3e4592d6d87f061adef9f2884ef87714

Sharing

Copy URL

Twitter E-mail

General

Target

3e4592d6d87f061adef9f2884ef87714
Size

404KB
MD5

3e4592d6d87f061adef9f2884ef87714
SHA1

29d5e8e6dd3d0f5f335f265676b5eecadb9fe768
SHA256

2aaf5811084b14f169fc36449d9d7681c20b60cc66ac1e2d9236e6a0568e5461
SHA512

7ce65d8524a3e3021452437aec88deffa4adc10bd9f6c4cceb446704612ee5d21d5529a75f000718f8c1ed10f6ca8a021d926ac7a7e8105aa99fd6081f3e9e50
SSDEEP

12288:oWcYEjrh3HQG0vxut0tA9lQRcb7ENnMaBTy:tcVHQjut0tA90cb7ENnMaBTy

Score

1^/10

Malware Config

Signatures

Files

3e4592d6d87f061adef9f2884ef87714
.dll windows:5 windows x86 arch:x86

d77e0f3736ceba816b55892c3ace67ff

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:9b:9c:70:c9:f8:02:d8:9e:d5:c3:66:be:3b:13:78
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

12-10-2015 00:00

Not After

20-09-2016 23:59

Subject

CN=Kunming Shuangyinqing Science and Technology Co.\, Ltd.,O=Kunming Shuangyinqing Science and Technology Co.\, Ltd.,L=Kunming,ST=Yunnan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:a3:5e:ad:8f:bb:b2:a3:54:0f:85:b4:24:b5:b3:e2:96:f1:3c:d1
Signer

Actual PE Digest

f2:a3:5e:ad:8f:bb:b2:a3:54:0f:85:b4:24:b5:b3:e2:96:f1:3c:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
LoadLibraryA
TerminateProcess
GetCurrentProcess
FindResourceA
FindResourceExA
TlsSetValue
TlsGetValue
HeapFree
GetProcessHeap
HeapAlloc
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
LocalAlloc
LocalFree
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
SetUnhandledExceptionFilter
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
InterlockedExchange
GetPrivateProfileSectionNamesW
VirtualFree
GetPrivateProfileSectionW
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
RemoveDirectoryW
GetNativeSystemInfo
GetOverlappedResult
GetModuleHandleA
RaiseException
IsDebuggerPresent
GetQueuedCompletionStatus
WaitForSingleObjectEx
WaitForMultipleObjectsEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
DeleteCriticalSection
VirtualAlloc
TlsAlloc
GetThreadLocale
GetSystemDefaultLCID
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
ReadFile
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetVersionExW
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
InterlockedDecrement
InterlockedIncrement
DeviceIoControl
CreateFileW
MoveFileExW
ExitProcess
GetWindowsDirectoryW
CopyFileW
GetSystemDirectoryW
GetModuleFileNameW
OpenEventW
Sleep
GetLastError
OutputDebugStringW
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetModuleHandleW
GetProcAddress
WritePrivateProfileStringW
DeleteFileW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
SetLastError
SetFileAttributesW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesExW
MoveFileW
QueryDosDeviceW
ExpandEnvironmentStringsW
lstrcpyW
lstrlenW
SetErrorMode
GetProcessId
TerminateThread
ReleaseMutex
ExitThread
GetSystemInfo
VirtualProtect
CreateEventA
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
GetCommandLineA
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsFree
HeapCreate
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA

advapi32

RegOpenKeyW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
DeleteAce
GetAce
GetNamedSecurityInfoW
AdjustTokenPrivileges
LookupPrivilegeValueW
QueryServiceStatus
CreateServiceW
DeleteService
ControlService
ChangeServiceConfigW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
RegCloseKey
LookupAccountSidW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegEnumKeyW
RegOpenKeyExW
ChangeServiceConfig2W
QueryServiceStatusEx
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegCreateKeyW

ntdll

RtlUnwind
NtQueryDirectoryFile
NtSetInformationFile
NtQueryInformationFile
NtWriteFile
NtReadFile
NtOpenFile
NtCreateFile
NtEnumerateValueKey
NtEnumerateKey
NtSetValueKey
NtQueryValueKey
NtDeleteValueKey
NtDeleteKey
NtCreateKey
NtOpenKey
RtlEqualUnicodeString
RtlDetermineDosPathNameType_U
RtlCompareMemory
RtlIsDosDeviceName_U
NtWaitForSingleObject
RtlDosPathNameToNtPathName_U
RtlUnicodeStringToAnsiString
RtlAllocateHeap
RtlFreeHeap
RtlCreateUnicodeString
RtlDeleteCriticalSection
NtClose
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlOpenCurrentUser
RtlFreeUnicodeString
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlUpcaseUnicodeChar
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCharToInteger
RtlNtStatusToDosError

Exports

Exports

EZCloseHandle
EZExtractFile
EZOpenHandle
Is64System
LZMACloseHandle
LZMAEncodeFile
LZMAOpenHandle
ServiceMain

Sections

.text
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d77e0f3736ceba816b55892c3ace67ff

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

75:9b:9c:70:c9:f8:02:d8:9e:d5:c3:66:be:3b:13:78Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f2:a3:5e:ad:8f:bb:b2:a3:54:0f:85:b4:24:b5:b3:e2:96:f1:3c:d1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ntdll

Exports

Exports

Sections

.text Size: 315KB - Virtual size: 315KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 13KB - Virtual size: 30KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 19KB - Virtual size: 19KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

75:9b:9c:70:c9:f8:02:d8:9e:d5:c3:66:be:3b:13:78
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f2:a3:5e:ad:8f:bb:b2:a3:54:0f:85:b4:24:b5:b3:e2:96:f1:3c:d1
Signer

.text
Size: 315KB - Virtual size: 315KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 13KB - Virtual size: 30KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 19KB - Virtual size: 19KB