16946b1beeb43a237e068eaf189bebd2

Sharing

Copy URL

Twitter E-mail

General

Target

16946b1beeb43a237e068eaf189bebd2
Size

809KB
MD5

16946b1beeb43a237e068eaf189bebd2
SHA1

e22c0f83ceafbeaebe35207225d18b90fca20f0b
SHA256

bb7894fb21e3ca7021062b4d0f0c561c4462bdd7f079c247e15d551227435b61
SHA512

6e8bf8d1e7d67e9ba24fefc60d8f79b044c413e85df6f61fcab75118487d02b16042f9009de6cc4b26a1ae28229f7bf6d51ab7553f815c7ef80150d04350ced0
SSDEEP

24576:D8ozamYvCX6DeJHsk/vMK14rZzTWz16H3deMFK/W:Yogu6CJHstK141TuS34MFK/W

Score

1^/10

Malware Config

Signatures

Files

16946b1beeb43a237e068eaf189bebd2
.dll regsvr32 windows:4 windows x86 arch:x86

91b464bda9ab5b3a460e21bfc2812fc1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30-09-2015 00:00

Not After

28-09-2018 23:59

Subject

CN=Sogou.com,OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ef:e3:d9:fc:68:53:19:71:5b:2b:39:b2:05:a4:bc:6a:a0:e5:2b
Signer

Actual PE Digest

32:ef:e3:d9:fc:68:53:19:71:5b:2b:39:b2:05:a4:bc:6a:a0:e5:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAGetLastError
ioctlsocket
setsockopt
send
recv
__WSAFDIsSet
select
connect
inet_ntoa
inet_addr
htonl
gethostbyname
htons
WSACleanup
closesocket
WSAStartup
socket
ntohl
ntohs

kernel32

SystemTimeToFileTime
WideCharToMultiByte
lstrcpynW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetProcAddress
FreeLibrary
GetLastError
GetVersionExW
CreateProcessW
GetCurrentProcess
GetProcessTimes
OutputDebugStringW
OutputDebugStringA
GetModuleHandleW
WritePrivateProfileStringW
lstrcmpiW
InterlockedExchange
CreateMutexW
GetCurrentProcessId
RaiseException
GetCommandLineW
LocalFree
lstrcpyW
GlobalFree
GetTickCount
GlobalAlloc
CopyFileW
LeaveCriticalSection
TerminateThread
lstrcpyA
MoveFileExW
lstrcpynA
GetPrivateProfileIntW
EnterCriticalSection
InterlockedCompareExchange
SleepEx
CreateFileW
ReadFile
GetExitCodeProcess
GetFileSize
CreateThread
ExpandEnvironmentStringsW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ExitProcess
GlobalAddAtomW
WriteFile
FileTimeToSystemTime
DuplicateHandle
OpenEventW
lstrlenW
GetTempPathW
GetFullPathNameW
GetPrivateProfileStringW
SetEnvironmentVariableW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
InterlockedDecrement
ResumeThread
TlsAlloc
OpenMutexW
CreateNamedPipeW
OpenSemaphoreW
GetVersion
InitializeCriticalSection
DeleteCriticalSection
FreeResource
SetFilePointer
UnhandledExceptionFilter
lstrlenA
TerminateProcess
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
GetSystemTime
HeapFree
WaitForMultipleObjects
VirtualAlloc
GetSystemDefaultLangID
GetSystemInfo
VirtualQuery
SetFileTime
LocalFileTimeToFileTime
GetFileAttributesW
ResetEvent
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
GetModuleFileNameA
DeviceIoControl
GetStdHandle
SetLastError
GetPrivateProfileIntA
WTSGetActiveConsoleSessionId
FindClose
GetPrivateProfileStringA
GetModuleHandleA
LoadLibraryA
VirtualProtect
VirtualFree
FlushInstructionCache
GetThreadContext
SetThreadContext
GetACP
CreateDirectoryA
ExpandEnvironmentStringsA
SetEndOfFile
CreateFileA
CreateEventA
CompareStringA
CompareStringW
FindFirstFileA
DeleteFileA
CopyFileA
GetVersionExA
GetSystemDirectoryA
HeapSize
HeapReAlloc
HeapDestroy
GetLocaleInfoA
GetThreadLocale
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetCommandLineA
FileTimeToLocalFileTime
RtlUnwind
GetDriveTypeA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapCreate
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentDirectoryA
GetFullPathNameA
CreateDirectoryW
LoadLibraryW
GetModuleFileNameW
MultiByteToWideChar
FindResourceW
GetLocalTime
FindResourceExW
LoadResource
LockResource
SizeofResource
SetEvent
DeleteFileW
Sleep
WaitForSingleObject
CloseHandle
CreateEventW
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
SetEnvironmentVariableA
GetCurrentThreadId
GetUserDefaultLCID

