cbe17aa142def58f1db6a378d533b753

Sharing

Copy URL Twitter E-mail

General

Target

cbe17aa142def58f1db6a378d533b753
Size

945KB
MD5

cbe17aa142def58f1db6a378d533b753
SHA1

d4c4215db0cef90336fe109dde15b71a20fbe9cb
SHA256

fa9ec84de58a682bbf1a8142c3c8833a5e8e36e360642eececaad459353c34ae
SHA512

87e6db2b82ce8c597a470c63cf87974303d3dc42847f4f738239205950f46892189c00cb6e5af9a22b230a714ff658a810f7760ebe7c784eed176db4b2eb1c01
SSDEEP

24576:OMJT0KeWPrYxgrYU1MxWiYj+m4pws0+O+uLFsmcMkH31:MWDc7U1Jj+m4pwshEncR31

Score

1^/10

Malware Config

Signatures

Files

cbe17aa142def58f1db6a378d533b753
.exe windows:5 windows x86 arch:x86

0da37cbca5d869ce3501a669ad509a77

Code Sign

04:44:c0
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

22/10/2008, 12:07

Not After

31/12/2029, 12:07

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:ae
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

09/11/2016, 08:45

Not After

09/11/2026, 08:45

Subject

CN=WoSign Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:ca:80:4b:b8:37:35:bd:12:16:23:40:c7:b5:da:99
Certificate

Issuer

CN=WoSign Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

27/02/2018, 07:04

Not After

27/02/2019, 07:04

Subject

CN=江西贪玩信息技术有限公司,O=江西贪玩信息技术有限公司,L=上饶市,ST=江西省,C=CN,1.2.840.113549.1.9.1=#0c136c6979696d696e674074616e77616e2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:00:f6:f0:4b:64:cc:3c:d0:de:8e:be:b2:37:b7:96:5a:b4:f4:bc:02:d3:17:03:0a:53:7d:94:11:44:40:5b
Signer

Actual PE Digest

27:00:f6:f0:4b:64:cc:3c:d0:de:8e:be:b2:37:b7:96:5a:b4:f4:bc:02:d3:17:03:0a:53:7d:94:11:44:40:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\source\tanwan\MicroGame\WebGame(传世)官网\Release\twcs.pdb

Imports

kernel32

GetVersionExW
WritePrivateProfileStringW
InterlockedExchangeAdd
GetLastError
CreateMutexW
GetModuleFileNameW
GetCommandLineW
GetSystemTime
FindClose
WriteFile
WideCharToMultiByte
MultiByteToWideChar
SystemTimeToFileTime
CloseHandle
DecodePointer
HeapSize
WriteConsoleW
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
CreateFileW
GetCurrentThreadId
CreateThread
GetPrivateProfileStringW
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetProcessHeap
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
lstrlenW
FindNextFileW
FindFirstFileExW
RtlUnwind
RaiseException
LoadLibraryW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
GetCurrentThread
EncodePointer
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
SetEvent
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
Sleep
CreateEventW
SetLastError
QueryPerformanceCounter
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GetTickCount
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock

user32

SetWindowLongW
PostMessageW
DestroyWindow
RegisterClassExW
MapWindowPoints
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
SendMessageW
CopyIcon
DestroyIcon
SetWindowRgn
GetMonitorInfoW
MonitorFromWindow
EndPaint
BeginPaint
GetUpdateRect
ReleaseDC
GetDC
ReleaseCapture
SetCapture
ScreenToClient
TrackMouseEvent
EqualRect
SetRect
PtInRect
IntersectRect
LoadCursorW
SetCursor
DefWindowProcW
GetWindowLongW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
InvalidateRect
SetFocus
MessageBoxW
RegisterHotKey
SystemParametersInfoW
SetTimer
IsWindowVisible
KillTimer
GetCursorPos
SwitchToThisWindow
SetWindowPos
LoadIconW
PostThreadMessageW
IsZoomed
GetParent
wsprintfW
CopyRect
GetClassNameW
GetWindowTextW
GetWindowThreadProcessId
EnumChildWindows
GetClientRect
SetForegroundWindow
DialogBoxParamW
IsWindow
GetWindowRect
ShowWindow
SetActiveWindow
MoveWindow
GetSystemMetrics

shell32

Shell_NotifyIconW
ShellExecuteW

ole32

OleInitialize
OleUninitialize
OleCreate
CreateStreamOnHGlobal
StgCreateDocfile

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
SafeArrayCreate
SafeArrayAccessData
SafeArrayDestroy

iphlpapi

GetAdaptersInfo

wininet

HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
HttpAddRequestHeadersA
InternetReadFile
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
InternetOpenA
InternetCrackUrlA
InternetConnectA

gdiplus

GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromScan0
GdipCreateTextureIA
GdipGetImageGraphicsContext
GdipLoadImageFromStreamICM
GdipAlloc
GdipFree
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipDrawPath
GdipAddPathArcI
GdipAddPathLineI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipDrawString
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipDeleteFont
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipFillRectangleI
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipDrawLinesI
GdipMeasureString
GdipDrawRectangleI
GdiplusStartup
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesWrapMode
GdipDrawImageRectRectI

gdi32

CreateCompatibleBitmap
SetBkMode
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
DeleteDC
CreateDIBSection
CreatePolygonRgn
CreateRectRgn

Sections

.text
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 577KB - Virtual size: 577KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0da37cbca5d869ce3501a669ad509a77

Code Sign

04:44:c0Certificate

Key Usages

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47Certificate

Extended Key Usages

Key Usages

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:aeCertificate

Extended Key Usages

Key Usages

73:ca:80:4b:b8:37:35:bd:12:16:23:40:c7:b5:da:99Certificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0eCertificate

Extended Key Usages

Key Usages

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47Certificate

Extended Key Usages

Key Usages

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0eCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

27:00:f6:f0:4b:64:cc:3c:d0:de:8e:be:b2:37:b7:96:5a:b4:f4:bc:02:d3:17:03:0a:53:7d:94:11:44:40:5bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

oleaut32

iphlpapi

wininet

gdiplus

gdi32

Sections

.text Size: 252KB - Virtual size: 251KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 11KB - Virtual size: 15KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 577KB - Virtual size: 577KB

.reloc Size: 16KB - Virtual size: 16KB

04:44:c0
Certificate

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

17:ef:72:b4:15:7d:6f:4b:68:e4:bd:d5:75:e5:cc:ae
Certificate

73:ca:80:4b:b8:37:35:bd:12:16:23:40:c7:b5:da:99
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

27:00:f6:f0:4b:64:cc:3c:d0:de:8e:be:b2:37:b7:96:5a:b4:f4:bc:02:d3:17:03:0a:53:7d:94:11:44:40:5b
Signer

.text
Size: 252KB - Virtual size: 251KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 11KB - Virtual size: 15KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 577KB - Virtual size: 577KB

.reloc
Size: 16KB - Virtual size: 16KB