c9a8520e305ce0aa49e7a8ca4672ade700f1412005fd9259f632039042146c78

Sharing

Copy URL Twitter E-mail

General

Target

c9a8520e305ce0aa49e7a8ca4672ade700f1412005fd9259f632039042146c78
Size

45KB
MD5

a2620204ddd5263563206a814e20c268
SHA1

dfa70b9ea297d8612bdb3be3b13cd04d990bef5c
SHA256

c9a8520e305ce0aa49e7a8ca4672ade700f1412005fd9259f632039042146c78
SHA512

9f18d5c6ec934d115cfac0e9ca3c198527b2cccee53c5d9301372023735c05a5e08b39da08aeb3796a0a1ee6800022647cdbdf6384399906a79fc17dafaeea00
SSDEEP

768:cHJtoqvWGHk9OlbQplbmYiBkojAMxkEvFYiBk0AMxkER:4DvFHoOlolbm7BkoDxZ7BkSxt

Score

1^/10

Malware Config

Signatures

Files

c9a8520e305ce0aa49e7a8ca4672ade700f1412005fd9259f632039042146c78
.dll windows:5 windows x64 arch:x64

75f2821fb6410e600bf41bf64201fccf

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/08/2022, 00:00

Not After

29/07/2025, 23:59

Subject

SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/08/2022, 00:00

Not After

29/07/2025, 23:59

Subject

SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:76:1a:fd:e8:32:d4:1d:b6:72:c7:69:65:69:e7:92:80:44:79:1d:66:44:f2:b6:77:bd:af:08:33:6e:7c:08
Signer

Actual PE Digest

79:76:1a:fd:e8:32:d4:1d:b6:72:c7:69:65:69:e7:92:80:44:79:1d:66:44:f2:b6:77:bd:af:08:33:6e:7c:08

Digest Algorithm

sha256

PE Digest Matches

true

f8:b8:88:46:a6:f9:2b:fc:b6:df:9e:d2:4c:1f:6e:fd:b0:21:7f:fd
Signer

Actual PE Digest

f8:b8:88:46:a6:f9:2b:fc:b6:df:9e:d2:4c:1f:6e:fd:b0:21:7f:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\winapps\5.0\dll\vc\ConfigDll\sourcecode\x64\Release\Config.pdb

Imports

mfc90u

ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord2303
ord4050
ord4687
ord5362
ord5345
ord5696
ord2602
ord2797
ord2904
ord4419
ord4121
ord2907
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4596
ord4372
ord3424
ord286
ord280
ord789
ord5532
ord2531
ord3930
ord588
ord296
ord688
ord450
ord772
ord577
ord3783
ord4145
ord4103
ord5658
ord916
ord791
ord2780
ord913
ord592
ord1235
ord320
ord1963
ord1203
ord1201
ord1225
ord1146
ord1195
ord379
ord1118
ord1234
ord1232
ord1111
ord1053
ord1103
ord321
ord780
ord1061
ord779

msvcr90

_initterm_e
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
free
_local_unwind
_initterm
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
??2@YAPEAX_K@Z
__CxxFrameHandler3
wcscpy_s
_wcsnicmp

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
SetLastError
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
LocalAlloc
LocalFree
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLastError
GetModuleFileNameW

advapi32

RegEnumValueW
RegRestoreKeyW
RegSaveKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegFlushKey
RegCloseKey
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyW

shlwapi

SHCopyKeyW
SHDeleteKeyW
SHDeleteValueW
SHSetValueW
PathFileExistsW
SHGetValueW

Exports

Exports

GUCCloseKey
GUCCopyTree
GUCCopyTreeToConfig
GUCCopyTreeToReg
GUCCreateKey
GUCCreateKeyEx
GUCDeleteKey
GUCDeleteKeyValue
GUCDeleteTree
GUCDeleteValue
GUCEnumKey
GUCEnumValue
GUCFlushKey
GUCGetDefaultName
GUCGetValue
GUCIsConfigFile
GUCIsSeparate
GUCOpenKey
GUCOpenKeyEx
GUCQueryInfoKey
GUCQueryValueEx
GUCRestoreKey
GUCSaveKey
GUCSetKeyValue
GUCSetValueEx
Test

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 362B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75f2821fb6410e600bf41bf64201fccf

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

79:76:1a:fd:e8:32:d4:1d:b6:72:c7:69:65:69:e7:92:80:44:79:1d:66:44:f2:b6:77:bd:af:08:33:6e:7c:08Signer

f8:b8:88:46:a6:f9:2b:fc:b6:df:9e:d2:4c:1f:6e:fd:b0:21:7f:fdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 362B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

79:76:1a:fd:e8:32:d4:1d:b6:72:c7:69:65:69:e7:92:80:44:79:1d:66:44:f2:b6:77:bd:af:08:33:6e:7c:08
Signer

f8:b8:88:46:a6:f9:2b:fc:b6:df:9e:d2:4c:1f:6e:fd:b0:21:7f:fd
Signer

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 362B