addf023be1eefac070fcf13b27a647d3

resource	yara_rule
sample	upx
static1/unpack001/CKAngel/ckangel.exe.tmp	upx

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/OnTop.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack002/out.upx
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

SHA256 e663c2ab41480b29ef39aeada7469aa5821a8210f00d00d4c5419fbd8259a662
MD5 addf023be1eefac070fcf13b27a647d3
SHA1 8a13eea93a7c193bcbf22f203acb6cff68eab706
SHA512 91fc8ac470a255d058d9582ce5114b26dd778a9c14b2d2568ea1ebe3b74a46fd534e0cdaf08ac4c32f473cce139921453c8af8d800e2b5b792d3ff5cab324f93
SSDEEP 98304:miAagcHchXQWY9PqHeeL9f6xPsCl6uS6oJ:BjglXQnqH54l5C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

c5:d0:08:24:89:3b:6a:37:c0:23:a6:5e:f2:14:70:28:4f:5f:13:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

4

Entry point

320704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$COMMONFILES/Angels/$0

SHA256 883967e66df47c4bd3810aa2df7e3af059140b206273a2be3689f88ffb427288
MD5 7606229a20eea288cdb776b7c76da447
SHA1 9823df7de56166411b75d7b6d3105888d0711189
SHA512 ffc9983504d6c2fad61eaeb2371c66ff09f85870325be53c823c9442916bf083406a628d0c7949b45f721b31c4a01f08e3a7a86237ffd3139b8ab730f7faf3af
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$COMMONFILES/Angels/AgLog.dll.tmp

IMPHASH 8b94593f8aa2176ca294ef29c489bf88
SHA256 5b432e3255dc73277356571855cb782d3a376c9d2a77eec940092853b68319fb
MD5 eac8960e017bd934b2009f6db2faf03c
SHA1 709263b55e8002c9acde39ff48eb9b43486d5ec6
SHA512 2c27493d946f3696c200b3c8db9bb698a6d8e2dcc8ad94304ca7c34b5d4fd40c735214691dcd294923515831da818a482d4821d0e0b92d162b8734ba07c9e6e5
SSDEEP 6144:BCv6QXUtiBav//wX4Yz0jfTc3B3QvZusUhm:IPi/wX4YzYfTchQhu0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Feb 23, 2024

Minor OS version

0

Major OS version

5

Entry point

97064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Source\AgLog\Release\AgLog.pdb

kernel32

HeapFree GetCommandLineA HeapAlloc RtlUnwind Sleep ExitProcess RaiseException VirtualAlloc HeapReAlloc HeapSize SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree SetHandleCount GetStdHandle GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW CreateFileA SetEnvironmentVariableA GetFileTime GetFileSizeEx GetFileAttributesW GetFullPathNameW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers InterlockedIncrement GetModuleHandleA GlobalFlags GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue InterlockedDecrement LocalAlloc FileTimeToLocalFileTime FileTimeToSystemTime GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW WaitForSingleObject GlobalAddAtomW SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetSystemInfo GetProcAddress GetVersionExW GetModuleHandleW GetSystemDefaultLangID GetVolumeInformationW GetCurrentProcessId DeleteFileW DeleteCriticalSection EnterCriticalSection WritePrivateProfileStringW GetTimeZoneInformation LeaveCriticalSection GetPrivateProfileIntA InitializeCriticalSection GetPrivateProfileStringW ExpandEnvironmentStringsA GetTickCount lstrlenA MultiByteToWideChar CloseHandle LockResource GetLocalTime GetLastError CreateFileW ReadFile SizeofResource WideCharToMultiByte WriteFile LoadResource FindResourceW SetFilePointer FreeEnvironmentStringsW GetFileSize

user32

DestroyMenu CharUpperW GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush ClientToScreen ShowWindow SetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetWindowTextW GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow UnregisterClassW UnhookWindowsHookEx GetMenuItemID GetMenuItemCount GetSubMenu SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow SetCursor PostMessageW PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetSystemMetrics MessageBoxA MessageBoxW

gdi32

GetStockObject TextOutW RectVisible PtVisible DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape CreateBitmap SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox GetDeviceCaps ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW CryptDestroyKey CryptEncrypt CryptImportKey CryptGenRandom CryptReleaseContext CryptSetKeyParam CryptAcquireContextW

shell32

ord165 SHGetFolderPathW

shlwapi

PathFindFileNameW UrlUnescapeW PathStripToRootW PathIsUNCW PathFindExtensionW

oleaut32

VariantClear VariantInit VariantChangeType

ws2_32

WSAStartup WSACleanup WSASetLastError

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW HttpQueryInfoW HttpAddRequestHeadersW InternetQueryDataAvailable InternetSetOptionExW InternetCanonicalizeUrlW InternetCrackUrlW HttpOpenRequestW InternetCloseHandle

