0cfe9344c4ef1bcf8fc296ceaef61973

Sharing

Copy URL

Twitter E-mail

General

Target

0cfe9344c4ef1bcf8fc296ceaef61973
Size

11.3MB
MD5

0cfe9344c4ef1bcf8fc296ceaef61973
SHA1

2b4e25a246c95b6ac5759183b816902993dd998a
SHA256

d918ed591b97693b9946de6df95b069c1a01383947c654c057c131cbbcccce3d
SHA512

1e7a07b8cf3fe0eb63170c8053152cc4e883533df97f5a079d3f6fd784ce4f0e287fde41389a3f40c8401a5d04e6e66f3a3bc4b4ec505624cce1d4bb34dbed10
SSDEEP

196608:szanEd3826z6ncrkk0JJR8bY2tEyQYi1llA/Q5YjdTKUxFW1/ycus5lWUh+hvRuV:YaERBk0XR8s2tEyQYi1l218gFsycv1c4

Score

1^/10

Malware Config

Signatures

Files

0cfe9344c4ef1bcf8fc296ceaef61973
.rar
baodou_installer_1.2.0.0.exe
.exe windows:4 windows x86 arch:x86

12e1996a43c5c380929b3664490b58a8

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

4c:8c:57:a1:22:d8:ea:fc:f8:a0:58:00:69:55:d2:66
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

14/12/2007, 00:00

Not After

13/12/2008, 23:59

Subject

CN=北京卓锦锐泽科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京卓锦锐泽科技有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

5e:8f:af:46:f8:31:d9:bf:31:f4:39:57:9b:45:b4:48:90:7d:6e:79
Signer

Actual PE Digest

5e:8f:af:46:f8:31:d9:bf:31:f4:39:57:9b:45:b4:48:90:7d:6e:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
RtlUnwind
ExitProcess
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetCurrentProcessId
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetTimeZoneInformation
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CreateFileA
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTickCount
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
GlobalFlags
InterlockedIncrement
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
RaiseException
GlobalFindAtomW
lstrlenA
GetModuleHandleA
LoadLibraryA
lstrcatW
GetVersionExA
InterlockedDecrement
GetLastError
SetLastError
MulDiv
FormatMessageW
lstrcpynW
LocalFree
GlobalUnlock
GlobalFree
FreeResource
GlobalAddAtomW
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalAlloc
GlobalDeleteAtom
GetModuleHandleW
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrcpyW
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
lstrcmpiW
GetFullPathNameW
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetModuleFileNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
CreateDirectoryW
GetSystemDirectoryW
Sleep
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CopyFileW
lstrlenW
WaitForSingleObject
DeleteFileW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetFileSize
GetFileAttributesW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
ReadFile
SetFilePointer
WriteFile
QueryPerformanceCounter
CloseHandle

user32

DestroyMenu
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
GetSysColorBrush
LoadCursorW
SetCapture
CharUpperW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ShowWindow
MoveWindow
SetWindowTextW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoW
RegisterClassW
UnregisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindow
SetWindowContextHelpId
MapDialogRect
wsprintfW
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
PostThreadMessageW
RegisterClipboardFormatW
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
MessageBoxW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
PeekMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
SetWindowPos
ReleaseCapture
GetSystemMetrics
EnableWindow
LoadIconW
KillTimer
SetTimer
GetClientRect
GetWindowRect
IsIconic
PostMessageW
SendMessageW
DrawIcon

gdi32

Escape
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
CreateRectRgnIndirect
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateSolidBrush
SetMapMode
RestoreDC
SaveDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateBitmap
CreateFontW
SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyExW
RegQueryValueW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW

comctl32

ord17

shlwapi

PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateInstance
CoRegisterMessageFilter
OleFlushClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleIsCurrentClipboard
CoRevokeClassObject

oleaut32

VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString

netapi32

Netbios

wininet

InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetSetOptionW
InternetCloseHandle

Sections

.text
Size: 220KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12.3MB - Virtual size: 12.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

12e1996a43c5c380929b3664490b58a8

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

4c:8c:57:a1:22:d8:ea:fc:f8:a0:58:00:69:55:d2:66Certificate

Extended Key Usages

Key Usages

5e:8f:af:46:f8:31:d9:bf:31:f4:39:57:9b:45:b4:48:90:7d:6e:79Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

netapi32

wininet

Sections

.text Size: 220KB - Virtual size: 217KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 12.3MB - Virtual size: 12.3MB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

4c:8c:57:a1:22:d8:ea:fc:f8:a0:58:00:69:55:d2:66
Certificate

5e:8f:af:46:f8:31:d9:bf:31:f4:39:57:9b:45:b4:48:90:7d:6e:79
Signer

.text
Size: 220KB - Virtual size: 217KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 12.3MB - Virtual size: 12.3MB