user32

FindWindowA
IsIconic
wsprintfA
GetWindow
GetDesktopWindow
GetMessageW
SetPropW
GetPropW
UnregisterClassW
RegisterClassExW
DefWindowProcW
DestroyWindow
ShowWindow
CreateWindowExW
PostQuitMessage
RemovePropW
SendMessageW
IsWindow
SetWindowLongW
GetParent
IsWindowVisible
MessageBoxW
PostMessageW
EnumWindows
GetWindowThreadProcessId
GetClassNameW
CharUpperW
SendMessageTimeoutW
FindWindowW
UnregisterClassA
TranslateMessage
PeekMessageW
DispatchMessageW

advapi32

RegOpenKeyExA
IsValidSid
RegOpenKeyW
QueryServiceConfigW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA

shell32

SHGetSpecialFolderPathA
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderPathA

ole32

CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoLoadLibrary
CoCreateGuid
CoInitialize
CoUninitialize
CoFreeLibrary
CLSIDFromProgID

oleaut32

SysFreeString
SysAllocStringByteLen
SysAllocString

shlwapi

PathRemoveFileSpecW
PathFileExistsA
PathRemoveFileSpecA
PathAppendW
PathIsDirectoryW
PathFileExistsW
PathAddBackslashW
PathFindFileNameW
PathRemoveBackslashW

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetOpenW
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetGetConnectedState
InternetReadFile

netapi32

Netbios
NetWkstaTransportEnum
NetApiBufferFree

Exports

Exports

CancelDetector
DetectorHelp
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetDectectorResult
GetDectectorResultEx
InitDetector
InitDownloader
InitLoadLoadParam
InstHelpDW
InstHelpWStr
NsisGetDectectorResult
NsisGetDectectorResultA
NsisGetDectectorResultEx
NsisRunDetector
NsisRunDetectorA
NsisRunDetectorEx
NsisWaitDetectorComplete
NsisWaitDetectorCompleteA
NsisWaitDetectorCompleteEx
QQBrowserModuleEntry
QQBrowserProcessParamVersion
ReleaseDR
RunDetector
RunDetectorEx
RunDetectorWithNotification
SetDriverService
SetGroupId
UnInitDetector
WaitDetectorComplete
WaitDetectorCompleteEx

Sections

.text
Size: 480KB - Virtual size: 477KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91b464bda9ab5b3a460e21bfc2812fc1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ceCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

32:ef:e3:d9:fc:68:53:19:71:5b:2b:39:b2:05:a4:bc:6a:a0:e5:2bSigner

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

version

wininet

netapi32

Exports

Exports

Sections

.text Size: 480KB - Virtual size: 477KB

.rdata Size: 92KB - Virtual size: 90KB

.data Size: 16KB - Virtual size: 26KB

.rsrc Size: 172KB - Virtual size: 171KB

.reloc Size: 40KB - Virtual size: 37KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

32:ef:e3:d9:fc:68:53:19:71:5b:2b:39:b2:05:a4:bc:6a:a0:e5:2b
Signer

.text
Size: 480KB - Virtual size: 477KB

.rdata
Size: 92KB - Virtual size: 90KB

.data
Size: 16KB - Virtual size: 26KB

.rsrc
Size: 172KB - Virtual size: 171KB

.reloc
Size: 40KB - Virtual size: 37KB