a24e926c7d8edf9fa15299a967417412dd0ad0a640ea1a247d21593462bfbb0e

Sharing

Copy URL Twitter E-mail

General

Target

a24e926c7d8edf9fa15299a967417412dd0ad0a640ea1a247d21593462bfbb0e
Size

2.1MB
MD5

888bd9226c77024083e364398c47464d
SHA1

619bfecba614881e384ec4bf4cb1df36dd1f7911
SHA256

a24e926c7d8edf9fa15299a967417412dd0ad0a640ea1a247d21593462bfbb0e
SHA512

8d1dbcc02b60119f6f58bcc1af9d559dce812d73a82e33af6b9742af9bec323b54497a5d6e1785812cc1a512f442d4e18fbfe0d5e74fbc905710da722f224b5b
SSDEEP

24576:6sryGvrWMsUlv+lC3jZwECQZRpV8amGmVxtUlv2CMFRRT:6sWyylQ/CORsxpxtUBFuRRT

Score

1^/10

Malware Config

Signatures

Files

a24e926c7d8edf9fa15299a967417412dd0ad0a640ea1a247d21593462bfbb0e
.dll windows:5 windows x86 arch:x86

0eb230ab3a32aa72f1845409e220836b

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

cf:b2:b9:4e:e5:c1:bc:6a:b4:a5:96:49:86:9f:68:6d:5e:03:80:58:24:cf:1a:97:e4:49:d9:5c:4b:ea:f3:5d
Signer

Actual PE Digest

cf:b2:b9:4e:e5:c1:bc:6a:b4:a5:96:49:86:9f:68:6d:5e:03:80:58:24:cf:1a:97:e4:49:d9:5c:4b:ea:f3:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\webview\WebView\webview\Release\WebView.pdb

Imports

kernel32

FindResourceExW
GetTempPathW
GetTempFileNameW
CreateFileW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
MultiByteToWideChar
GetCurrentThreadId
OutputDebugStringA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
CreateEventW
RegisterWaitForSingleObject
UnregisterWait
GetCurrentProcessId
GetFileSizeEx
GetLocalTime
FreeLibrary
FindResourceW
CreateMutexW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
CreateProcessW
GetCommandLineW
RtlCaptureStackBackTrace
GetTickCount
CloseHandle
GetFileTime
SizeofResource
LoadResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
WriteConsoleW
SetEndOfFile
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
OutputDebugStringW
GetModuleHandleW
GetModuleFileNameW
ReleaseMutex
LoadLibraryW
RaiseException
GetExitCodeProcess
OpenProcess
GetProcessHeap
HeapSize
HeapFree
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetFileAttributesExW
CreateProcessA
GetACP
GetStringTypeW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
LockResource
DecodePointer
DuplicateHandle
SetProcessAffinityMask
VirtualProtect
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FormatMessageW
LoadLibraryExW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadFile
SetFilePointer
WriteFile
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedExchangeAdd
LocalFree
InitializeCriticalSectionEx
ConnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForMultipleObjectsEx
CreateSemaphoreW
DisconnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetFileSize
FlushFileBuffers
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
ResetEvent

user32

UnregisterClassW
SendMessageW
SendMessageTimeoutW
PostMessageW
DefWindowProcW
CallWindowProcW
CopyRect
WaitForInputIdle
LoadCursorW
FindWindowW
SetWindowLongW
GetWindowLongW
SetWindowTextW
DestroyWindow
IsWindow
wsprintfW
CreateWindowExW
GetClassInfoExW
RegisterClassExW

gdi32

GetTextExtentPoint32W
GetStockObject
DeleteObject
SelectObject

advapi32

CryptSetKeyParam
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
CryptAcquireContextW
CryptContextAddRef

shell32

ShellExecuteW
SHGetFolderPathA
ShellExecuteExW
SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

ole32

StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize

oleaut32

SysFreeString

shlwapi

PathFindExtensionW
PathFindExtensionA
PathCompactPathW
PathCombineW
SHGetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathCanonicalizeW
PathAppendW
StrStrIA
StrStrIW
PathIsRootW
PathIsRelativeW
PathIsDirectoryW
PathAppendA
PathFindFileNameA

psapi

GetModuleFileNameExW
EnumProcessModules

urlmon

URLDownloadToCacheFileW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Exports

Exports

CreateMultiTabWebView
CreateMultiTabWebViewEx
GetWebViewFactory
IWebViewToIWebViewEx
IsSupportedWebViewEngine

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 352KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0eb230ab3a32aa72f1845409e220836b

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

cf:b2:b9:4e:e5:c1:bc:6a:b4:a5:96:49:86:9f:68:6d:5e:03:80:58:24:cf:1a:97:e4:49:d9:5c:4b:ea:f3:5dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

urlmon

version

crypt32

wintrust

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 352KB - Virtual size: 351KB

.data Size: 25KB - Virtual size: 32KB

.idata Size: 9KB - Virtual size: 9KB

.shared Size: 512B - Virtual size: 260B

.00cfg Size: 512B - Virtual size: 260B

.tls Size: 1024B - Virtual size: 777B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 62KB - Virtual size: 61KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

cf:b2:b9:4e:e5:c1:bc:6a:b4:a5:96:49:86:9f:68:6d:5e:03:80:58:24:cf:1a:97:e4:49:d9:5c:4b:ea:f3:5d
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 352KB - Virtual size: 351KB

.data
Size: 25KB - Virtual size: 32KB

.idata
Size: 9KB - Virtual size: 9KB

.shared
Size: 512B - Virtual size: 260B

.00cfg
Size: 512B - Virtual size: 260B

.tls
Size: 1024B - Virtual size: 777B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 62KB - Virtual size: 61KB