$COMMONFILES/Angels/Agwin7.dll.tmp

IMPHASH ca3f15eec83fb7e594f68f6dcb467db9
SHA256 07a15218c0862b9406e3a1002c0dfedac2fbad69578add537d5ef23961d36d9b
MD5 71c71a81864920b3c993500370bd24cd
SHA1 1afdb9e97970741728788c3aa4da83de0c1893ec
SHA512 f4737c417e9370144409bc762f2a9067ec23c08359835f3c1191af5449c2f9ba72656cef4003309ad5f3a2b1878f3cadc34ef801414122b7b50ba66a2ce3e960
SSDEEP 768:kpdcLGMKEfsu1nWmmR2LEY2t7bXrvSZYA8YKU1r15sD+ewMLEUbGq:knLMWTR24Y2tHXrv0hLrK+eF4QGq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

71:43:c9:4b:de:ac:20:7c:9d:c8:dd:52:14:23:00:3e:e6:04:bb:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 13, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

6257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleHandleW GetProcAddress GetModuleFileNameW GetLastError GetVersionExW GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar HeapAlloc VirtualAlloc HeapReAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA CloseHandle FlushFileBuffers

ole32

PropVariantClear CoCreateInstance

$COMMONFILES/Angels/AngelAsst.exe.tmp

IMPHASH f7291fcd7324c762026b4751870129d0
SHA256 57d2ed4d5ffce987eba4321a055f6c2f74f94a09ec13053205462f205df33fe0
MD5 fcddb14984babda702a989a4182724d2
SHA1 8220a6486fa2d5b3fdb5e936d372c4f13438f015
SHA512 5f813e63e717df87c7f516e7b4e7b2daf3550d36f0d5347dd82e25f174eef5f0a3c615abdb3619f55f562d270c92af934acc06b50218dae892f7d531f7f390a5
SSDEEP 3072:GHrcfb6juHeNxHlbuL9hKNIVu2f+FZKPSxE:GHrcfb6juHmlSL9hLVu2cZJE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

2d:1b:6f:49:04:b6:0a:e2:c0:6f:8b:6d:17:b5:75:d8:3e:42:bc:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 23, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

42683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileW ExpandEnvironmentStringsW GetPrivateProfileStringW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize CreateFileW GetPrivateProfileSectionNamesW CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetPrivateProfileIntW GetPrivateProfileSectionW LeaveCriticalSection EnterCriticalSection GetCurrentProcessId GetTickCount GetLocalTime GetProcessHeap OpenProcess HeapAlloc HeapFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCommandLineW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement CreateEventW GetCurrentThreadId Sleep WaitForSingleObject GetModuleFileNameW CreateThread ResumeThread SetEvent CloseHandle lstrcmpiW lstrlenW GetModuleHandleW GetProcAddress GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer WideCharToMultiByte LoadLibraryA InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount RtlUnwind GetStartupInfoW VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW

user32

LoadStringW CharUpperW MessageBoxW CharNextW TranslateMessage DispatchMessageW GetMessageW PostThreadMessageW

advapi32

GetKernelObjectSecurity InitializeSecurityDescriptor CryptAcquireContextW CryptReleaseContext CryptGenRandom GetUserNameW BuildExplicitAccessWithNameW GetSecurityDescriptorDacl SetEntriesInAclW MakeAbsoluteSD SetSecurityDescriptorDacl SetKernelObjectSecurity DuplicateTokenEx ImpersonateLoggedOnUser CreateProcessAsUserW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW ChangeServiceConfigW ChangeServiceConfig2W RegEnumKeyExW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource ControlService DeleteService CreateServiceW OpenSCManagerW OpenServiceW CloseServiceHandle RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoInitialize CoUninitialize CoCreateInstance StringFromGUID2

oleaut32

SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi LoadRegTypeLi VarUI4FromStr RegisterTypeLi SysStringLen

shlwapi

PathFileExistsW StrCmpNIW

urlmon

URLDownloadToFileW

$COMMONFILES/Angels/IEHelp.htm.tmp

SHA256 609471ce7403a914ef23d91082242c876e1b2ffcfcc6a70ab1309f45b387d1d4
MD5 4e72a0d4ecf37f91b9fc9fd2e27a6661
SHA1 c3e9117731947e1a3e2f9aaea9356cedf5fe53da
SHA512 ffc517b819c9e995f0aadef0583b099b16bff262315a9f27ba1c6306d0e0fde30c32ecaac19fdaf9584f182b64677699b42d40606f4038637485b2b5601d79bb
MD5 SHA1 SHA512

polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$COMMONFILES/Angels/IEMenuExt.dll.tmp

