4ba4618bce32eead38e6d188001f9fd2e6894dfe8283b9ef5040ef1e62c55a71

Sharing

Copy URL Twitter E-mail

General

Target

4ba4618bce32eead38e6d188001f9fd2e6894dfe8283b9ef5040ef1e62c55a71
Size

142KB
MD5

86f4cb8d1fe2f1be63587ef4b0f48366
SHA1

0e73c65659f2163493fab3e7bd83bfd2171aa7cd
SHA256

4ba4618bce32eead38e6d188001f9fd2e6894dfe8283b9ef5040ef1e62c55a71
SHA512

91f31a4deb266ef70f0df6da445bd667ff5bc906f7ff5ba047f6ba46cca92c6befca7f590f20d603f0c44be4391b2804c93162c49d4a859426ed143fdf4b02b0
SSDEEP

3072:qqFtQQw2m1VGNTshmcYiqVhB/P5ggJ3omYkSw:HFuQ1m1VyTshdYiyhxxEHkx

Score

1^/10

Malware Config

Signatures

Files

4ba4618bce32eead38e6d188001f9fd2e6894dfe8283b9ef5040ef1e62c55a71
.exe windows:4 windows x86 arch:x86

a9e436bc6279371b3f9f87b65e9fdb85

Code Sign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/03/2009, 11:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21/12/2009, 09:32

Not After

22/12/2020, 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4c
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

07/01/2011, 00:00

Not After

06/01/2013, 23:59

Subject

CN=厦门美图网科技有限公司,OU=产品部,O=厦门美图网科技有限公司,L=Xiamen,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:ce:64:80:86:67:d8:5e:4a:ca:41:aa:a0:35:de:87:fd:66:57:da
Signer

Actual PE Digest

b6:ce:64:80:86:67:d8:5e:4a:ca:41:aa:a0:35:de:87:fd:66:57:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord617
ord5214
ord296
ord3643
ord3584
ord696
ord543
ord394
ord803
ord5710
ord4129
ord6662
ord6418
ord2393
ord1263
ord6307
ord909
ord4167
ord521
ord5628
ord2820
ord548
ord538
ord4185
ord1166
ord4278
ord5683
ord2763
ord4204
ord939
ord6223
ord6055
ord4078
ord1776
ord4407
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord3742
ord6383
ord818
ord4275
ord6442
ord1233
ord5731
ord1871
ord1187
ord2919
ord3258
ord1265
ord2233
ord699
ord397
ord5593
ord3438
ord5590
ord912
ord4188
ord6199
ord2827
ord665
ord1979
ord5442
ord5186
ord354
ord536
ord1576
ord5440
ord2107
ord6394
ord5450
ord2841
ord3579
ord350
ord3613
ord3126
ord5651
ord3616
ord3127
ord743
ord446
ord3353
ord6143
ord1168
ord6139
ord6142
ord6140
ord6883
ord5857
ord5860
ord5858
ord5608
ord5602
ord5606
ord5603
ord4003
ord4226
ord2730
ord2727
ord2614
ord4202
ord6282
ord6283
ord2915
ord5572
ord941
ord860
ord3663
ord858
ord537
ord2764
ord924
ord800
ord823
ord535
ord540
ord2818
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3401
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord567
ord3922
ord6467
ord2729
ord290
ord541
ord287
ord500
ord341
ord614
ord801
ord610
ord2512
ord2554
ord4486
ord6375
ord5241
ord815
ord772
ord654
ord1799

msvcrt

_except_handler3
_purecall
_mbscmp
__CxxFrameHandler
memcpy
memset
atoi
_setmbcp
memmove
sprintf
rand
_splitpath
strtoul
__RTDynamicCast
atol
memcmp
strlen
_mbsicmp
_mbsstr
time
_beginthreadex
__dllonexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_onexit
_controlfp

kernel32

GetModuleHandleA
WaitForMultipleObjects
TerminateThread
SetThreadPriority
WaitForSingleObject
GetLogicalDrives
GetDriveTypeA
GetVolumeInformationA
MoveFileExA
GetShortPathNameA
GetWindowsDirectoryA
lstrcatA
CreateFileMappingA
MapViewOfFile
lstrcpyA
UnmapViewOfFile
CopyFileA
SetFileAttributesA
GetModuleFileNameA
GetTempPathA
CreateProcessA
GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
SetFilePointer
SetEndOfFile
GetVersionExA
HeapAlloc
WriteFile
GetProcessHeap
HeapFree
ResetEvent
SetEvent
CreateDirectoryA
GetFileAttributesA
CreateEventA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
GetFileSize
CloseHandle
GetComputerNameA
DeleteFileA
GetCommandLineA
CreateMutexA
GetLastError
lstrlenA
MultiByteToWideChar
GetTempFileNameA
WideCharToMultiByte
lstrlenW
GetStartupInfoA

user32

PeekMessageA
PostThreadMessageA
PostMessageA
wsprintfA
TranslateMessage
GetDesktopWindow
GetMessageA
EnableWindow
DispatchMessageA

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey
GetUserNameA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

StgCreateDocfile
StgOpenStorage
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc

wininet

InternetCloseHandle
HttpSendRequestA
InternetSetOptionA
InternetSetStatusCallback
HttpQueryInfoA
InternetErrorDlg
InternetReadFileExA
HttpAddRequestHeadersA
InternetQueryOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenA

netapi32

Netbios

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32

htonl
ntohl

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9e436bc6279371b3f9f87b65e9fdb85

Code Sign

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4cCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

b6:ce:64:80:86:67:d8:5e:4a:ca:41:aa:a0:35:de:87:fd:66:57:daSigner

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

wininet

netapi32

version

wsock32

Sections

.text Size: 92KB - Virtual size: 90KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1000B

04:00:00:00:00:01:20:19:c1:90:66
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

1e:67:58:c1:f4:25:4a:a0:28:c9:f1:3f:31:8a:cb:4c
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

b6:ce:64:80:86:67:d8:5e:4a:ca:41:aa:a0:35:de:87:fd:66:57:da
Signer

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1000B