29c968f892901d40e185a4ad68ed9586

Sharing

Copy URL Twitter E-mail

General

Target

29c968f892901d40e185a4ad68ed9586
Size

1.5MB
MD5

29c968f892901d40e185a4ad68ed9586
SHA1

77ae985f37c558b8fd8f84fb506a702eaae0020f
SHA256

e01c449fe145914d438c842fe3a627144e75aaa86f560625cc9a5bb392eff0b1
SHA512

601caee565d3b3fc84b3180d487d42eb58f2f06de9fddb25a8da715ebb52e84c715bc3b3a21b9618734b3df71457547613154be6ffce2ec377f95bb660db23c4
SSDEEP

24576:PbWtd9eIDUuOB0TvpmK6qbZF03cbBnG0CI1dfD0DsKHNC/d1KnIHNZme57y:YeYDbpmKNX/f78DNQ11KIHNZD5m

Score

1^/10

Malware Config

Signatures

Files

29c968f892901d40e185a4ad68ed9586
.exe windows:4 windows x86 arch:x86

92b0ae2a3e224a74afd1fc95c7f6d960

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/07/2008, 08:07

Not After

11/07/2010, 08:07

Subject

CN=福建网龙计算机网络信息技术有限公司,OU=Technical Dept.,O=福建网龙计算机网络信息技术有限公司,L=Fu Zhou,ST=Fu Jian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a1:a1:02:06:dd:7e:f2:74:f7:5c:ee:81:4a:af:d4:19:3c:56:89:08
Signer

Actual PE Digest

a1:a1:02:06:dd:7e:f2:74:f7:5c:ee:81:4a:af:d4:19:3c:56:89:08

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAStartup
inet_ntoa
WSACleanup
inet_addr
gethostbyname
gethostname
recv
send
socket
WSAGetLastError
setsockopt
ioctlsocket
htons
connect
select
__WSAFDIsSet
closesocket

graphic

?Init3DEx@CMyBitmap@@SAHPAUHWND__@@KKHK@Z
?GameFontCreate@CMyBitmap@@SAHXZ
TargetBmpCreate
?GetScreenSize@CMyBitmap@@SAXAAH0@Z
?ScreenShot@CMyBitmap@@SAXPBD@Z
?HintGraphicDetail@CMyBitmap@@SAHK@Z
?End3D@CMyBitmap@@SAHXZ
?Flip@CMyBitmap@@SAHPBUtagRECT@@0PAUHWND__@@@Z
?IfDeviceLost@CMyBitmap@@SAHXZ
?ResetDevice@CMyBitmap@@SAHXZ
?Begin3D@CMyBitmap@@SAHXZ
?GetFontSize@CMyBitmap@@SAKXZ
?ShowString@CMyBitmap@@SAXHHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetStrShowLen@CMyBitmap@@SAHPBDHH@Z
?ShowEmotionString@CMyBitmap@@SAXHHKPBDPAVIDataIcon@@0HHHHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?ShowEmotionStringEx@CMyBitmap@@SA?AUCMySize@@HHKPBDPAVIDataIcon@@0HHHHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?CheckStringPixels@CMyBitmap@@SA_NPBDK0H@Z
?CalcuTextExtent@CMyBitmap@@SA?AUCMySize@@PBD0HPAVIDataIcon@@H@Z
?ShowBlock@CMyBitmap@@SAXHHHHK@Z
PuzzelTriangleCreate
PuzzelBlockCreate
?PrepareLine@CMyBitmap@@SAXXZ
?GetFontWidth@CMyBitmap@@SAKPBDH@Z
?GameCameraBuild@CMyBitmap@@SAXUCMySize@@@Z
?ClearBuffer@CMyBitmap@@SAHHHK@Z
?GetScreenHeight@CMyBitmap@@SAHXZ
?ShowStringEx@CMyBitmap@@SA?AUCMySize@@HHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetScreenWidth@CMyBitmap@@SAHXZ
?ShowRect@CMyBitmap@@SAXHHHHK@Z
?PrepareSprite@CMyBitmap@@SAXXZ
?ShowBlock@CMyBitmap@@SAXUCMyPos@@000K@Z
MultiBmpCreate
?ShowLine@CMyBitmap@@SAXHHHHK@Z
?GameCameraSet@CMyBitmap@@SAXMMMK@Z
?GameCameraDestroy@CMyBitmap@@SAXXZ

graphicdata

GameDataSetQuery
GameDataSetDestroy

ndsound

_DXSoundinit@4
_DXPlaySound@24
_DXSetMusicVolume@4
_DXProcessSound@8
_DXPlayMedia@8
_DXCloseMedia@4
_DXSetVolume@16
_DXCloseSound@12
_DXClose2DSound@4
_DXSet2DSoundPos@12
_DXDestroy@0
_DXCloseAllMedia@0
_DXCloseAllSound@0
_DXSetSoundVolume@4