IMPHASH e0f58ba6084a5b179c79424ceac9fd5e
SHA256 ae47cd1154ceafc74bb4b8b11f5425bd12f2ac5eb3f3ecd7153837cd1b0761f7
MD5 4c6f8c20b9a649e42b07f33bcce32290
SHA1 c5a59524d924aa66c321479cc1dd0486cb669f61
SHA512 59d0c341a4beff3dc2b53d3493e2a4642b6c91a426aca0a5510f8ddff732aebc22882535841cf96295acb630b6b73609031df1b697308f360d6798e865fdcd3f
SSDEEP 3072:tHWSddWrkqTQslbv7mfpAQx0F9OS8jouaTX5CEoHgr5Aa9+4UtEBi41kRw:ZW4r87y0POJvakEoHk5AaCfi
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

6c:45:16:b1:cc:e9:45:54:46:eb:74:67:ed:2c:f8:7b:69:25:4e:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

66761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenW GetLastError GetProcAddress GetModuleHandleW lstrcmpiW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW InterlockedDecrement SetThreadLocale GetThreadLocale GetACP CloseHandle WriteFile CreateFileW GetProcessHeap InterlockedIncrement GetModuleFileNameW GetFileAttributesW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection LoadLibraryExW RaiseException SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetLocaleInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidLocale EnumSystemLocalesA InterlockedExchange Sleep RtlUnwind HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetOEMCP IsValidCodePage HeapSize ExitProcess VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetModuleHandleA ReadFile SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID

user32

wsprintfA CharNextW

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegSetValueW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2

oleaut32

LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen SysFreeString

$COMMONFILES/Angels/IEScan.dll.tmp

IMPHASH d4d7acf2490f50cad61341abdc13b81b
SHA256 589c537d60dfb98c6fbb1d5a26c2ffed48ed3b6ce083e2fc0ff9f4d45f6cbed3
MD5 bc790cfb3e358b55b841410ae2fd7fa1
SHA1 2cc3e8d98279a5e730bce9b77b18d19d069c90ee
SHA512 97de33fe680f8289fd3b2d761db345198278194853aa40e4c7fa58cd549ff3c55cb2178e0001d0fef74fd385c366a7b2cbb17c0622d955681b564bc5cfe87ee7
SSDEEP 768:8Q0Uz/q4DHd5IytXGU1ZclADgN87Hra48fd+R0iyQpH/xL53+SeeKWr392LEUbG8:B0f4D9yYJlDgMgfdtyt/P+Cj924QG8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

14547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\src\IE360\bin\IEScan.pdb

kernel32

GetVersion DisableThreadLibraryCalls GetProcAddress GetModuleFileNameW Sleep LoadLibraryW CreateProcessW GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetLastError HeapFree HeapAlloc LCMapStringW ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection GetLocaleInfoA VirtualAlloc HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapSize

user32

SendMessageW wsprintfW

advapi32

RegOpenKeyExW RegEnumValueW RegQueryValueExW RegCreateKeyExW RegCloseKey

$COMMONFILES/Angels/IEsafe.dll.tmp

IMPHASH b39b2b15224277c12a2ea0c459fa58fb
SHA256 5d112bb59e28f4e2c2caf5d66b76cd625f04e79d87e69610e835653bf4f7574c
MD5 e17b2e98ece6437d1c4706bec74f4123
SHA1 12e35f617552c6f46f28a591d243921760d2553d
SHA512 1b666d0a02d5f0647362fcffa46af47a41583406129a7aaf903e395563f9a07be238d3277ad0c841473c5ca0cc56d0a1c5ae2c1033518125b0207f594c691a82
SSDEEP 12288:IfpD/QT3YycROwCH7JrNxfhcfVuOfkY0Kqpx/25tbyoVmmjyHe4TBu1pJLR3j3LT:6sPrm++ou1p/j3LTD9JBp
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

a5:c7:ac:e6:a5:e9:d8:3e:9b:ad:c2:e5:81:91:fd:48:d8:d3:ee:b9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

391683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

GetUrlCacheEntryInfoW DeleteUrlCacheEntryW

winmm

PlaySoundW

gdiplus

GdiplusShutdown GdipLoadImageFromFile GdipFree GdipAlloc GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipCloneImage GdiplusStartup

