04b6d766af4a5f3250915bb829cd1b6a

Sharing

Copy URL

Twitter E-mail

General

Target

04b6d766af4a5f3250915bb829cd1b6a
Size

279KB
MD5

04b6d766af4a5f3250915bb829cd1b6a
SHA1

5dced1657620281f902a3ed1b39322d5a6ba3b9b
SHA256

ed230f3097588532ebb20b081ba55fc865dee43e8c325ca1ca004fdd0f1bd6b3
SHA512

03ef32518fd664d97d95d9c64142597887e02d98fce1abdeb6ad1dbbbc06f83d43fa80377f1b2368a10bcdf956c88c780adf6e7818eb68cc6e6f85e649cffde2
SSDEEP

3072:6femVGjbV8ixLM9EqRQjh6NnQBw4YG4raoGER4EvbZj11vgB7ocvARnLP:swiix2EqOcP43CvbZj11vgnvOP

Score

1^/10

Malware Config

Signatures

Files

04b6d766af4a5f3250915bb829cd1b6a
.dll windows:4 windows x86 arch:x86

e5ce09183f77d84d0da57e40ebf7ef93

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

34:8a:4d:46:c9:a1:a9:ed:c2:b4:81:84:65:a6:6b:ed
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2014, 00:00

Not After

21/06/2016, 23:59

Subject

CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,OU=RDC,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:ef:77:ea:7b:29:2f:15:20:df:e4:b4:6a:06:cd:d2:29:eb:37:cd
Signer

Actual PE Digest

65:ef:77:ea:7b:29:2f:15:20:df:e4:b4:6a:06:cd:d2:29:eb:37:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
FindAtomA
GetAtomNameA

msvcrt

_strdup
__dllonexit
_assert
_errno
_iob
abort
calloc
fflush
free
fwrite
getenv
malloc
memmove
memset
realloc
strcat
strcmp
strcpy
strlen

Exports

Exports

_tld_tables
c_isalnum
c_isalpha
c_isascii
c_isblank
c_iscntrl
c_isdigit
c_isgraph
c_islower
c_isprint
c_ispunct
c_isspace
c_isupper
c_isxdigit
c_strcasecmp
c_strncasecmp
c_tolower
c_toupper
idn_free
idna_strerror
idna_to_ascii_4i
idna_to_ascii_4z
idna_to_ascii_8z
idna_to_ascii_lz
idna_to_unicode_44i
idna_to_unicode_4z4z
idna_to_unicode_8z4z
idna_to_unicode_8z8z
idna_to_unicode_8zlz
idna_to_unicode_lzlz
pr29_4
pr29_4z
pr29_8z
pr29_strerror
punycode_decode
punycode_encode
punycode_strerror
str_iconv
stringprep
stringprep_4i
stringprep_4zi
stringprep_check_version
stringprep_convert
stringprep_iscsi
stringprep_iscsi_prohibit
stringprep_kerberos5
stringprep_locale_charset
stringprep_locale_to_utf8
stringprep_nameprep
stringprep_plain
stringprep_profile
stringprep_profiles
stringprep_rfc3454_A_1
stringprep_rfc3454_B_1
stringprep_rfc3454_B_2
stringprep_rfc3454_B_3
stringprep_rfc3454_C_1_1
stringprep_rfc3454_C_1_2
stringprep_rfc3454_C_2_1
stringprep_rfc3454_C_2_2
stringprep_rfc3454_C_3
stringprep_rfc3454_C_4
stringprep_rfc3454_C_5
stringprep_rfc3454_C_6
stringprep_rfc3454_C_7
stringprep_rfc3454_C_8
stringprep_rfc3454_C_9
stringprep_rfc3454_D_1
stringprep_rfc3454_D_2
stringprep_saslprep
stringprep_saslprep_space_map
stringprep_strerror
stringprep_trace
stringprep_ucs4_nfkc_normalize
stringprep_ucs4_to_utf8
stringprep_unichar_to_utf8
stringprep_utf8_nfkc_normalize
stringprep_utf8_to_locale
stringprep_utf8_to_ucs4
stringprep_utf8_to_unichar
stringprep_xmpp_nodeprep
stringprep_xmpp_nodeprep_prohibit
stringprep_xmpp_resourceprep
strverscmp
tld_check_4
tld_check_4t
tld_check_4tz
tld_check_4z
tld_check_8z
tld_check_lz
tld_default_table
tld_get_4
tld_get_4z
tld_get_table
tld_get_z
tld_strerror

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 208B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stab
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_MEM_DISCARDABLE

.stabstr
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_MEM_DISCARDABLE

Sharing

General

Malware Config

Signatures

Files

e5ce09183f77d84d0da57e40ebf7ef93

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

34:8a:4d:46:c9:a1:a9:ed:c2:b4:81:84:65:a6:6b:edCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

65:ef:77:ea:7b:29:2f:15:20:df:e4:b4:6a:06:cd:d2:29:eb:37:cdSigner

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 164KB - Virtual size: 164KB

.bss Size: - Virtual size: 208B

.edata Size: 3KB - Virtual size: 2KB

.idata Size: 1024B - Virtual size: 692B

.reloc Size: 1024B - Virtual size: 852B

.stab Size: 44KB - Virtual size: 43KB

.stabstr Size: 22KB - Virtual size: 21KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

34:8a:4d:46:c9:a1:a9:ed:c2:b4:81:84:65:a6:6b:ed
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

65:ef:77:ea:7b:29:2f:15:20:df:e4:b4:6a:06:cd:d2:29:eb:37:cd
Signer

.text
Size: 16KB - Virtual size: 15KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 164KB - Virtual size: 164KB

.bss
Size: - Virtual size: 208B

.edata
Size: 3KB - Virtual size: 2KB

.idata
Size: 1024B - Virtual size: 692B

.reloc
Size: 1024B - Virtual size: 852B

.stab
Size: 44KB - Virtual size: 43KB

.stabstr
Size: 22KB - Virtual size: 21KB