role3d

Game3DEffectCreate
Simple3DObjCreate

dinput8

DirectInput8Create

gamedata

RoleDataQuery
RoleDataDestroy

roleview

RoleViewCreate

mfc42

ord656
ord616
ord3663
ord3626
ord2414
ord692
ord683
ord800
ord4275
ord6442
ord1233
ord5981
ord6215
ord2086
ord2379
ord823
ord3873
ord6880
ord4123
ord2642
ord2078
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord3610
ord3402
ord3721
ord795
ord540
ord324
ord2302
ord4234
ord2645
ord3874
ord6199
ord4710
ord5875
ord609
ord3803
ord537
ord2864
ord4299
ord3706
ord1641
ord2614
ord858
ord922
ord860
ord2818
ord3876
ord941
ord6778
ord2575
ord4396
ord3574
ord6453
ord2135
ord1572
ord3631
ord3226
ord1200
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord6779
ord4476
ord2688
ord4224
ord4284
ord6877
ord665
ord2860
ord1979
ord5442
ord5186
ord354
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord3571
ord2915
ord2099
ord6605
ord3089
ord4538
ord5148
ord3698
ord765
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1134
ord2725
ord1768
ord2859
ord755
ord470
ord2393
ord690
ord5207
ord389
ord1949
ord4034
ord535
ord641
ord825
ord567
ord1168
ord1146
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3092
ord1576

msvcrt

wcsncat
wcscat
wcslen
_mkdir
_strrev
_strdup
_rotl
_rotr
gmtime
??8type_info@@QBEHABV0@@Z
mktime
atol
ctime
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_splitpath
sqrt
fread
fwrite
exit
fopen
fscanf
fgets
fclose
fprintf
isdigit
vsprintf
floor
time
localtime
srand
strstr
_i64toa
abs
_findfirst
_findnext
_findclose
_strset
strrchr
pow
_atoi64
memset
strchr
strcpy
strcat
atoi
_ftol
sprintf
_snprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memcmp
_CxxThrowException
memmove
memcpy
strcmp
strlen
strncpy
sscanf
_purecall
__CxxFrameHandler
_strupr
_filelength
_fileno
realloc
_pctype
__mb_cur_max
_isctype
abort
wcsstr
_vsnprintf
_strlwr
_stricmp
_itoa
sin
atan2
feof
free
malloc
fseek
fabs
rand
_mbscmp
vfprintf
_iob
memchr
fflush
_setmode
ftell
qsort
_setmbcp
atan

kernel32

GetStdHandle
GetCurrentProcessId
GlobalMemoryStatus
GetStartupInfoA
GetFileType
InterlockedIncrement
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
FindFirstFileA
QueryPerformanceCounter
GetVersionExA
GetVersion
InterlockedDecrement
GetLastError
FindNextFileA
FindClose
InterlockedExchange
WritePrivateProfileStringA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileIntA
GetTickCount
GetFileAttributesA
WritePrivateProfileSectionA
WritePrivateProfileStructA
DeleteFileA
IsDBCSLeadByte
LockResource
LoadResource
SizeofResource
FindResourceA
CloseHandle
lstrcpynA
GetProcAddress
GetModuleHandleA
WriteProcessMemory
ReadProcessMemory
LoadLibraryA
FreeLibrary
_lclose
_lopen
IsDebuggerPresent
CreateDirectoryA
GetCurrentThreadId
WinExec
CopyFileA
SetCurrentDirectoryA
GetSystemDirectoryA
CreateMutexA
OpenMutexA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapValidate
IsBadCodePtr
MultiByteToWideChar
WideCharToMultiByte
Sleep

user32

CallNextHookEx
SetWindowsHookExA
IsWindow
ChangeDisplaySettingsA
InflateRect
GetClassNameA
GetWindowTextA
EnumWindows
RedrawWindow
GetActiveWindow
UnionRect
ReleaseCapture
SetCapture
SetWindowRgn
GetParent
IsIconic
DestroyCursor
GetCursorPos
ScreenToClient
PtInRect
SetCursor
GetForegroundWindow
GetSystemMetrics
GetClientRect
CallWindowProcA
SetWindowPos
SetWindowLongA
GetWindowRect
SetRect
PostMessageA
ClientToScreen
OffsetRect
EnableWindow
LoadCursorFromFileA
MessageBoxA
GetKeyState
keybd_event
DrawIcon
EnumDisplaySettingsA
PostQuitMessage
BeginPaint
LoadIconA
LoadCursorA
SendMessageA
GetDC
WindowFromPoint
MapDialogRect
GetKeyboardState
IsWindowVisible
SetCursorPos
mouse_event
KillTimer
SetTimer
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
GetFocus
EndPaint
LoadImageA

gdi32

CreateSolidBrush
CreatePolygonRgn
CreateFontA
GetTextMetricsA
PtInRegion
ExtCreateRegion
DeleteObject
CreateRectRgnIndirect
CombineRgn
CreateRectRgn
CreatePatternBrush

shell32

ShellExecuteA

oleaut32

VariantClear

msvcp60

??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

winmm

timeGetTime

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92b0ae2a3e224a74afd1fc95c7f6d960

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

a1:a1:02:06:dd:7e:f2:74:f7:5c:ee:81:4a:af:d4:19:3c:56:89:08Signer

Headers

File Characteristics

Imports

ws2_32

graphic

graphicdata

ndsound

role3d

dinput8

gamedata

roleview

mfc42

msvcrt

kernel32

user32

gdi32

shell32

oleaut32

msvcp60

winmm

advapi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 216KB - Virtual size: 215KB

.data Size: 64KB - Virtual size: 101KB

.rsrc Size: 100KB - Virtual size: 99KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

a1:a1:02:06:dd:7e:f2:74:f7:5c:ee:81:4a:af:d4:19:3c:56:89:08
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 216KB - Virtual size: 215KB

.data
Size: 64KB - Virtual size: 101KB

.rsrc
Size: 100KB - Virtual size: 99KB