kernel32

GetSystemWindowsDirectoryW ExpandEnvironmentStringsW GetCurrentThreadId GetTickCount GetCurrentProcessId SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA LoadLibraryA MultiByteToWideChar lstrlenA HeapFree HeapAlloc GetProcessHeap GetCurrentProcess RaiseException FlushInstructionCache lstrcmpiW LoadLibraryExW TerminateThread WaitForSingleObject DisableThreadLibraryCalls SizeofResource LoadResource FindResourceW GlobalAlloc WideCharToMultiByte CreateThread GlobalFree WriteFile DebugBreak OutputDebugStringW GlobalUnlock GlobalLock MulDiv GlobalHandle LockResource CreateProcessW MoveFileExW ResumeThread GetPrivateProfileStringW VirtualProtectEx IsBadReadPtr GetTempPathW InterlockedCompareExchange CreateFileMappingA CreateEventA GetSystemInfo lstrcmpiA GetVersionExA CompareStringW CompareFileTime SystemTimeToFileTime FileTimeToSystemTime GetWindowsDirectoryW GetLongPathNameW FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileW VirtualQuery VirtualProtect VirtualAlloc GetThreadContext SetThreadContext SuspendThread SetFilePointer TlsAlloc TlsGetValue HeapReAlloc HeapDestroy HeapCreate GetCommandLineA GetSystemTimeAsFileTime GetConsoleMode GetConsoleCP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind LocalFree VirtualFree IsProcessorFeaturePresent InterlockedExchange GetLocalTime GetCPInfo GetACP GetOEMCP IsValidCodePage lstrcmpW lstrcpyW OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary OutputDebugStringA GetModuleFileNameW SetLastError LoadLibraryW GetCurrentThread GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA Sleep DeleteFileW InterlockedIncrement CopyFileW CreateFileW ExitProcess GetStdHandle GetModuleFileNameA LCMapStringW HeapSize GetFileType SetHandleCount GetStartupInfoA SetStdHandle GetFileSize WriteConsoleA GetConsoleOutputCP WriteConsoleW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter LCMapStringA GetStringTypeA GetLastError ReadFile CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection CreateDirectoryW lstrlenW InterlockedDecrement GetStringTypeW InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetEndOfFile GetLocaleInfoW FlushFileBuffers TlsSetValue TlsFree

user32

OffsetRect GetCursorPos RegisterWindowMessageW LoadBitmapW MessageBeep SetDlgItemInt GetDlgItemInt CreateAcceleratorTableW DestroyAcceleratorTable BeginPaint EndPaint FillRect IsChild RedrawWindow InvalidateRgn InvalidateRect MoveWindow SetWindowTextA SetFocus GetDlgItemTextW EnableWindow GetDlgItem MapDialogRect EndDialog SetWindowContextHelpId DestroyIcon LoadImageW GetCursor DrawEdge DialogBoxIndirectParamW GetActiveWindow SetForegroundWindow BringWindowToTop UpdateWindow ReleaseCapture PtInRect SetCursor IsWindowVisible wsprintfW SetMenuItemInfoW DrawFocusRect InflateRect CopyRect DrawTextW DeleteMenu ScreenToClient wvsprintfW AdjustWindowRectEx SetCapture ReleaseDC GetDC GetWindowTextLengthW GetWindowTextW CharNextW GetClassInfoExW RegisterClassExW CharUpperBuffW GetSystemMetrics DestroyWindow GetSysColor LoadCursorW GetDesktopWindow SetWindowLongW CreateWindowExW DestroyMenu ClientToScreen LoadMenuW GetSubMenu TrackPopupMenu DefWindowProcW MessageBoxW ShowWindow wsprintfA UnhookWindowsHookEx GetFocus SetTimer TranslateMessage PostMessageW DispatchMessageW FindWindowExW GetClassNameW GetAsyncKeyState GetKeyState CallWindowProcW KillTimer CharLowerBuffW IsWindow LoadStringW LoadIconW GetParent GetWindow GetWindowRect MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos SendMessageW SetDlgItemTextW SetWindowTextW GetWindowLongW UnregisterClassA GetMenu

gdi32

CreateSolidBrush MoveToEx GetTextMetricsW SetMapMode SetTextAlign CreateFontIndirectW GetDeviceCaps SetBkMode GetStockObject GetDIBits GetObjectW CreateCompatibleDC CreateBitmap CreateCompatibleBitmap SetBkColor BitBlt DeleteDC CreatePen GetTextExtentPoint32W DeleteObject LineTo SelectObject

advapi32

RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegEnumValueW RegQueryInfoKeyW RegEnumKeyExW CopySid GetLengthSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority RegGetKeySecurity FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl AllocateAndInitializeSid RegEnumKeyW RegSetKeySecurity GetUserNameW RegDeleteKeyW RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CoGetMalloc CoTaskMemAlloc CLSIDFromProgID StringFromIID CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal ReleaseStgMedium OleLockRunning CoGetClassObject CLSIDFromString RegisterDragDrop OleInitialize CoTaskMemRealloc OleUninitialize CoTaskMemFree

oleaut32

VarBstrCmp VariantInit VariantClear SysAllocString SysAllocStringLen DispCallFunc LoadRegTypeLi LoadTypeLi VariantChangeType SysStringLen RegisterTypeLi VarUI4FromStr SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector SysFreeString UnRegisterTypeLi

shlwapi

PathFileExistsW StrToIntW StrCpyW

urlmon

IsValidURL URLDownloadToCacheFileA URLDownloadToFileW

oleacc

AccessibleObjectFromWindow

Name

.text

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

149KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$COMMONFILES/Angels/Scan.dll.tmp

