b40359dfe052d488b105768c659f596290ee1c649ee5242e2f926339feb946a7

Sharing

Copy URL Twitter E-mail

General

Target

b40359dfe052d488b105768c659f596290ee1c649ee5242e2f926339feb946a7
Size

6.4MB
MD5

76be9f31cf1c3e0544ae2f6873b53479
SHA1

c0ecf2474e88454c3bb10244640676bb1d9821a8
SHA256

b40359dfe052d488b105768c659f596290ee1c649ee5242e2f926339feb946a7
SHA512

704e66be0ae9f2b0470fe467acc515422d2027b505c1e8b5e743a67820660448f507dfe11fd91c7a49dcc74c68d384843d7aecb758fea0b5bf7a5f60137dc49b
SSDEEP

98304:yHr/ij5wlpYmslTg74VGM/2cgIwJJCn6H1WZ4l94Tl6NhZnhIy/4j+s3ZdhDx9:URO/VGM/LHAS6H1q294Twfqt9

Score

1^/10

Malware Config

Signatures

Files

b40359dfe052d488b105768c659f596290ee1c649ee5242e2f926339feb946a7
.exe windows:5 windows x86 arch:x86

f95f53042712dac46e00778963549755

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:97:98:0b:71:4d:c3:d1:34:74:ec:a4:00:08:98:96:f7:2b:dc:99:a4:eb:d6:8f:21:7a:6c:9e:e5:47:d2:e9
Signer

Actual PE Digest

68:97:98:0b:71:4d:c3:d1:34:74:ec:a4:00:08:98:96:f7:2b:dc:99:a4:eb:d6:8f:21:7a:6c:9e:e5:47:d2:e9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MoveWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetDeviceCaps

advapi32

CryptContextAddRef

shell32

ord165

ole32

StringFromGUID2

oleaut32

SysStringLen

shlwapi

SHRegGetPathW

comctl32

InitCommonControlsEx

gdiplus

GdipDisposeImageAttributes

ws2_32

ioctlsocket

secur32

GetUserNameExW

version

GetFileVersionInfoW

psapi

EnumProcesses

imm32

ImmDisableIME

wtsapi32

WTSUnRegisterSessionNotification
WTSSendMessageW

winmm

timeGetDevCaps

wininet

InternetCrackUrlW

iphlpapi

GetAdaptersInfo

crypt32

CryptBinaryToStringA

wintrust

WTHelperProvDataFromStateData

msimg32

AlphaBlend

urlmon

URLDownloadToCacheFileW

Sections

.text
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 675KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx0
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.upx1
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f95f53042712dac46e00778963549755

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

68:97:98:0b:71:4d:c3:d1:34:74:ec:a4:00:08:98:96:f7:2b:dc:99:a4:eb:d6:8f:21:7a:6c:9e:e5:47:d2:e9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

ws2_32

secur32

version

psapi

imm32

wtsapi32

winmm

wininet

iphlpapi

crypt32

wintrust

msimg32

urlmon

Sections

.text Size: - Virtual size: 3.4MB

.rdata Size: - Virtual size: 675KB

.data Size: - Virtual size: 100KB

.upx0 Size: - Virtual size: 3.1MB

.upx1 Size: 6.2MB - Virtual size: 6.2MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 221KB - Virtual size: 221KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

68:97:98:0b:71:4d:c3:d1:34:74:ec:a4:00:08:98:96:f7:2b:dc:99:a4:eb:d6:8f:21:7a:6c:9e:e5:47:d2:e9
Signer

.text
Size: - Virtual size: 3.4MB

.rdata
Size: - Virtual size: 675KB

.data
Size: - Virtual size: 100KB

.upx0
Size: - Virtual size: 3.1MB

.upx1
Size: 6.2MB - Virtual size: 6.2MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 221KB - Virtual size: 221KB