4f1851ed6b0e54da3d2a05fb5405e5c0094f792a9a868b84c0ca3be59eefa2d3

Sharing

Copy URL Twitter E-mail

General

Target

4f1851ed6b0e54da3d2a05fb5405e5c0094f792a9a868b84c0ca3be59eefa2d3
Size

2.4MB
MD5

e67565094bb33eed740d80c3f98e09dd
SHA1

78b03564551ec6c2702b7f97d384991f091a933f
SHA256

4f1851ed6b0e54da3d2a05fb5405e5c0094f792a9a868b84c0ca3be59eefa2d3
SHA512

c33b539f39c3f7fc3d007eea362c6a90fc7e7c6777c14100a6b121792642c9c5dcef2f48b7806aaabbc3b62e706ee7f1607530c9e5e94f0a686c271510fd70be
SSDEEP

49152:QJgnHSJRhyxpE7lOrUoFKgdgPUAitZGl04r+Z:Q+nM77lOrHFwPUAiGo

Score

1^/10

Malware Config

Signatures

Files

4f1851ed6b0e54da3d2a05fb5405e5c0094f792a9a868b84c0ca3be59eefa2d3
.exe windows:5 windows x86 arch:x86

8966fed343e2a60750213ed38cd04aec

Code Sign

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/09/2019, 00:00

Not After

22/09/2020, 12:00

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/09/2019, 00:00

Not After

22/09/2020, 12:00

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:d3:86:da:f7:ec:2b:10:fe:ee:e0:97:40:ca:40:73:fd:16:eb:9d:e3:39:80:b1:20:17:c5:6d:65:5c:21:3b
Signer

Actual PE Digest

45:d3:86:da:f7:ec:2b:10:fe:ee:e0:97:40:ca:40:73:fd:16:eb:9d:e3:39:80:b1:20:17:c5:6d:65:5c:21:3b

Digest Algorithm

sha256

PE Digest Matches

true

55:83:5d:42:0b:5d:c9:14:a8:1b:bb:84:f9:58:52:92:34:b3:19:71
Signer

Actual PE Digest

55:83:5d:42:0b:5d:c9:14:a8:1b:bb:84:f9:58:52:92:34:b3:19:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetProcessImageFileNameW

kernel32

IsBadReadPtr
LoadLibraryA
ExpandEnvironmentStringsA
GetModuleFileNameA
ReleaseMutex
GetCommandLineW
GetCurrentProcessId
GetComputerNameExA
CreateEventW
TerminateThread
OpenProcess
GetModuleHandleA
DuplicateHandle
CreateProcessW
Sleep
CopyFileW
ExpandEnvironmentStringsW
GetLocalTime
OpenMutexW
GetFileSizeEx
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetProcessTimes
CreateMutexW
GetEnvironmentVariableW
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameW
WaitForSingleObject
SetEvent
CreateThread
SetFileAttributesW
DeleteFileW
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
CreateFileW
CloseHandle
SetErrorMode
WriteProcessMemory
GlobalAlloc
DosDateTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
MulDiv
lstrlenW
GlobalUnlock
GlobalLock
GetConsoleCP
ReadConsoleW
MultiByteToWideChar
lstrcmpiW
GetConsoleMode
GetACP
FileTimeToSystemTime
SetStdHandle
SystemTimeToTzSpecificLocalTime
LoadLibraryW
GetModuleHandleW
WideCharToMultiByte
TerminateProcess
InterlockedDecrement
GetTickCount
ExitProcess
DeleteCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
SetConsoleCtrlHandler
GetCurrentDirectoryW
WaitForSingleObjectEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetSystemInfo
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
FormatMessageW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
VerSetConditionMask
VerifyVersionInfoA
InitializeCriticalSection
SleepEx
FormatMessageA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetUnhandledExceptionFilter
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
lstrcpyW
GetFileSize
InterlockedIncrement
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetVersionExW
ResumeThread
SetThreadAffinityMask
GetVolumeInformationW
DeviceIoControl
GetSystemDirectoryW
CreateFileA
GetCurrentThread
GetComputerNameW
FindFirstFileW
WriteFile
GetFileAttributesW
SetNamedPipeHandleState
CreateNamedPipeW
DisconnectNamedPipe
ResetEvent
GetOverlappedResult
TransactNamedPipe
WaitNamedPipeW
ConnectNamedPipe
WriteConsoleW
RtlUnwind
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableA
MoveFileExW
RemoveDirectoryW

user32

GetCursorPos
SetWinEventHook
SendMessageW
GetClassNameW
GetClientRect
EnumChildWindows
EnumWindows
DestroyWindow
EnableWindow
MoveWindow
PostQuitMessage
GetWindowTextW
GetWindowPlacement
SetWindowPlacement
SetLayeredWindowAttributes
SetWindowTextW
FlashWindowEx
GetSystemMetrics
ScreenToClient
TrackMouseEvent
LoadMenuW
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
wsprintfW
ReleaseDC
ReleaseCapture
SetCapture
SetFocus
GetDC
SetWindowRgn
RegisterWindowMessageW
GetWindowRgn
UpdateLayeredWindow
PtInRect
IsRectEmpty
IntersectRect
GetSysColor
DispatchMessageW
PeekMessageW
TranslateMessage
GetWindowThreadProcessId
LoadImageW
KillTimer
SetForegroundWindow
GetWindowLongW
SetWindowLongW
SetTimer
IsWindowVisible
ShowWindow
CallWindowProcW
GetWindowRect
SetCursor
GetLastInputInfo
DefWindowProcW
LoadCursorW
RegisterClassExW
CreateWindowExW
GetDesktopWindow
GetShellWindow
MessageBoxW
GetMessageW
UpdateWindow
IsWindow
IsIconic
IsZoomed
FindWindowExW
GetMonitorInfoW
MonitorFromWindow
SetWindowPos
PostMessageW
ClientToScreen
WindowFromPoint
GetParent
CharPrevW
DrawTextW
MapWindowPoints
SetCaretPos
GetCaretBlinkTime
CreateCaret
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
IsWindowEnabled
GetWindowTextLengthW
GetKeyState
GetFocus
GetActiveWindow
CharNextW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
GetWindow
AdjustWindowRectEx
GetPropW
SetPropW
FillRect
SetRect
HideCaret
ShowCaret
GetForegroundWindow
InflateRect
UnionRect
OffsetRect
GetMenu
RegisterClassW
GetClassInfoExW
GetCaretPos

advapi32

RegOpenCurrentUser
RegQueryInfoKeyW
GetUserNameA
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
LookupAccountNameW
ConvertSidToStringSidA
EnumServicesStatusW
OpenSCManagerW
CheckTokenMembership

ole32

CoInitializeSecurity
CoSetProxyBlanket
OleLockRunning
CLSIDFromProgID
CLSIDFromString
ReleaseStgMedium
CreateStreamOnHGlobal
OleDuplicateData
RegisterDragDrop
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoInitialize
StringFromCLSID
CoCreateGuid
DoDragDrop

oleaut32

VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

StrStrW
PathFindFileNameA
PathAppendA
PathAppendW
PathRemoveFileSpecW
StrStrIW
StrCpyW
PathFindFileNameW
StrStrIA
PathFileExistsA
StrIsIntlEqualW

wininet

InternetReadFile
InternetSetOptionW
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA

imagehlp

MakeSureDirectoryPathExists

ws2_32

getsockopt
gethostname
ntohl
gethostbyname
htonl
WSAStartup
WSACleanup
WSAGetLastError
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockname
getpeername
connect
closesocket
bind
send
recv
__WSAFDIsSet
select
WSASetLastError

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301

gdi32

RestoreDC
SaveDC
CloseEnhMetaFile
CreateEnhMetaFileW
GetStockObject
GetDeviceCaps
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleBitmap
BitBlt
SelectObject
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRectRgn
PtInRegion
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
DeleteObject
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
CreateDIBSection
CreateCompatibleDC
DeleteDC
GetClipBox
MoveToEx
SetBitmapBits
GetBitmapBits
GdiFlush
TextOutW

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

gdiplus

GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipSetStringFormatTrimming
GdipCreateBitmapFromFile
GdiplusStartup
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipCreateFontFromDC
GdipCloneBrush
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdiplusShutdown
GdipDeleteBrush
GdipFree
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipCreateSolidFill

iphlpapi

GetAdaptersInfo

msimg32

AlphaBlend

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 161KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8966fed343e2a60750213ed38cd04aec

Code Sign

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

45:d3:86:da:f7:ec:2b:10:fe:ee:e0:97:40:ca:40:73:fd:16:eb:9d:e3:39:80:b1:20:17:c5:6d:65:5c:21:3bSigner

55:83:5d:42:0b:5d:c9:14:a8:1b:bb:84:f9:58:52:92:34:b3:19:71Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wininet

imagehlp

ws2_32

wldap32

gdi32

imm32

gdiplus

iphlpapi

msimg32

version

comctl32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 356KB - Virtual size: 356KB

.data Size: 161KB - Virtual size: 182KB

.gfids Size: 1KB - Virtual size: 1KB

.rsrc Size: 119KB - Virtual size: 118KB

.reloc Size: 97KB - Virtual size: 96KB

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

45:d3:86:da:f7:ec:2b:10:fe:ee:e0:97:40:ca:40:73:fd:16:eb:9d:e3:39:80:b1:20:17:c5:6d:65:5c:21:3b
Signer

55:83:5d:42:0b:5d:c9:14:a8:1b:bb:84:f9:58:52:92:34:b3:19:71
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 356KB - Virtual size: 356KB

.data
Size: 161KB - Virtual size: 182KB

.gfids
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 119KB - Virtual size: 118KB

.reloc
Size: 97KB - Virtual size: 96KB