432e1f6f0743351923ce0844f70ff732

Sharing

Copy URL Twitter E-mail

General

Target

432e1f6f0743351923ce0844f70ff732
Size

2.3MB
MD5

432e1f6f0743351923ce0844f70ff732
SHA1

712dd3e2665aa7d774f71a3f245dbe4a951c87b6
SHA256

05462de9a2359851380552aa918b0d0b024b6512d9d1673586f1791a262547fe
SHA512

068639535b4ef503203a0128e9cc8382231e587c66758aeb627c1d7cedc8841207cebdce304803bdb2174919d50f8aac087827d77a08b5582aae04a13efc3f54
SSDEEP

49152:XT4FNM8N8iH+uuGEWxZ1M8N8EM8N8dlJaphU3j:XT4FNM89eRG3xZ1M8nM8ClspOz

Score

1^/10

Malware Config

Signatures

Files

432e1f6f0743351923ce0844f70ff732
.exe windows:4 windows x86 arch:x86

c8b1f6a1458e3fb6470f38c01916359e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:88:a3:54:ac:f8:6e:3c:a5:dc:f3:3b:08:26:06:15
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/06/2014, 00:00

Not After

25/06/2016, 23:59

Subject

CN=郑州易灵信软件有限公司,O=郑州易灵信软件有限公司,L=郑州市,ST=河南省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:3e:13:07:94:da:0e:f6:d5:c0:0d:42:32:2b:0b:fc:e1:61:b2:a5
Signer

Actual PE Digest

13:3e:13:07:94:da:0e:f6:d5:c0:0d:42:32:2b:0b:fc:e1:61:b2:a5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord5477
ord2023
ord4329
ord4857
ord5792
ord5474
ord1963
ord966
ord3565
ord605
ord278
ord610
ord2069
ord860
ord2606
ord913
ord6278
ord4197
ord4272
ord2755
ord1631
ord2021
ord665
ord1971
ord6381
ord5180
ord354
ord5624
ord1940
ord2388
ord3341
ord5296
ord5299
ord4074
ord4693
ord5303
ord5285
ord5711
ord4616
ord700
ord817
ord394
ord398
ord565
ord696
ord1244
ord2718
ord4221
ord1172
ord3434
ord5590
ord6217
ord909
ord5586
ord3430
ord2810
ord942
ord5679
ord2116
ord3737
ord3566
ord1263
ord1229
ord1165
ord3621
ord3658
ord2406
ord4270
ord6193
ord6374
ord4294
ord5781
ord640
ord1633
ord323
ord1634
ord1143
ord755
ord2854
ord470
ord3614
ord5871
ord2371
ord6211
ord5806
ord5568
ord2910
ord4029
ord539
ord922
ord925
ord927
ord4184
ord6135
ord287
ord5598
ord4667
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord5298
ord2717
ord4692
ord5710
ord3733
ord561
ord815
ord641
ord772
ord773
ord2506
ord5208
ord2613
ord1131
ord5214
ord617
ord296
ord559
ord812
ord5261
ord4992
ord6048
ord1767
ord5276
ord4419
ord3592
ord501
ord500
ord324
ord2294
ord4229
ord4704
ord4847
ord4282
ord1106
ord6195
ord1083
ord5858
ord2859
ord6330
ord6140
ord2768
ord3332
ord3806
ord2127
ord5286
ord1941
ord818
ord567
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3397
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1768
ord4073
ord6051
ord2756
ord4124
ord6655
ord4273
ord535
ord538
ord825
ord861
ord858
ord823
ord5856
ord940
ord540
ord2144
ord800
ord1569

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
wcschr
wcsstr
wcsncpy
fflush
fseek
ftell
fread
wcstol
__CxxFrameHandler
wcscpy
_wtol
_wtoi
wcscmp
wcslen
swprintf
_wcsicmp
sprintf
fclose
fwrite
_wfopen
memmove

kernel32

CloseHandle
GetModuleFileNameW
MultiByteToWideChar
GetACP
FormatMessageW
GetLastError
Sleep
CreateSemaphoreW
CreateDirectoryW
SetProcessShutdownParameters
SetThreadPriority
SetPriorityClass
GetCurrentProcess
WriteFile
CreateFileW
GetExitCodeThread
WaitForSingleObject
GetVersionExW
LockResource
LoadResource
SizeofResource
FindResourceW
GetSystemDirectoryW
GetModuleHandleW
GetStartupInfoW
ResumeThread
CreateProcessW
GetFileAttributesW
WideCharToMultiByte
lstrlenW
DeleteFileW
GetEnvironmentVariableW
GetCurrentThread
LocalFree

user32

OffsetRect
PtInRect
ScreenToClient
GetCursorPos
LoadImageW
CopyRect
GetSystemMetrics
LoadIconW
KillTimer
DrawIcon
IsIconic
FindWindowW
GetClientRect
PostThreadMessageW
EnableWindow
GetDC
PostQuitMessage
SystemParametersInfoW
GetWindowRect
GetClassInfoW
DefWindowProcW
LoadCursorW
PostMessageW
SetTimer
SendMessageW

gdi32

SelectObject
CreateCompatibleDC
GetObjectW
StretchBlt
CreateFontIndirectW

advapi32

SetEntriesInAclW
SetNamedSecurityInfoW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

shell32

ShellExecuteW
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHGetMalloc

ole32

CoInitialize
CoUninitialize
CoCreateInstance

wsock32

shutdown
WSAGetLastError

gdiplus

GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8b1f6a1458e3fb6470f38c01916359e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

29:88:a3:54:ac:f8:6e:3c:a5:dc:f3:3b:08:26:06:15Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

13:3e:13:07:94:da:0e:f6:d5:c0:0d:42:32:2b:0b:fc:e1:61:b2:a5Signer

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

gdiplus

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 24KB - Virtual size: 23KB

.rsrc Size: 2.2MB - Virtual size: 2.2MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

29:88:a3:54:ac:f8:6e:3c:a5:dc:f3:3b:08:26:06:15
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

13:3e:13:07:94:da:0e:f6:d5:c0:0d:42:32:2b:0b:fc:e1:61:b2:a5
Signer

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 24KB - Virtual size: 23KB

.rsrc
Size: 2.2MB - Virtual size: 2.2MB