357b7a3af0b1858ce7cd035c1701f01b41cc4144099d20d4fc44ccb0d492aa84

Sharing

Copy URL Twitter E-mail

General

Target

357b7a3af0b1858ce7cd035c1701f01b41cc4144099d20d4fc44ccb0d492aa84
Size

2.3MB
MD5

48ee98ac1034648e5271922dae7779b9
SHA1

b77cb0c91e8d3869bac1e65b83980754858befb5
SHA256

357b7a3af0b1858ce7cd035c1701f01b41cc4144099d20d4fc44ccb0d492aa84
SHA512

35e693725f7ce9a429b58c074af4ba02399389001bc807301af89aef927b65a08d692e9f01349da8c3f1e5c778af56d2f441496569576d48297b0b22fb3e9152
SSDEEP

49152:8Mz9Pyl634lkRebpmlkFti54ktauZF2mV9bdawjqxpdSoeGogoL/ef+3iS:8MzZyl63VlkFGFfV90sqx9oF5SS

Score

1^/10

Malware Config

Signatures

Files

357b7a3af0b1858ce7cd035c1701f01b41cc4144099d20d4fc44ccb0d492aa84
.dll windows:4 windows x86 arch:x86

1420547eea1076277499aa0e5c873b00

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:8b:04:26:2b:50:f1:1f:46:2f:41:e9
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

30/04/2020, 01:26

Not After

30/07/2023, 01:26

Subject

CN=RayShare Co.\,Ltd,O=RayShare Co.\,Ltd,L=Beijing,ST=Beijing,C=CN,1.2.840.113549.1.9.1=#0c1572617973686172656c746440676d61696c2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c6:b8:e1:2d:13:c0:f3:9d:c4:35:b2:fe:d4:d7:90:88:5d:07:86:e9:be:bd:d5:00:c5:70:32:96:03:5f:57:a7
Signer

Actual PE Digest

c6:b8:e1:2d:13:c0:f3:9d:c4:35:b2:fe:d4:d7:90:88:5d:07:86:e9:be:bd:d5:00:c5:70:32:96:03:5f:57:a7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Imports

libvlccore

aout_ChannelReorder
aout_CheckChannelReorder
block_Alloc
config_GetUserDir
es_format_Init
var_Inherit
vlc_Log
vlc_b64_decode_binary
vlc_global_mutex
vlc_path2uri
vlc_stream_Delete
vlc_stream_NewURL
xml_ReaderCreate
xml_ReaderDelete

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateDirectoryA
CreateEventA
CreateFileA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FreeLibrary
GetACP
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExA
GetFileAttributesA
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetProcessWorkingSetSize
GetStartupInfoA
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GlobalMemoryStatus
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
OutputDebugStringA
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
ResetEvent
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
__doserrno
__mb_cur_max
__pioinfo
_amsg_exit
_errno
_exit
_filelengthi64
_fileno
_findclose
_findfirst
_fstat64
_fullpath
_getcwd
_initterm
_iob
_lock
_lseeki64
_mkdir
_onexit
_open_osfhandle
_rmdir
_snwprintf
time
_stricmp
_strnicmp
_unlink
_unlock
calloc
clock
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
getwc
isalnum
iscntrl
isprint
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbtowc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
raise
realloc
setlocale
setvbuf
sprintf
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
_vsnprintf
_write
abort
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcscpy
wcsftime
wcslen
wcsxfrm
wctomb
atoi
atol
_stati64
_fstat
_findnext
_write
_stricmp
_strdup
_setmode
_read
_open
_getpid
_fileno
_fdopen
_close
_access

user32

GetActiveWindow
GetCapture
GetCaretPos
GetClipboardOwner
GetClipboardViewer
GetCursorPos
GetDesktopWindow
GetFocus
GetInputState
GetMessagePos
GetMessageTime
GetOpenClipboardWindow
GetProcessWindowStation
MessageBoxW

Exports

Exports

vlc_entry__3_0_0f
vlc_entry_copyright__3_0_0f
vlc_entry_license__3_0_0f

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1420547eea1076277499aa0e5c873b00

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

2c:8b:04:26:2b:50:f1:1f:46:2f:41:e9Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

c6:b8:e1:2d:13:c0:f3:9d:c4:35:b2:fe:d4:d7:90:88:5d:07:86:e9:be:bd:d5:00:c5:70:32:96:03:5f:57:a7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libvlccore

advapi32

kernel32

msvcrt

user32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.data Size: 13KB - Virtual size: 12KB

.rdata Size: 240KB - Virtual size: 239KB

.buildid Size: 512B - Virtual size: 53B

.bss Size: - Virtual size: 129KB

.edata Size: 512B - Virtual size: 160B

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 73KB - Virtual size: 72KB

/4 Size: 512B - Virtual size: 28B

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

2c:8b:04:26:2b:50:f1:1f:46:2f:41:e9
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c6:b8:e1:2d:13:c0:f3:9d:c4:35:b2:fe:d4:d7:90:88:5d:07:86:e9:be:bd:d5:00:c5:70:32:96:03:5f:57:a7
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 13KB - Virtual size: 12KB

.rdata
Size: 240KB - Virtual size: 239KB

.buildid
Size: 512B - Virtual size: 53B

.bss
Size: - Virtual size: 129KB

.edata
Size: 512B - Virtual size: 160B

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 73KB - Virtual size: 72KB

/4
Size: 512B - Virtual size: 28B