IMPHASH cebe3e34ceb35941b3c83de27fd8e026
SHA256 54e849e119904f52cfca5362290daa094544a569c13c9f5edf4806a5e0f611a2
MD5 6891d3d4e9fefe584e758db70c0380ae
SHA1 f79f700870f2ea2e37be7bb5569c5a035ffefe81
SHA512 b0e908d2067fdc579904c73d13b14d96e22dab546961a65dff867bd0e41acb3483e974acce887fb7586ddc42f33ee28f22369327b90c9a3c9e9c120b40d22e12
SSDEEP 24576:TgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkk6:TgcIwi5nQ24EreytZ2ce
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

21:6e:c6:b7:86:cb:f6:79:f5:da:b0:4d:45:1d:84:e4:85:63:cd:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

634033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\haokanbar4\browser\ie\Scan\Release\Scan.pdb

winmm

timeGetTime timeBeginPeriod timeEndPeriod

kernel32

GetFileAttributesExW DeleteFileW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CreateMutexW SetFilePointer WaitForSingleObject GetTickCount GetModuleFileNameW GetCurrentThreadId OutputDebugStringA ReleaseMutex GetCurrentProcessId Sleep RaiseException InterlockedExchangeAdd WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentProcess GetFullPathNameA CreateFileA GetFileSize FreeLibrary UnlockFile LockFile FormatMessageA LoadLibraryW FlushFileBuffers GetProcAddress LockFileEx LoadLibraryA GetVersionExA GetTempPathA GetSystemTime AreFileApisANSI DeleteFileA InterlockedIncrement InitializeCriticalSection InterlockedDecrement GetThreadLocale GetACP GetLocaleInfoA GetLocaleInfoW GetTimeZoneInformation MapViewOfFile CreateFileMappingW UnmapViewOfFile GetConsoleOutputCP WriteConsoleW WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetModuleHandleA GetLastError GetTempPathW CreateFileW ReadFile GetFileAttributesW WriteFile GetFullPathNameW CloseHandle IsDebuggerPresent InterlockedExchange InterlockedCompareExchange MultiByteToWideChar GetFileAttributesA CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetStdHandle GetConsoleMode GetConsoleCP TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree HeapAlloc GetCommandLineA HeapReAlloc RtlUnwind GetCPInfo LCMapStringA LCMapStringW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree VirtualAlloc ExitProcess HeapSize GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHFileOperationW

$COMMONFILES/Angels/WebSafe.dll.tmp

IMPHASH c1ff6eb1812d22911676818ed8cde4d6
SHA256 d2080eebe7cda869349c0ac21e8503b24993bf764accdca10fadf4b1251bf65a
MD5 7ed89085881366038fa967cab289337a
SHA1 a12864a8bf292f9a24b392c1612ab108104bcae3
SHA512 4440056d682ea2ce7d25bc1517a4e8f83381f7d6db5ec4da841b98eb45cb0eac21b0905db62215f80a75dd14b14b6dc46fd18f5c447c68f9166af4aa60e982fc
SSDEEP 3072:Go/IOSN2Qv32fQNA6rPEvDKke+Eq+g4+AwCWC:9/IOSNPfNjrPeb0pg4eC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

fb:01:98:88:f2:d8:e2:be:78:00:3f:ad:f9:5b:f4:2a:30:fc:69:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

39107

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetWindowsDirectoryW LoadLibraryW FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleFileNameA GetCurrentThreadId DeleteFileA DeleteFileW WriteFile WriteFileEx CreateProcessW CreateProcessA WinExec VirtualProtect VirtualProtectEx OutputDebugStringW SetFilePointer SetLastError LoadLibraryA ExitThread GetVersion VirtualQuery TerminateProcess GetCurrentProcess DisableThreadLibraryCalls GetLastError ResumeThread GetThreadContext SetThreadContext InterlockedCompareExchange GetSystemWindowsDirectoryW VirtualAlloc SuspendThread GetModuleHandleW InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA HeapReAlloc GetModuleHandleA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW ExpandEnvironmentStringsW GetModuleFileNameW InterlockedDecrement Sleep GetCurrentThread LockResource LoadResource FindResourceW InterlockedIncrement WideCharToMultiByte lstrlenW FlushInstructionCache GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess HeapSize LCMapStringW MultiByteToWideChar LCMapStringA HeapAlloc TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo

user32

DrawTextW TrackMouseEvent SetWindowTextW GetDlgItem MoveWindow ClientToScreen GetWindowRect GetSysColor PostMessageW DialogBoxIndirectParamW EndDialog LoadBitmapW DefWindowProcW CallWindowProcW ShowWindow EndPaint GetSystemMetrics GetWindowTextW GetParent BeginPaint GetWindowLongW SetWindowLongW InvalidateRect SendMessageW GetClientRect IsWindowVisible IsWindow

gdi32

SelectObject GetStockObject DeleteDC StretchBlt CreateCompatibleDC DeleteObject SetTextColor SetBkMode GetTextMetricsW CreateFontIndirectW GetObjectW

shell32

ShellExecuteExW ShellExecuteA

ole32

CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocString

urlmon

CoGetClassObjectFromURL URLDownloadToFileW URLDownloadToFileA

shlwapi

PathFileExistsW PathIsURLW

$COMMONFILES/Angels/blockimg.xml.tmp

SHA256 b162f56577a34bd1ebb234828fcc74e2d5b65095c7997b790222d418b5202587
MD5 458c0781fef9f07c2b94e2d164fb4a76
SHA1 9e8e26cd4d03ccfc7abaa63d05dc8983bd2d0ab6
SHA512 463d117cf5cb42d225dba57262f9df8d34ca5d9c7397991a50d233b89a6e7ab480af44c5595bccb8b2f58c83e0a61641946b5d0f96c7a49ddd92e8e4f1a670c7
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$COMMONFILES/Angels/go114fa.exe.tmp

