c1f0b6a48906684074ffee5caf0cc70dc9018c2e95ea0edb6389688985a9ce15

Sharing

Copy URL Twitter E-mail

General

Target

c1f0b6a48906684074ffee5caf0cc70dc9018c2e95ea0edb6389688985a9ce15
Size

5.1MB
MD5

3be1aaf201e209a443395f30956e912c
SHA1

5d05d9b167080f560a699d9a3a4366b01c5e3ef9
SHA256

c1f0b6a48906684074ffee5caf0cc70dc9018c2e95ea0edb6389688985a9ce15
SHA512

99ad2a0b76ca2e98f1d1481ee0f56996569e09dd5aba5e9faf4a3553c2b9e192db50b141cb17e2ebc2098e5d27da7f3b58543c269b50f8b37a0426271d6f1b59
SSDEEP

98304:46jTAxf4wOceLDZ0S+cZv61tCKeYN6xea:F4xALDSCZQtCKjN6xea

Score

1^/10

Malware Config

Signatures

Files

c1f0b6a48906684074ffee5caf0cc70dc9018c2e95ea0edb6389688985a9ce15
.exe windows:5 windows x86 arch:x86

b0d536edebc7a6ac3e3ad282c6b5b240

Code Sign

01:fb:56:23:5e:01:96:6d:80:34:7a:ae:7a:2f:b8:44
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/05/2021, 00:00

Not After

23/08/2023, 23:59

Subject

SERIALNUMBER=91110105MA0198RL2R,CN=北京华网智讯信息有限公司,O=北京华网智讯信息有限公司,ST=北京市,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e69c9de998b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

96:4d:b7:b2:5a:06:40:f9:c3:f5:8f:65:79:f9:28:8a:8b:e9:e8:30:c2:19:80:43:65:ba:6e:6b:aa:cc:46:af
Signer

Actual PE Digest

96:4d:b7:b2:5a:06:40:f9:c3:f5:8f:65:79:f9:28:8a:8b:e9:e8:30:c2:19:80:43:65:ba:6e:6b:aa:cc:46:af

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
CreateProcessAsUserW
RegCloseKey
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
LookupAccountSidW
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
GetTokenInformation

ole32

CoCreateGuid
CoInitialize
OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
OleLockRunning
CLSIDFromProgID
CreateBindCtx
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromString

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetSpecialFolderLocation
ShellExecuteExW
SHChangeNotify
SHGetPathFromIDListW
ShellExecuteW

shlwapi

PathFileExistsW
StrToIntExW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

user32

IsRectEmpty
EqualRect
PtInRect
CharNextW
DestroyIcon
SetFocus
GetFocus
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
GetActiveWindow
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
EnableWindow
IsWindowEnabled
SetActiveWindow
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
ClientToScreen
EnableMenuItem
GetSysColor
GetSystemMetrics
MessageBoxW
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IntersectRect
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
GetDC
ReleaseDC
InflateRect
OffsetRect
DrawIconEx
IsMenu
GetIconInfo
wsprintfW
GetDesktopWindow
TranslateMessage
DispatchMessageW
PeekMessageW
GetClassNameW
UnregisterClassW
SetWindowPos
GetForegroundWindow
SetForegroundWindow
CopyRect
SetRect
SetCursor
GetWindowLongW
SetWindowLongW
LoadStringW
SendMessageW
SystemParametersInfoW
KillTimer
SetTimer
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
GetKeyState
UnionRect
SetWindowTextW
ShowWindow
PostMessageW
FindWindowW
PostQuitMessage

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsCount
GdipGetImageHeight

kernel32

GetFileAttributesW
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
lstrlenW
LoadLibraryA
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleW
SetCurrentDirectoryW
GetTempPathW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetLastError
GetVersionExW
MulDiv
MultiByteToWideChar
LocalAlloc
LocalFree
OutputDebugStringW
ResetEvent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalLock
IsProcessorFeaturePresent
TerminateProcess
GetLongPathNameW
GetExitCodeProcess
CopyFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FindClose
GetEnvironmentVariableW
OutputDebugStringA
CreateDirectoryW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
GlobalFree
lstrcpyW
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetSystemInfo
GetVolumeInformationW
ReleaseMutex
CreateMutexW
FileTimeToSystemTime
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
GetModuleHandleA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetOEMCP
IsValidCodePage
GetTickCount
ReadFile
WriteFile
GetFileSize
GlobalUnlock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
CreateFileW
GetSystemDirectoryW
LoadLibraryW
CloseHandle
DeviceIoControl
Sleep
OpenProcess
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
FormatMessageA
SleepEx
WaitForMultipleObjects
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
GetSystemTime
SystemTimeToFileTime
InterlockedCompareExchange
GetFileInformationByHandle
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
lstrlenA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
GetStartupInfoW
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
WriteConsoleW
GetACP
ExitProcess
GetStdHandle
GetModuleHandleExW
ExitThread
RtlUnwind

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

gdi32

SetGraphicsMode
GetDeviceCaps
CreateBitmap
GetCharABCWidthsW
EnumFontsW
BitBlt
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
CreateCompatibleDC
CreateSolidBrush
EnumFontFamiliesExW
GetStockObject
Rectangle
SetBkMode
StretchBlt
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
GetTextMetricsW
SetWorldTransform
ExtTextOutW
GetTextFaceW
GdiFlush
GetCurrentObject
GetViewportOrgEx
CreateFontIndirectW
CreateRoundRectRgn

wininet

InternetCloseHandle
InternetQueryOptionW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW

wldap32

ord60
ord211
ord46
ord143
ord50
ord41
ord22
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord26

ws2_32

select
WSAStartup
WSACleanup
recv
send
WSAGetLastError
WSASetLastError
bind
__WSAFDIsSet
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname

oleaut32

SysAllocString
SysFreeString
SysStringLen

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 917KB - Virtual size: 916KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 946KB - Virtual size: 946KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0d536edebc7a6ac3e3ad282c6b5b240

Code Sign

01:fb:56:23:5e:01:96:6d:80:34:7a:ae:7a:2f:b8:44Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

96:4d:b7:b2:5a:06:40:f9:c3:f5:8f:65:79:f9:28:8a:8b:e9:e8:30:c2:19:80:43:65:ba:6e:6b:aa:cc:46:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ole32

shell32

shlwapi

userenv

user32

version

gdiplus

kernel32

imm32

gdi32

wininet

wldap32

ws2_32

oleaut32

usp10

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 917KB - Virtual size: 916KB

.data Size: 77KB - Virtual size: 187KB

.rsrc Size: 946KB - Virtual size: 946KB

01:fb:56:23:5e:01:96:6d:80:34:7a:ae:7a:2f:b8:44
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

96:4d:b7:b2:5a:06:40:f9:c3:f5:8f:65:79:f9:28:8a:8b:e9:e8:30:c2:19:80:43:65:ba:6e:6b:aa:cc:46:af
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 917KB - Virtual size: 916KB

.data
Size: 77KB - Virtual size: 187KB

.rsrc
Size: 946KB - Virtual size: 946KB