e0cfba0ff083d9b243e56755e4064a8d22f0458b9d2f60fd51da578cabf02d9d

Sharing

Copy URL Twitter E-mail

General

Target

e0cfba0ff083d9b243e56755e4064a8d22f0458b9d2f60fd51da578cabf02d9d
Size

663KB
MD5

821340173ba7f8485395368f29c956ff
SHA1

efea83503472e78a486b1725124106e12b1fc729
SHA256

e0cfba0ff083d9b243e56755e4064a8d22f0458b9d2f60fd51da578cabf02d9d
SHA512

df93b42c885d6810ec7ea85b30651a9932d29408cb70b946e3c0428569c0ea844d3c3912175cb1024891975ffe33e0c7272874c797aecb72fd984665adbd7afb
SSDEEP

6144:hATO5/Ab7yXF5Ai9ieHp+0uY0UF0TOwV4LMhhzj3kPhlS2izE4SW1:hATO5/dXFyi9vHHtT0hhhz6ns

Score

1^/10

Malware Config

Signatures

Files

e0cfba0ff083d9b243e56755e4064a8d22f0458b9d2f60fd51da578cabf02d9d
.exe windows:5 windows x86 arch:x86

3c0a03126badeef198c457ea9a980f03

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:83:1e:85:5b:dd:a6:0b:82:60:56:04
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

30/08/2022, 02:52

Not After

25/11/2025, 03:35

Subject

CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,OU=BPIT,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:83:1e:85:5b:dd:a6:0b:82:60:56:04
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

30/08/2022, 02:52

Not After

25/11/2025, 03:35

Subject

CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,OU=BPIT,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:1e:00:a9:f2:9f:bd:a0:ce:c4:08:c0:cd:01:a0:ac:ab:e0:58:18:48:eb:60:b1:dc:2a:d6:55:74:4e:9a:63
Signer

Actual PE Digest

5d:1e:00:a9:f2:9f:bd:a0:ce:c4:08:c0:cd:01:a0:ac:ab:e0:58:18:48:eb:60:b1:dc:2a:d6:55:74:4e:9a:63

Digest Algorithm

sha256

PE Digest Matches

false

3b:b0:f1:41:6e:f2:1e:47:80:58:ec:66:37:df:20:4c:a6:48:b6:13
Signer

Actual PE Digest

3b:b0:f1:41:6e:f2:1e:47:80:58:ec:66:37:df:20:4c:a6:48:b6:13

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\code\pinyin-pc\Basic\Outputs\Release\BDImeTips.pdb

Imports

wininet

InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW

imm32

ImmDisableIME

configure

ReleaseConfigInst
GetConfigureInst

kernel32

QueryPerformanceCounter
LoadLibraryExW
FlushFileBuffers
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
ExitProcess
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
GetFileAttributesExW
EncodePointer
GetStringTypeW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
CreateFileMappingW
DecodePointer
HeapSize
GetProcessHeap
HeapFree
HeapAlloc
HeapReAlloc
GetFileSize
MoveFileW
GetTempPathW
MulDiv
WideCharToMultiByte
GetFileAttributesW
UnmapViewOfFile
ProcessIdToSessionId
GetPrivateProfileIntW
GetSystemTimeAsFileTime
OpenFileMappingW
MapViewOfFile
GetTickCount
FlushInstructionCache
RaiseException
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetModuleHandleW
GetPrivateProfileStringW
CreateProcessW
GlobalMemoryStatusEx
GetCurrentThreadId
GetCommandLineW
GetModuleFileNameW
AddVectoredExceptionHandler
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
RemoveVectoredExceptionHandler
ReadFile
WriteFile
GetOverlappedResult
SetEvent
SetNamedPipeHandleState
CreateFileW
CreateEventW
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetLastError
SetErrorMode
ReleaseMutex
CloseHandle
CreateMutexW
Sleep
LocalAlloc
LocalFree
WaitForSingleObject
FreeLibrary
GetVersionExW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleHandleExW

user32

ReleaseDC
GetDC
DefWindowProcW
SetWindowLongW
GetWindowLongW
IsWindow
DestroyWindow
CreateWindowExW
UpdateLayeredWindow
TrackMouseEvent
SetCapture
ReleaseCapture
KillTimer
SendMessageW
RegisterClassExW
GetClassInfoExW
SetWinEventHook
WaitForInputIdle
LoadCursorW
SetCursor
IsWindowVisible
IsIconic
PeekMessageW
PostMessageW
FindWindowExW
GetDesktopWindow
CloseDesktop
OpenDesktopW
CharNextW
UnhookWinEvent
GetMessageW
CallWindowProcW
BringWindowToTop
MoveWindow
PtInRect
ClientToScreen
ShowWindow
FindWindowW
GetWindow
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostQuitMessage
SetTimer
GetKeyState
MonitorFromWindow
UnregisterClassW
DispatchMessageW
TranslateMessage
GetWindowRect

gdi32

GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection

advapi32

AllocateAndInitializeSid
SetEntriesInAclW
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptSetKeyParam
CryptDecrypt
CryptDestroyKey
CryptImportKey
CryptReleaseContext
CryptAcquireContextW
GetSecurityDescriptorDacl
RegSetKeySecurity
RegGetKeySecurity
RegSetValueExW
RegCreateKeyExW
ConvertStringSidToSidW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
InitializeSecurityDescriptor

shell32

ord51
SHGetFolderPathW
ord165
ShellExecuteW

ole32

CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathAppendW
AssocQueryStringW
PathRemoveFileSpecW

basicnetutils

?ReleaseHttpClientInDefaultManager@basic_net@@YAHPAVIHttpClient@1@@Z
?CreateHttpClientInDefaultManager@basic_net@@YAPAVIHttpClient@1@XZ

crypt32

CertGetNameStringW
CertNameToStrW

imagehlp

ImageGetCertificateHeader

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3c0a03126badeef198c457ea9a980f03

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

61:83:1e:85:5b:dd:a6:0b:82:60:56:04Certificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

61:83:1e:85:5b:dd:a6:0b:82:60:56:04Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

5d:1e:00:a9:f2:9f:bd:a0:ce:c4:08:c0:cd:01:a0:ac:ab:e0:58:18:48:eb:60:b1:dc:2a:d6:55:74:4e:9a:63Signer

3b:b0:f1:41:6e:f2:1e:47:80:58:ec:66:37:df:20:4c:a6:48:b6:13Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

imm32

configure

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

basicnetutils

crypt32

imagehlp

wintrust

version

Sections

.text Size: 318KB - Virtual size: 317KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 13KB - Virtual size: 26KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 249KB - Virtual size: 249KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

61:83:1e:85:5b:dd:a6:0b:82:60:56:04
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

61:83:1e:85:5b:dd:a6:0b:82:60:56:04
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

5d:1e:00:a9:f2:9f:bd:a0:ce:c4:08:c0:cd:01:a0:ac:ab:e0:58:18:48:eb:60:b1:dc:2a:d6:55:74:4e:9a:63
Signer

3b:b0:f1:41:6e:f2:1e:47:80:58:ec:66:37:df:20:4c:a6:48:b6:13
Signer

.text
Size: 318KB - Virtual size: 317KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 13KB - Virtual size: 26KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 249KB - Virtual size: 249KB