SHA256 5b1a692e365eaa612e11e4f7161b2e2223b3f8171a18516368d646c16bd53e2c
MD5 be4cb0b0f6b6b2392e4df25ac7a1ab60
SHA1 445d5b3ad9d14231caa5db1b2d899f37430a63c1
SHA512 fce748853a7f2e524f60c03b6587349c09211648978a9470c9980976b8830d0689a2876f60a6358f5dd8c5d886325b75ace982679ecaf6f9863a96d5d1a00646
SSDEEP 768:JicxqkQ0OJQSf5Q4bDb87SSFAuJJ2m81LLEUbGNl:wcxqkQOYDb87ZFAuJJ2z4QGNl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

3f:95:ac:de:d2:86:8e:52:b9:95:f7:c2:55:3f:f4:b3:f6:4d:d0:17

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 13, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

4

Entry point

15628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

844B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$COMMONFILES/Angels/xFoCtrl.dll.tmp

IMPHASH 7de146e96b1265070990368b75f4ff4c
SHA256 31ab42cfb448c45b4cafc5c9dd783705ee1f057bdf9b0478ccc94f87fd644427
MD5 c1d9762180741f397b5d71147e4e4141
SHA1 503007d02c1e77697012f0046bd5164b488752d0
SHA512 cdd427390bea5e5e9cdc7febcb026477b2445db25e3c038e1a5c7f5f74338fdec62acc387382cd7582a4407d375f4029cc8b15930167313f45c1524f129fa5b4
SSDEEP 3072:h8nvO1B0Rn+rXBllu2jMLaj6ocVkTpS+lsOJx1N:Gnv9Rn+/faPbeIjsN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

3d:26:66:af:70:25:18:11:9f:35:52:53:40:8e:a0:6b:05:f6:47:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

4

Entry point

63765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FlushFileBuffers GetStringTypeW GetStringTypeA SetStdHandle GetOEMCP GetACP LCMapStringW LCMapStringA GetCPInfo SetFilePointer IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate GetVersionExA GetEnvironmentVariableA TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue HeapSize TerminateProcess ExitProcess GetVersion GetCommandLineA HeapAlloc HeapReAlloc HeapFree CloseHandle LocalFree lstrcatA DeleteCriticalSection HeapDestroy InitializeCriticalSection IsDBCSLeadByte lstrcpynA lstrcmpiA LoadLibraryExA GetLastError FindResourceA LoadResource SizeofResource GetModuleFileNameA GetModuleHandleA GetShortPathNameA GetCurrentProcess FlushInstructionCache GetCurrentThreadId WideCharToMultiByte lstrlenA lstrcmpA lstrlenW InterlockedIncrement LoadLibraryA GetProcAddress FreeLibrary lstrcpyA InterlockedDecrement Sleep GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar EnterCriticalSection LeaveCriticalSection GetStartupInfoA RtlUnwind RaiseException

user32

GetWindowTextLengthA SendMessageA GetClientRect SetWindowPos GetWindowTextA SetWindowTextA SetWindowLongA GetWindow DefWindowProcA RegisterWindowMessageA GetClassInfoExA RegisterClassExA GetDC ReleaseDC FillRect DestroyCursor LoadCursorA LoadImageA GetWindowLongA SetCursor PtInRect ClientToScreen GetCursorPos TrackMouseEvent CharNextA CreateWindowExA IntersectRect EqualRect OffsetRect SetWindowRgn UnionRect GetKeyState ShowWindow wsprintfA GetClassNameA GetDlgItem InvalidateRgn SetCapture ReleaseCapture CreateAcceleratorTableA GetParent GetDesktopWindow RedrawWindow IsWindow BeginPaint EndPaint CallWindowProcA GetFocus IsChild SetFocus GetSysColor InvalidateRect DestroyWindow LoadStringA

gdi32

CreateMetaFileA SetWindowExtEx CloseMetaFile DeleteMetaFile CreateRectRgnIndirect LPtoDP SaveDC SetMapMode SetWindowOrgEx SetViewportOrgEx RestoreDC GetObjectA GetDeviceCaps CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectA SetBkMode SetTextAlign SetTextColor TextOutA BitBlt DeleteDC GetStockObject CreateSolidBrush SelectObject PatBlt DeleteObject CreateDCA

advapi32

RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegDeleteValueA RegCreateKeyExA RegDeleteKeyA

ole32

OleInitialize CreateStreamOnHGlobal CoInitialize StringFromIID CoGetMalloc CoTaskMemRealloc CreateDataAdviseHolder OleRegGetMiscStatus CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs OleLockRunning CoTaskMemAlloc StringFromCLSID CLSIDFromString ProgIDFromCLSID CoTaskMemFree CLSIDFromProgID CoCreateInstance OleUninitialize CoUninitialize

oleaut32

GetErrorInfo LoadTypeLi RegisterTypeLi VarUI4FromStr OleCreatePropertyFrame LoadRegTypeLi OleCreateFontIndirect CreateErrorInfo SetErrorInfo VariantInit VariantClear SysStringLen SysAllocStringLen SysAllocString SysFreeString

wininet

InternetCombineUrlA

urlmon

CoInternetParseUrl

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/OnTop.dll

IMPHASH 5868b2e27b7dc96acf77699398b4c95b
SHA256 28cf47c05c86b2264ea1da120d3644cb46c86d6f27072a9a853e63e05ec97a25
MD5 7c0c240e911a521e8e554a10d04e558f
SHA1 d12ca9c464f2764e211039c09e56cb347626f7c7
SHA512 579b6787061efdc7f618f3c5a513cb539ccbe12ca41ba5e9ba8f00d03600edcdd82262b0fbfd58b96231c461f18b1233d657cbd0d1b827ea9df5374508578707
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ae16abcc57fb605e81077f272c9653d6888ccd448326d7db91746e617b49a587
MD5 94a43b471830d20ffe49845d1f471f6d
SHA1 b345ad97fa7942add5f201eab28bf4fc9e54eaa3
SHA512 8aefbd41e69819571c2a8d20d6538bffe2d19f75aa1d1624b739dd5b0e16b18d98312ff4e3658286d07bfcba52c26f60ff3042831aecf7ae715fdc01c106ac7d
SSDEEP 384:eDRMu4XKU+L5IhDESBSekauwd47sJNUfhiGb29rLxf+C8N8g:8CZXKU+FKDR0weYJqZiGqLEC8Gg
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 56dce7622a16fa21df6887796e26e78278f58386ac2d8d08fd07c7e190fcd4c5
MD5 b33f9cde76a6b5122434189a69c6ceed
SHA1 dac90feb2d097c4e59140160ca2f66e2c6a8a616
SHA512 1bba9311d61c72fec6cbb1c146d1a5e4532b55daf9bd48ec97fef435206999ab1353f789ec718f4e8d72b601e59edc125608c969a064f87085c20e5518e391cc
SSDEEP 1536:r/Nd9ViZbG06v4wv0WU8CAnMPuYvICg/ac2UgkwN46LFxpL4QU6Eblo0Ky:f9Qb/6hnhXpgZJL4QNy
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWebEx.dll

IMPHASH ae32207b6031c02aed9dfbea809c29f1
SHA256 0974e41b380a2e6fa080b04b7558d12e92d5d0885edf6025b7d0000201de59da
MD5 cc329d5153c6b5949ee9dcedb12926ab
SHA1 75744729739a8db546c08102dde407574d592a3b
SHA512 42b511bcbc639b6d6b3f657830a56c287d30a9ea0fbb5e63ec1db21bfcbd403a3fb3400f59ed94970fc4a71ca0830749a3f2a3190399c6e596413bba876a0b2e
SSDEEP 3072:pdVMcUtREsBESl+4+dTqQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5dnD:xMcUjpBrAnTqdKcS0Hwjl2JwbD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

f4:28:41:bc:3e:9c:9f:f0:e4:6e:6f:48:8e:a3:ea:59:b8:a9:ea:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 16, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

19382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError CreateFileA GetCurrentProcessId GetTickCount GetPrivateProfileStringA GetPrivateProfileIntA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount HeapSize GetConsoleMode GetConsoleCP WriteFile SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW CloseHandle GetProcessHeap HeapAlloc ExpandEnvironmentStringsA WritePrivateProfileStringA HeapFree GetPrivateProfileSectionA lstrcpyA LoadLibraryA GlobalFree MultiByteToWideChar LCMapStringA HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter VirtualFree GetSystemTimeAsFileTime RtlUnwind GetCurrentThreadId GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA RaiseException Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy

user32

ReleaseDC ShowWindow GetWindowTextA MoveWindow GetDlgItem GetClientRect GetDC PostMessageA LoadCursorA SetCursor SetDlgItemTextA InvalidateRect CreateDialogParamA SetWindowLongA SendMessageA GetWindowRect MapWindowPoints UpdateWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA IsDlgButtonChecked DestroyWindow CheckDlgButton LoadBitmapA CallWindowProcA

gdi32

CreateCompatibleDC SelectObject BitBlt DeleteObject DeleteDC GetObjectA GetTextExtentPointA GetTextExtentPoint32A

advapi32

CryptReleaseContext CryptGenRandom CryptAcquireContextW

ole32

OleUninitialize OleInitialize

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry InternetAttemptConnect GetUrlCacheEntryInfoA

