc19e20c3083cc07b2d6b6f870

Sharing

Copy URL Twitter E-mail

General

Target

f7967bcc19e20c3083cc07b2d6b6f870
Size

1.3MB
MD5

f7967bcc19e20c3083cc07b2d6b6f870
SHA1

6170a11aa7d8c5e2547626f99d17afadbdafaf97
SHA256

750db9d352ac91659684ab2357d9bd7c63fdfe10bf6a848aa75e07efca3657c3
SHA512

aa881d23b7e87d328d9d27c59d454613d846962a995c18b42a33a5b2f944a6ec156c8e014a0677acf60a313577ebfe0927257092531c16166af6bd9495fa648a
SSDEEP

24576:SFeV7rtFhosiRcNjoqbzg+KjP/GlTRpjznls:4EFhbiHuIGlTrjBs

Score

1^/10

Malware Config

Signatures

Files

f7967bcc19e20c3083cc07b2d6b6f870
.exe windows:5 windows x86 arch:x86

e5540aff8c4695d27ba3da6c1071acf3

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:9c:47:b2:20:64:4d:d3:95:ed:08:18
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

16/10/2018, 05:18

Not After

16/10/2021, 05:18

Subject

SERIALNUMBER=91330106749463103W,CN=杭州九天网络信息技术有限公司,O=杭州九天网络信息技术有限公司,L=杭州,ST=浙江,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130848414e475a484f55,1.3.6.1.4.1.311.60.2.1.2=#13085a48454a49414e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:6a:46:ad:f7:87:73:12:77:1e:5f:26:5f:24:0d:0a:6d:f2:a4:1a:b9:85:96:a3:7b:81:8c:ce:b7:a0:7e:81
Signer

Actual PE Digest

4b:6a:46:ad:f7:87:73:12:77:1e:5f:26:5f:24:0d:0a:6d:f2:a4:1a:b9:85:96:a3:7b:81:8c:ce:b7:a0:7e:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileStringA
GetCurrentDirectoryW
FindClose
FreeResource
LocalFree
GetCommandLineW
SetCurrentDirectoryW
GetModuleFileNameW
FindNextFileW
FindFirstFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
SetFilePointer
CloseHandle
ReadFile
CreateFileA
MultiByteToWideChar
GetLastError
WideCharToMultiByte
WritePrivateProfileStringW
GetLocalTime
GetPrivateProfileStringW
GetComputerNameW
GetSystemDirectoryW
Sleep
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
WaitForSingleObject
CreateProcessW
GetTempPathW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetACP
GlobalLock
GlobalUnlock
GetTickCount
lstrlenW
GetModuleHandleW
ExitProcess
GetFileSize
CreateFileW
FormatMessageW
VerSetConditionMask
GetCurrentProcessId
MulDiv
GetCurrentProcess
GetFileType
WriteFile
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
GlobalAlloc
InterlockedIncrement
InterlockedDecrement
lstrcpyW
InitializeCriticalSection
SleepEx
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
SetLastError
FormatMessageA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFullPathNameW
SetStdHandle
FlushFileBuffers
FindFirstFileExW

user32

GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsWindowVisible
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
SetCaretPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
LoadCursorW
MessageBoxW
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
InflateRect
GetPropW
UpdateLayeredWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
HideCaret
ShowCaret
GetCaretPos
ClientToScreen
IsWindowEnabled
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
OffsetRect
SetWindowRgn
UnionRect
SetCursor
GetWindowThreadProcessId
GetShellWindow
wsprintfW
ShowWindow
GetSystemMetrics
FindWindowW
GetWindowRect
SetWindowPos
GetDesktopWindow
SetWindowTextW
WindowFromPoint
GetForegroundWindow
IsIconic
MoveWindow
GetClassNameW
SetPropW

advapi32

CryptHashData
RegOpenKeyExW
RegOpenKeyW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegCloseKey
RegQueryValueExW
RegEnumValueW

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
DragQueryFileW
Shell_NotifyIconW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoUninitialize

shlwapi

PathIsDirectoryW
PathRemoveFileSpecW

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

ws2_32

socket
ioctlsocket
sendto
listen
gethostbyname
gethostname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
closesocket
accept
freeaddrinfo
getaddrinfo
recvfrom
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
connect
getpeername

wldap32

ord32
ord27
ord26
ord22
ord33
ord41
ord50
ord143
ord30
ord79
ord200
ord301
ord46
ord211
ord60
ord35

gdi32

CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
GetObjectW
PtInRegion
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
GetBitmapBits
SetBitmapBits
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateRectRgn
CreateRoundRectRgn
SetBkMode
SetWindowOrgEx
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
BitBlt
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
SetBkColor

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

comctl32

ord17
InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipImageSelectActiveFrame
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage

Sections

.text
Size: 887KB - Virtual size: 886KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5540aff8c4695d27ba3da6c1071acf3

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

33:9c:47:b2:20:64:4d:d3:95:ed:08:18Certificate

Extended Key Usages

Key Usages

4b:6a:46:ad:f7:87:73:12:77:1e:5f:26:5f:24:0d:0a:6d:f2:a4:1a:b9:85:96:a3:7b:81:8c:ce:b7:a0:7e:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

urlmon

wininet

ws2_32

wldap32

gdi32

oleaut32

imm32

comctl32

gdiplus

Sections

.text Size: 887KB - Virtual size: 886KB

.rdata Size: 198KB - Virtual size: 198KB

.data Size: 9KB - Virtual size: 15KB

.gfids Size: 512B - Virtual size: 472B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 145KB - Virtual size: 145KB

.reloc Size: 47KB - Virtual size: 46KB

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

33:9c:47:b2:20:64:4d:d3:95:ed:08:18
Certificate

4b:6a:46:ad:f7:87:73:12:77:1e:5f:26:5f:24:0d:0a:6d:f2:a4:1a:b9:85:96:a3:7b:81:8c:ce:b7:a0:7e:81
Signer

.text
Size: 887KB - Virtual size: 886KB

.rdata
Size: 198KB - Virtual size: 198KB

.data
Size: 9KB - Virtual size: 15KB

.gfids
Size: 512B - Virtual size: 472B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 145KB - Virtual size: 145KB

.reloc
Size: 47KB - Virtual size: 46KB