71edcf4487c5382d2724a1223abc8248

Sharing

Copy URL Twitter E-mail

General

Target

71edcf4487c5382d2724a1223abc8248
Size

38KB
MD5

71edcf4487c5382d2724a1223abc8248
SHA1

b967af7e82a9eba105dee34a30dd58de1c738e2e
SHA256

e18f281c8254fbede7335d83b0adda1d5e96401a14af189f007f7436b7cd4372
SHA512

617f700cb4d57a5d0714b0b4d63353cdca6dc4949d062ca8f9ad12a6f6cce96225eb1ec93d8a2a8551c89eb459c3217d6df576471a1e5ad8c1d6abfdcdf64e8d
SSDEEP

768:ugsKkRfsel82B7Y1LU0WoEIcFCh+mVQHzIpsq1kDz7XOgiDI1lpaQLWHbCDv:VsKifskB7Yy9othDIzNqQOgiDI1lpda6

Score

1^/10

Malware Config

Signatures

Files

71edcf4487c5382d2724a1223abc8248
.dll windows:4 windows x86 arch:x86

918bd412b5c4d08260936fe619f7c938

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:23:0b:4f:96:dd:4c:1e:c5:bc:83:03:60:f2:da:8b:81:1c:45:f2
Signer

Actual PE Digest

14:23:0b:4f:96:dd:4c:1e:c5:bc:83:03:60:f2:da:8b:81:1c:45:f2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc80

ord5230
ord4568
ord3948
ord2248
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord5213
ord1187
ord1191
ord5566
ord3830
ord372
ord6754
ord765
ord315
ord1084
ord1037
ord1092
ord1206
ord1208
ord1098
ord371
ord1917
ord1167
ord1120
ord1201
ord764
ord1175
ord1177
ord314
ord1209
ord581
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord566
ord3683
ord745
ord557
ord3934
ord4109
ord297
ord1486
ord300
ord781
ord785
ord5715
ord1185
ord6006
ord6118
ord6703
ord299
ord876
ord1489
ord310
ord2322
ord6174
ord6180
ord2902
ord2451
ord5491
ord2271
ord304
ord2272
ord578
ord757

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memset
__CxxFrameHandler3
strstr
malloc
free
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
wcscpy_s
calloc
_recalloc
_resetstkoflw
wcslen
??2@YAPAXI@Z
_unlock
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
?terminate@@YAXXZ

kernel32

UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
LocalAlloc
LocalFree
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiW
CompareStringW
CompareStringA
lstrlenW
MultiByteToWideChar
InterlockedExchange
GetFileAttributesExW
GetFileAttributesExA
SetUnhandledExceptionFilter
GetFileType
GetVersionExA
GetVersion
GetSystemInfo
GetCurrentProcessId
lstrcmpiA
VirtualProtect
GetCurrentProcess
WriteProcessMemory
GetLastError
VirtualQuery
GetProcAddress
GetModuleHandleA
Module32Next
Module32First
CreateToolhelp32Snapshot
CloseHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
QueryPerformanceCounter
WideCharToMultiByte
GetThreadLocale
GetACP
GetLocaleInfoA
GetTickCount

user32

CharUpperW
CharLowerA
CharLowerW
CharUpperA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

ole32

CoTaskMemFree
StringFromCLSID

oleaut32

SysFreeString

imagehlp

ImageDirectoryEntryToData

Exports

Exports

InstallHook
SetFileList
SetFlag
UninstallHook

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

918bd412b5c4d08260936fe619f7c938

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

14:23:0b:4f:96:dd:4c:1e:c5:bc:83:03:60:f2:da:8b:81:1c:45:f2Signer

Headers

DLL Characteristics

File Characteristics

Imports

mfc80

msvcr80

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

14:23:0b:4f:96:dd:4c:1e:c5:bc:83:03:60:f2:da:8b:81:1c:45:f2
Signer

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB