ccdbb96947b1d80bff7ee3f407b6c652

Sharing

Copy URL

Twitter E-mail

General

Target

ccdbb96947b1d80bff7ee3f407b6c652
Size

1023KB
MD5

ccdbb96947b1d80bff7ee3f407b6c652
SHA1

5c5c5ff3d5b72eecc50276ac84a720b6decc060d
SHA256

94c53e6c7b2072e0a43760278b90abfa9dd1abcb9dea845cfca88fab9538ea7f
SHA512

5f9721cf209cc1eb86cae992cca80bfea6fb41efe86646012e2362bfc4504a6d938f7db838c07cf0f856d47298a1474122e8a3807dedac5df755ee6d6b30c1c5
SSDEEP

24576:SlF3ow4Zggv7fWA6SEn4MTEUwhmxYDJ3I4rKp6:uYB/TfWos4MTxE5W6

Score

1^/10

Malware Config

Signatures

Files

ccdbb96947b1d80bff7ee3f407b6c652
.exe windows:5 windows x86 arch:x86

9ec692bee87c6ffed3b912377dd74405

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-03-2013 00:00

Not After

05-04-2016 23:59

Subject

CN=Kingsoft Security Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=毒霸研发部,O=Kingsoft Security Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:a2:4e:5b:c9:ae:44:61:ae:85:de:ff:ef:d8:2b:95:a5:bd:2c:6a
Signer

Actual PE Digest

fa:a2:4e:5b:c9:ae:44:61:ae:85:de:ff:ef:d8:2b:95:a5:bd:2c:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

K:\liebao_src_pool\release.branch_73\src_import\build\Release\DesktopTips.pdb

Imports

psapi

GetModuleFileNameExW

kernel32

SetLastError
MulDiv
lstrcmpW
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
TerminateProcess
WaitForSingleObject
CreateThread
Sleep
CreateDirectoryW
FindClose
LockResource
GetLongPathNameW
FindResourceExW
GetFullPathNameW
GetCurrentThread
GetTempFileNameW
GetCommandLineW
ReplaceFileW
GetCurrentDirectoryW
MoveFileW
RemoveDirectoryW
GetFileAttributesExW
GetVolumeInformationW
InterlockedExchangeAdd
IsDebuggerPresent
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
GetFileInformationByHandle
InterlockedCompareExchange
SetEvent
ResetEvent
CreateEventW
WaitForMultipleObjects
CreateMutexW
VirtualQuery
DuplicateHandle
ReleaseMutex
GetStdHandle
OutputDebugStringA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GlobalUnlock
GetCurrentProcess
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetQueuedCompletionStatus
InterlockedExchange
PostQueuedCompletionStatus
CreateIoCompletionPort
GetNativeSystemInfo
GetModuleHandleExW
GetModuleHandleExA
RegisterWaitForSingleObject
UnregisterWaitEx
GetUserDefaultLangID
ConnectNamedPipe
CreateNamedPipeW
CancelIo
GetNamedPipeInfo
InitializeCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
GetTempPathA
DeleteFileA
GetComputerNameA
GetLocalTime
GetDiskFreeSpaceExW
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
SetEnvironmentVariableA
GetDriveTypeW
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetFileType
SetStdHandle
AreFileApisANSI
ExitProcess
ExitThread
VirtualAlloc
IsProcessorFeaturePresent
RtlUnwind
EncodePointer
GetStringTypeW
FlushInstructionCache
GlobalLock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
GetVersionExW
FindNextFileW
FindFirstFileW
GetFileAttributesW
OutputDebugStringW
GetStartupInfoW
CreateProcessW
GetTickCount
GetExitCodeProcess
GetCurrentProcessId
OpenProcess
LocalFree
MultiByteToWideChar
FindResourceW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryW
LoadLibraryW
lstrlenW
FreeLibrary
DeleteFileW
CreateFileW
GetModuleHandleW
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
SetFilePointer
ReadFile
WriteFile
GetFileSize
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetCurrentThreadId
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
DecodePointer
QueryPerformanceFrequency
VirtualFree

user32

FindWindowW
FindWindowA
GetAncestor
wsprintfW
UnregisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
DestroyWindow
GetDesktopWindow
MonitorFromWindow
GetMonitorInfoW
ShowWindow
AnimateWindow
SetLayeredWindowAttributes
MoveWindow
PtInRect
SetRect
UpdateWindow
PostMessageW
LoadCursorW
GetWindow
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetClientRect
RedrawWindow
InvalidateRgn
MessageBoxW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
WaitMessage
KillTimer
PostQuitMessage
SetTimer
SetCursor
MapWindowPoints
LoadImageW
GetWindowDC
SetWindowTextW
GetWindowPlacement
OffsetRect
UpdateLayeredWindow
CreateDialogParamW
CharNextW
InvalidateRect
EndPaint
BeginPaint
SetWindowPos
IsIconic
IsZoomed
MsgWaitForMultipleObjects
GetSystemMetrics
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetCursorPos
WindowFromPoint
GetWindowLongW
SetWindowLongW
GetParent
SetParent
FindWindowExW
GetClassNameW
GetWindowThreadProcessId
SendMessageW
GetQueueStatus
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
IsChild
GetDlgItem
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC

gdi32

DeleteDC
DeleteObject
GetDeviceCaps
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
SelectObject
GetObjectW
GetObjectA
CreateDIBSection
BitBlt

advapi32

RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
CommandLineToArgvW

ole32

CoInitialize
CoUninitialize
CoCreateGuid
CoInitializeEx
CoGetMalloc
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysStringLen
LoadTypeLi
LoadRegTypeLi
VariantClear
OleCreateFontIndirect
VariantCopy
VariantInit
SysFreeString
SysAllocString
SysAllocStringLen
VarUI4FromStr
DispCallFunc

shlwapi

ord12
PathRemoveExtensionW
PathAppendW
PathRemoveFileSpecW
PathCombineW
SHSetValueA
PathRemoveFileSpecA
SHGetValueW
SHSetValueW
PathFindFileNameA
SHGetValueA

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipDeleteStringFormat
GdipCreateStringFormat
GdipGraphicsClear
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDrawString
GdipSetTextRenderingHint
GdipCreateBitmapFromScan0
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipRestoreGraphics
GdipSetClipRectI
GdipTranslateWorldTransform
GdipLoadImageFromStream
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipDrawImageRectRectI
GdipGetImageHeight
GdipSaveGraphics

urlmon

CoInternetGetSession

oleacc

AccessibleChildren
AccessibleObjectFromWindow
GetRoleTextW

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoW

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

iphlpapi

GetAdaptersInfo

ws2_32

inet_addr

Sections

.text
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ec692bee87c6ffed3b912377dd74405

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fa:a2:4e:5b:c9:ae:44:61:ae:85:de:ff:ef:d8:2b:95:a5:bd:2c:6aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

urlmon

oleacc

version

winmm

iphlpapi

ws2_32

Sections

.text Size: 598KB - Virtual size: 597KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 16KB - Virtual size: 29KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 268KB - Virtual size: 267KB

.reloc Size: 26KB - Virtual size: 25KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fa:a2:4e:5b:c9:ae:44:61:ae:85:de:ff:ef:d8:2b:95:a5:bd:2c:6a
Signer

.text
Size: 598KB - Virtual size: 597KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 16KB - Virtual size: 29KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 268KB - Virtual size: 267KB

.reloc
Size: 26KB - Virtual size: 25KB