04e17aa18c61e397290913f9222267cf

Sharing

Copy URL

Twitter E-mail

General

Target

04e17aa18c61e397290913f9222267cf
Size

158KB
MD5

04e17aa18c61e397290913f9222267cf
SHA1

28f2e4e678087b52ee03d9589862685093b35a5c
SHA256

0960e8c9ff184c56e65688929eca46080b8586cbf1c9ecd829c1c09533854b24
SHA512

28feded19fbd972cb99a53680c6b0b81226baa3c2dbfbf5398916982b332abc600c83a9300261abf2928e7526105d4c8fc0ffb47d7fa1adfa6533725675997e2
SSDEEP

3072:gi6OaTfjSMOt4lqBcrh6Gqg562lBmOwetzVGfL8uv:Vz6bQXe1AQuv

Score

1^/10

Malware Config

Signatures

Files

04e17aa18c61e397290913f9222267cf
.dll windows:4 windows x86 arch:x86

d5f75d4b953acc8371bd9bc67e405a8d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:c2:ab:fa:97:54:87:88:98:1d:dd:71:1b:67:3f:ca
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29-09-2015 00:00

Not After

28-10-2017 23:59

Subject

CN=sina.com Technology(China)Co.\,ltd,OU=sina.com Technology(China)Co.\,ltd,O=sina.com Technology(China)Co.\,ltd,L=beijing,ST=beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:2e:84:0b:1e:63:fb:ff:75:05:17:d2:6b:5a:09:9a:63:dd:8f:9d
Signer

Actual PE Digest

62:2e:84:0b:1e:63:fb:ff:75:05:17:d2:6b:5a:09:9a:63:dd:8f:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CopyFileW
CreateFileW
DeviceIoControl
lstrcpyW
lstrcatW
GetTempPathW
FindFirstFileW
GetSystemTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
DeleteFileW
WritePrivateProfileStringW
LoadLibraryW
FreeLibrary
InterlockedDecrement
CreateProcessW
CreateFileA
ReadFile
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Process32NextW
FindClose
FindNextFileW
OpenProcess
Process32FirstW
SetFileAttributesW
CreateToolhelp32Snapshot
GetFileAttributesW
lstrcmpiW
GetLongPathNameW
CreateEventW
WaitForSingleObject
Sleep
SetEvent
FindResourceExW
LoadResource
LockResource
FlushFileBuffers
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
SetFilePointer
GetFileType
SetStdHandle
SizeofResource
TerminateProcess
GetLastError
GetVersionExW
GetCommandLineW
FindResourceW
CloseHandle
GetCurrentProcess
GetPrivateProfileStringW
GetModuleFileNameW
WideCharToMultiByte
CreateMutexW
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetLastError
InterlockedIncrement
TlsFree
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapCreate
VirtualFree
VirtualAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue

user32

UnregisterClassA
FindWindowW
SendMessageW
wsprintfW
GetWindowTextW
SendMessageTimeoutW
LoadStringW
GetClassNameW
GetWindowThreadProcessId
GetDesktopWindow
GetWindow
PostQuitMessage

advapi32

CreateServiceW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
DeleteService
StartServiceW
RegCloseKey
ControlService

shell32

SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHCreateDirectoryExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
StrStrIW
PathCombineW
PathAddExtensionW
SHDeleteValueW
SHDeleteKeyW
PathFileExistsW

builoader

BL_ASYNC_NOTIFYUI
BL_RegistLuaBussiness
BL_LoadXAR
BL_NotifyWnd_AttachListner
BL_ASYNC_NOTIFYUI_INT
BL_DestroyLuaDataStack
?DispatchByName@CLuaC@NSLUAC@@QAEJQ6AHQAX@Z0@Z
??0CLuaC@NSLUAC@@QAE@XZ
??1CLuaC@NSLUAC@@UAE@XZ
?SetObjectClassName@CLuaC@NSLUAC@@QAEXQBD@Z
BL_GetNotifyWnd
BL_XLUE_SetTextObjectDefaultTextType

psapi

GetModuleFileNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Exports

Exports

L_LoadSetupUI
L_UnLoad

Sections

.text
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5f75d4b953acc8371bd9bc67e405a8d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1f:c2:ab:fa:97:54:87:88:98:1d:dd:71:1b:67:3f:caCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

62:2e:84:0b:1e:63:fb:ff:75:05:17:d2:6b:5a:09:9a:63:dd:8f:9dSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

builoader

psapi

version

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 102KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 9KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1f:c2:ab:fa:97:54:87:88:98:1d:dd:71:1b:67:3f:ca
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

62:2e:84:0b:1e:63:fb:ff:75:05:17:d2:6b:5a:09:9a:63:dd:8f:9d
Signer

.text
Size: 104KB - Virtual size: 102KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 9KB