2559e4efbf419b8ab7d3e85eb03f7fe4

Sharing

Copy URL

Twitter E-mail

General

Target

2559e4efbf419b8ab7d3e85eb03f7fe4
Size

312KB
MD5

2559e4efbf419b8ab7d3e85eb03f7fe4
SHA1

dd33c0a4b45e4ec7a1e1e643907579277f625bb0
SHA256

131b7af629b766c38b1230c599b2163eed9d4a1fe9d10363c45c040ed1c6d38e
SHA512

bb4ceb5225188dbb1be1a9251febd0daaab172c74b2e9f0e9890d8d1307395ab822d73e7fb09e1acb3d41cbefccafd647f20e1acfc6e362cc6fab7db0c9bc905
SSDEEP

6144:hVhQfohpx6F4Ycb20NbdjMSkwb2if1L5kz91xSxCFYd:xhpxmWbdjMNwbn9y6sY

Score

1^/10

Malware Config

Signatures

Files

2559e4efbf419b8ab7d3e85eb03f7fe4
.exe windows:4 windows x86 arch:x86

f5f9570ca171982439b8b332f740d193

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

e6:f2:2d:85:3e:2e:9e:18:20:b0:f4:2b:2e:3a:b9:a6
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

24-06-2009 00:00

Not After

23-06-2012 23:59

Subject

CN=Zhejiang HaoYing Network Co.\,Ltd,OU=WoSign Class 3 Code Signing,O=Zhejiang HaoYing Network Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

d8:01:73:5b:d2:42:61:cb:9b:fb:67:fc:e7:33:eb:25:fe:66:3b:cc
Signer

Actual PE Digest

d8:01:73:5b:d2:42:61:cb:9b:fb:67:fc:e7:33:eb:25:fe:66:3b:cc

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc71

ord757
ord578
ord605
ord2020
ord5975
ord1054
ord3830
ord3641
ord1084
ord5182
ord4212
ord4735
ord4890
ord4580
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord5203
ord3403
ord4722
ord4282
ord1600
ord5960
ord5235
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord566
ord1964
ord1656
ord1655
ord1599
ord5200
ord2862
ord4486
ord4262
ord3182
ord354
ord297
ord3997
ord2272
ord1489
ord876
ord2902
ord299
ord2933
ord6118
ord1482
ord1903
ord762
ord1063
ord3883
ord5868
ord1794
ord4749
ord709
ord501
ord2322
ord304
ord781
ord310
ord6168
ord2884
ord631
ord4085
ord5563
ord2748
ord2751
ord2288
ord2280
ord386
ord784
ord2878
ord1123
ord6067
ord2657
ord3680
ord3587
ord1654
ord1598
ord5915
ord1402
ord5214
ord754
ord572
ord3991
ord3799
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord2248
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord764
ord3683
ord5175
ord4541
ord1207

msvcr71

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
__p__fmode
_c_exit
__security_error_handler
_onexit
__dllonexit
??1type_info@@UAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_setmbcp
__set_app_type
?terminate@@YAXXZ
_controlfp
_exit
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_except_handler3
free
memset
strrchr

kernel32

ExitProcess
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringA

user32

GetSystemMetrics
LoadIconA
EnableWindow
KillTimer
SetTimer
GetClientRect
IsIconic
SendMessageA
DrawIcon

advapi32

RegQueryValueExA
RegEnumKeyExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey

shell32

SHChangeNotify

comctl32

ord17

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

F�
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f5f9570ca171982439b8b332f740d193

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

e6:f2:2d:85:3e:2e:9e:18:20:b0:f4:2b:2e:3a:b9:a6Certificate

Extended Key Usages

Key Usages

d8:01:73:5b:d2:42:61:cb:9b:fb:67:fc:e7:33:eb:25:fe:66:3b:ccSigner

Headers

File Characteristics

Imports

mfc71

msvcr71

kernel32

user32

advapi32

shell32

comctl32

msvcp71

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 468B

.rsrc Size: 24KB - Virtual size: 20KB

F� Size: 244KB - Virtual size: 244KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

e6:f2:2d:85:3e:2e:9e:18:20:b0:f4:2b:2e:3a:b9:a6
Certificate

d8:01:73:5b:d2:42:61:cb:9b:fb:67:fc:e7:33:eb:25:fe:66:3b:cc
Signer

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 468B

.rsrc
Size: 24KB - Virtual size: 20KB

F�
Size: 244KB - Virtual size: 244KB