$TEMP/updatesafe.exe

IMPHASH 3f4b03009aac87f62edb9c2603c1f3bf
SHA256 57daec3419ce1e392341d343004a31f5fe474e728126ae78b0281098d523199b
MD5 a53ceb8b5a3d9ee90de6370432327d83
SHA1 a50dbc458d2f29c6b83ea927211c49b87bb66358
SHA512 c7eda4f87c6d1f91e27e7a38390972d056a2253c40439d65a39a8c995d2b8a56dc95c75a18825626d29fc65bebcc85e07bf2a0b2b191b259647b4865d015a8e4
SSDEEP 1536:NgeIePh5nmOJ9R46UUhL8tc9/28hkl4O6VI/sQkMm+V4gg4QGa:NiQbvcqhL8i8sQkMm+V4gQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

c0:04:e1:72:c3:59:d1:5d:75:bb:1b:74:5e:10:12:b5:13:52:b9:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 20, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

10928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFileMappingW CloseHandle DeleteFileW SetFilePointer lstrlenA CreateProcessW WaitForSingleObject CreateFileMappingW CreateFileW MultiByteToWideChar GetLastError MoveFileW InterlockedIncrement InterlockedDecrement GetModuleFileNameW ReadFile MoveFileExW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleHandleW Sleep GetProcAddress ExitProcess HeapFree GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate VirtualFree HeapAlloc VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetLocaleInfoA WideCharToMultiByte RaiseException GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

ord165 SHGetSpecialFolderPathW

urlmon

URLDownloadToFileW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

CKAngel/ckangel.exe.tmp

SHA256 4a788fec0e552723484487666fc2525fbc56fd9dd9f15e9ff18a72d9275411ed
MD5 4977fd62294a20f5d400647c4a6962a7
SHA1 6f5aaa30412152be252d3055e8f9705471c9e6bb
SHA512 77923e3fc7de244bc9a87284b48c0b9ba0160751475f235843fac665ba527c9ff0aadbbf76957015bee42308887b98c37aa31f2b53dfedeea81c083016b6eff8
SSDEEP 49152:0BNSTaq3Xnsgb6Zz3i+9Z+1JIwoh9th04hQN52I3VmUV+yB/GOadWJ:0B0TaWXhmtSJ1mwo3c3/2I3Vmm+yB/G8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

1e:83:e3:24:db:7a:2e:6a:0e:d3:28:dd:b2:f8:a7:dc:88:a9:04:a8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

8356848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 a26762fc546a39ad706b7f7e6347db8aca88063d3a2d1bc438dcbde326fd8736
MD5 5552b987b4db1757e4daec33c3711e94
SHA1 e912f0b48fe110bba50a214cf49d9642478388a5
SHA512 4920175b2d374c95919306f5acafcf34c38fc49faa6eda8da40b49deba32d495ba6bcfd95a94de7361143b008d450a021a2ee6788f921c31bf67a8801e968e91
SSDEEP 49152:T3IsuN5KgdqSJNGk9MXPDD8aTkaa7F61q2PZTiFNl/icgEazjANRcn9emJaR/y2O:743MXbD8aTkawF6V+a2RtRbX2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

2668232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

934B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

CKAngel/uninst.exe.nsis

SHA256 80e9ccb90c22fdd737cd389b42f98f52c97fe3b4060381d74ca7d7e56301d32a
MD5 0a92a6af56b41ca6a8bbb999f0838a80
SHA1 faa552e5a72510b82f57bc82aa09568ae7baf11d
SHA512 0b5ef415202d230e925a0a6db723a6c0bc92ff51862a72edd3a73c19494b2c702b5d4412f1e7054171e6c226ee135120bda95201573f542b4b32af0d29f7f135
SSDEEP 768:AO/2lIoToZotoeauSiV3Fahse0LcC9T9ieefsQ9Bpk7UjTCz9/LOX7:AO/jOPaPiVZe0QCnibsR4mz9/LOL
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 336abb459a783489500a55b27a1b47ba0d87903ad5c969b0c8b82c2e82eb59e8
MD5 356bbecc2dcec470c5c918a5de3afa29
SHA1 bf447b8ecf67bef25e1b313b6815b4371bdf0bdb
SHA512 7fa7746bad9be1b28d1ff7ddbc3293569b8b199f5eaf3cc1392037f4b9ce62ef3c69447d96eca5bc2230fe4d7ecca7cac1a41c66a7a68e45f0febfba8739a59b
SSDEEP 1536:Y3cpyORJLuB4P4TVYWytXHsL3Coy8sWjHHLJWHw0Ht3qlhQmz4EhPAt:Y3c1fP42NVkylWTrB0NcQmVAt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer