General

Malware Config

Signatures

Files

• tmp

  .exe windows:5 windows x86 arch:x86

  25dfce4b46aa9e00ed2ac3581e0f0edb

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  7c:44:3d:7d:bb:05:4e:45:9c:51:3d:66:5d:fa:8d:b7

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  11-10-2018 00:00

  Not After

  02-02-2020 23:59

  Subject

  CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5d:2d:8c:bf:49:c9:09:4c:7e:a9:9e:6a:68:36:5e:32

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  11-10-2018 00:00

  Not After

  02-02-2020 23:59

  Subject

  CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  d0:51:4a:99:1d:f3:37:18:55:9b:54:6a:57:7a:1d:70:1b:c8:69:ff:ba:25:f9:77:f5:3d:de:b7:e0:a8:a1:5d

  Signer

  Actual PE Digest

  d0:51:4a:99:1d:f3:37:18:55:9b:54:6a:57:7a:1d:70:1b:c8:69:ff:ba:25:f9:77:f5:3d:de:b7:e0:a8:a1:5d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  70:77:ca:d6:a3:e6:8b:39:65:eb:c9:8e:13:8f:e4:c8:2f:94:78:a3

  Signer

  Actual PE Digest

  70:77:ca:d6:a3:e6:8b:39:65:eb:c9:8e:13:8f:e4:c8:2f:94:78:a3

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  qbcore

  cef_stream_writer_create_for_handler

  cef_drag_data_create

  cef_stream_reader_create_for_file

  cef_browser_host_create_browser

  cef_v8value_create_string

  cef_v8value_create_object

  cef_v8value_create_function

  cef_task_runner_get_for_thread

  cef_string_list_size

  cef_string_list_value

  cef_string_list_append

  cef_string_map_size

  cef_string_map_key

  cef_string_map_value

  cef_string_map_append

  cef_string_multimap_size

  cef_string_multimap_key

  cef_string_multimap_value

  cef_string_multimap_append

  cef_string_multimap_alloc

  cef_string_multimap_free

  cef_string_list_copy

  cef_get_extensions_for_mime_type

  cef_clear_cache

  cef_quit_message_loop

  cef_run_message_loop

  cef_shutdown

  cef_initialize

  cef_execute_process

  cef_post_delayed_task

  cef_post_task

  cef_currently_on

  cef_cookie_manager_get_global_manager

  cef_process_message_create

  cef_command_line_get_global

  cef_command_line_create

  cef_string_map_free

  cef_string_map_alloc

  cef_string_list_free

  cef_string_list_alloc

  cef_string_userfree_utf16_free

  cef_api_hash

  cef_log

  cef_string_ascii_to_utf16

  cef_string_wide_to_utf8

  cef_string_utf16_cmp

  cef_string_utf16_to_utf8

  cef_string_utf8_clear

  cef_string_utf8_to_utf16

  cef_string_utf16_clear

  cef_string_utf16_set

  opengl32

  glPopAttrib

  glPopMatrix

  glPushAttrib

  glPushMatrix

  glRotatef

  glTexEnvf

  glTexImage2D

  glPixelStorei

  glTexSubImage2D

  glVertex2f

  glVertex2i

  glViewport

  glLoadIdentity

  glLineWidth

  glInterleavedArrays

  glOrtho

  glTexParameteri

  glHint

  glGenTextures

  glEnd

  glEnable

  glDrawArrays

  glDisable

  glDeleteTextures

  glColor4f

  glColor3f

  glClearColor

  glClear

  glBlendFunc

  glBindTexture

  glBegin

  wglMakeCurrent

  wglDeleteContext

  wglCreateContext

  glMatrixMode

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  kernel32

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  VirtualProtect

  VirtualFree

  InterlockedCompareExchange

  VirtualAlloc

  FlushInstructionCache

  SetThreadContext

  VirtualQuery

  ResetEvent

  WaitForSingleObjectEx

  UnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetStartupInfoW

  QueryPerformanceCounter

  InitializeSListHead

  OutputDebugStringW

  RtlUnwind

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetACP

  GetFileType

  RtlCaptureContext

  GetProcAddress

  OpenProcess

  GetCurrentProcess

  GetCurrentProcessId

  SetUnhandledExceptionFilter

  GetCurrentThreadId

  GetThreadContext

  ResumeThread

  IsDebuggerPresent

  WaitForMultipleObjects

  CloseHandle

  DuplicateHandle

  CreateEventW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  CreateProcessW

  SearchPathW

  LocalFree

  DecodePointer

  LockResource

  FreeLibrary

  GlobalFree

  HeapDestroy

  TlsGetValue

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  TerminateProcess

  RaiseException

  CreateThread

  GetLastError

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  Sleep

  LoadResource

  SizeofResource

  LoadLibraryW

  LoadLibraryExA

  GetModuleFileNameA

  FindResourceW

  FindResourceExW

  MultiByteToWideChar

  WideCharToMultiByte

  InterlockedIncrement

  InterlockedDecrement

  SetEvent

  WaitForSingleObject

  GetCommandLineW

  GetTempPathA

  GetFileAttributesW

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  lstrcpynW

  lstrcatW

  lstrlenW

  GlobalAlloc

  GlobalSize

  GlobalLock

  GlobalUnlock

  SetEnvironmentVariableW

  GetPrivateProfileStringW

  GetWindowsDirectoryW

  GetFileAttributesA

  GetTickCount

  GetPrivateProfileIntW

  SetLastError

  SetErrorMode

  EnterCriticalSection

  LeaveCriticalSection

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  TlsAlloc

  EncodePointer

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  FlushFileBuffers

  WriteConsoleW

  HeapAlloc

  CreateFileW

  user32

  DestroyWindow

  IsWindowVisible

  SetFocus

  GetKeyState

  GetCapture

  SetCapture

  ReleaseCapture

  GetSystemMetrics

  CreateWindowExW

  GetDC

  ReleaseDC

  BeginPaint

  EndPaint

  DispatchMessageW

  TranslateMessage

  GetMessageW

  IsChild

  RegisterClassExW

  GetDoubleClickTime

  DefWindowProcW

  GetMessageTime

  TrackMouseEvent

  SetParent

  SetWindowLongW

  GetWindowLongW

  SetPropA

  SetWindowPos

  IsWindow

  PostMessageA

  RegisterWindowMessageW

  PostMessageW

  RegisterClipboardFormatW

  GetAncestor

  LoadIconW

  LoadCursorW

  GetWindowThreadProcessId

  GetParent

  SetClassLongW

  PtInRect

  UnionRect

  WindowFromPoint

  ScreenToClient

  ClientToScreen

  GetCursorPos

  SetCursor

  GetWindowRect

  GetClientRect

  GetPropA

  SetPropW

  gdi32

  GetDeviceCaps

  SwapBuffers

  ChoosePixelFormat

  SetPixelFormat

  comdlg32

  GetOpenFileNameW

  advapi32

  RegOpenKeyW

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  shell32

  DragFinish

  DragQueryFileW

  CommandLineToArgvW

  SHGetFolderPathW

  ShellExecuteW

  ole32

  OleUninitialize

  OleInitialize

  ReleaseStgMedium

  CoTaskMemFree

  CoTaskMemAlloc

  RevokeDragDrop

  RegisterDragDrop

  DoDragDrop

  oleaut32

  SysAllocString

  shlwapi

  PathRemoveFileSpecA

  PathFileExistsW

  PathAppendA

  PathRemoveFileSpecW

  PathAppendW

  ws2_32

  htons

  closesocket

  bind

  WSACleanup

  WSAStartup

  socket

  winhttp

  WinHttpGetIEProxyConfigForCurrentUser

  Sections

  .text

  Size: 355KB - Virtual size: 354KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 170KB - Virtual size: 170KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .shared_

  Size: 512B - Virtual size: 1B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 404B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 49KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