7f3ce8c346b73f25eb40b0f9c7aac45cc9d46a711da6df3aded04e363b5a7941

Sharing

Copy URL Twitter E-mail

General

Target

7f3ce8c346b73f25eb40b0f9c7aac45cc9d46a711da6df3aded04e363b5a7941
Size

224KB
MD5

63f77ec76d8f1ed049ed8f2411f5c4b2
SHA1

2256ee39989a2069bea61fcb89b0d59db4b25efb
SHA256

7f3ce8c346b73f25eb40b0f9c7aac45cc9d46a711da6df3aded04e363b5a7941
SHA512

97ed8f9234485510f61ad5e8076204d75d77f977b832604d51a590e3cb9b97523264f35ff035630c5a6c405d62fd59238c60df17b26f2b11dc9652420a4cd457
SSDEEP

3072:r4Wu1JkTmBNRP8hXzGEPkW6ZZW8egHf/jQmAg0FubAxZ+051gh9b0qWTkMdO85:r9CqhT2ZW8eUAOAZgMkMY85

Score

1^/10

Malware Config

Signatures

Files

7f3ce8c346b73f25eb40b0f9c7aac45cc9d46a711da6df3aded04e363b5a7941
.dll windows:6 windows x86 arch:x86

781c0f25a197e324dc4948975987f984

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:16:66:29:58:45:15:9f:57:ae:88:f4:41:bf:23:7e
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/07/2015, 00:00

Not After

01/08/2018, 12:00

Subject

CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,ST=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:eb:37:6f:c5:84:a7:1e:98:8d:12:84:c6:7b:a3:00:2d:6c:21:48
Signer

Actual PE Digest

67:eb:37:6f:c5:84:a7:1e:98:8d:12:84:c6:7b:a3:00:2d:6c:21:48

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Program Files (x86)\ASUS\AsusFanControlService\2.00.28\ASUS_WMI.pdb

Imports

kernel32

WaitForSingleObject
GetExitCodeThread
OutputDebugStringW
CloseHandle
CreateThread
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
CreateFileW

user32

wsprintfW

ole32

CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

Exports

Exports

IsSupportASUSWMI
burst_read_ec
burst_read_ec_thread
burst_read_hwm
burst_read_hwm_thread
burst_read_sio
burst_write_ec
burst_write_ec_thread
burst_write_hwm
burst_write_hwm_thread
burst_write_sio
read_cpuid
read_ec
read_ec_thread
read_hwm
read_hwm_thread
read_index_io
read_index_io_thread
read_io_byte
read_io_dword
read_io_word
read_mem
read_msr
read_pci
read_sio
read_sio_thread
read_smbus_block
read_smbus_byte
read_smbus_word
write_ec
write_ec_thread
write_hwm
write_hwm_thread
write_index_io
write_index_io_thread
write_io_byte
write_io_dword
write_io_word
write_mem
write_msr
write_pci
write_sio
write_sio_thread
write_smbus_block
write_smbus_byte
write_smbus_word

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

781c0f25a197e324dc4948975987f984

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

08:16:66:29:58:45:15:9f:57:ae:88:f4:41:bf:23:7eCertificate

Extended Key Usages

Key Usages

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9Certificate

Extended Key Usages

Key Usages

67:eb:37:6f:c5:84:a7:1e:98:8d:12:84:c6:7b:a3:00:2d:6c:21:48Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 3KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 472B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 9KB - Virtual size: 8KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

08:16:66:29:58:45:15:9f:57:ae:88:f4:41:bf:23:7e
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

67:eb:37:6f:c5:84:a7:1e:98:8d:12:84:c6:7b:a3:00:2d:6c:21:48
Signer

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 3KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 472B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 9KB - Virtual size: 8KB