b0d2fbe4a6069c1e6d9cfb218188c10b007167afa801344f1f49b75176771389

Sharing

Copy URL Twitter E-mail

General

Target

b0d2fbe4a6069c1e6d9cfb218188c10b007167afa801344f1f49b75176771389
Size

1.6MB
MD5

6f881a041c82eb80ddef564391caf055
SHA1

b10f6a2a3b92e40c9251693a3e8342c3a5a806a0
SHA256

b0d2fbe4a6069c1e6d9cfb218188c10b007167afa801344f1f49b75176771389
SHA512

239cd2a6ef297bdfa08aad5a68399f656979e08e107059d0a2e5a2e9eb455b7108450983d2b6e5d7285641a9ab455a6752e4ab7f10d50df249283b6c3eae7767
SSDEEP

12288:CM+xhrRp9ch4MxNhD+H3serbSBbhoi9pUI35ei8+76TPnpyx4ltJ86g5Z:0XgHx3h+bqoinJhv6Tfc4e6

Score

1^/10

Malware Config

Signatures

Files

b0d2fbe4a6069c1e6d9cfb218188c10b007167afa801344f1f49b75176771389
.exe windows:4 windows x86 arch:x86

2076454e3bc2f7af010726663900cf84

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:9b:b5:7b:3b:ff:32:f7:bc:dd:23:43:2f:1c:f1:75:a0:33:36:a4:65:53:a2:cb:1f:04:64:61:70:3c:7c:7b
Signer

Actual PE Digest

3f:9b:b5:7b:3b:ff:32:f7:bc:dd:23:43:2f:1c:f1:75:a0:33:36:a4:65:53:a2:cb:1f:04:64:61:70:3c:7c:7b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetWindowsDirectoryW
VirtualFree
VirtualAlloc
FormatMessageW
InterlockedCompareExchange
FlushFileBuffers
CreateFileA
InterlockedIncrement
OutputDebugStringW
InterlockedDecrement
GetDiskFreeSpaceExW
GetExitCodeThread
SleepEx
DuplicateHandle
TerminateThread
SetEnvironmentVariableA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
GetFullPathNameA
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryW
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStartupInfoA
GetStdHandle
SetHandleCount
HeapCreate
GetConsoleMode
GetConsoleCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
ExitProcess
GetModuleHandleA
GetSystemTimeAsFileTime
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
LoadLibraryA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetFileSize
CreateMutexW
RaiseException
GetModuleFileNameW
InterlockedExchange
LeaveCriticalSection
GetPrivateProfileIntW
EnterCriticalSection
SetLastError
GetCurrentThreadId
GetCommandLineW
GetPrivateProfileStringW
GetCurrentProcess
OpenProcess
RemoveDirectoryW
FindNextFileW
WaitForMultipleObjects
GetModuleFileNameA
SetFilePointer
SetEndOfFile
ResetEvent
SetEvent
CreateThread
CreateEventW
CopyFileW
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
QueryDosDeviceW
GetLogicalDriveStringsW
MoveFileW
ExpandEnvironmentStringsW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
ReleaseMutex
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
FlushInstructionCache
GetFileType
FreeResource
FreeLibrary
MultiByteToWideChar
WriteFile
lstrlenA
ReadFile
Sleep
WaitForSingleObject
FindClose
FindFirstFileW
GetStartupInfoW
DeleteFileW
FindResourceW
GetSystemDefaultLangID
GetLastError
GetVersionExW
GetSystemInfo
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
lstrlenW
GetSystemDirectoryW
CloseHandle
FileTimeToSystemTime
CreateFileW
FindResourceExW
LoadResource
LockResource
SizeofResource

user32

IsDialogMessageW
SetRectEmpty
IsChild
GetFocus
CallWindowProcW
GetDlgItem
GetParent
CreateWindowExW
SetWindowLongW
SetForegroundWindow
AttachThreadInput
LoadImageW
ReleaseCapture
UnionRect
SetCursor
PtInRect
SetActiveWindow
CopyRect
GetDesktopWindow
GetWindowLongW
DestroyWindow
DefWindowProcW
LoadCursorW
RegisterClassExW
IsWindow
IntersectRect
GetClientRect
GetWindow
PostMessageW
MapWindowPoints
SendMessageW
IsWindowEnabled
RegisterWindowMessageW
SetWindowPos
GetClassInfoExW
FindWindowW
InvalidateRect
GetActiveWindow
EnableWindow
GetDC
GetWindowThreadProcessId
GetForegroundWindow
ReleaseDC
SystemParametersInfoW
MoveWindow
ExitWindowsEx
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetRect
EndPaint
SetFocus
BeginPaint
GetNextDlgTabItem
ClientToScreen
KillTimer
MonitorFromWindow
GetDlgCtrlID
InflateRect
GetMonitorInfoW
LoadIconW
DestroyIcon
OffsetRect
ShowWindow
IsRectEmpty
SetCapture
GetCursorPos
EqualRect
ScreenToClient
DrawTextW
UpdateLayeredWindow
DrawFrameControl
IsWindowVisible
SetTimer
DrawIconEx
GetWindowRect
UnregisterClassA

gdi32

CombineRgn
GetClipRgn
CreateRectRgn
SetViewportOrgEx
GetViewportOrgEx
BitBlt
DeleteDC
GetTextColor
ExtTextOutW
GetCurrentObject
SetBkColor
SelectObject
CreateCompatibleDC
SelectClipRgn
SetBkMode
RestoreDC
ExtSelectClipRgn
CreateRoundRectRgn
CreateFontIndirectW
GetStockObject
RectInRegion
OffsetRgn
GetObjectW
CreateRectRgnIndirect
GetTextExtentPoint32W
LineTo
MoveToEx
TextOutW
CreatePen
SetTextColor
RoundRect
Rectangle
GetDeviceCaps
DeleteObject
SaveDC
CreateDIBSection

advapi32

RegOpenKeyExA
RegCreateKeyExW
RegOpenKeyW
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW

shlwapi

StrToIntA
PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW
StrToIntW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

gdiplus

GdiplusStartup
GdipGetFontCollectionFamilyList
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipTranslateWorldTransform
GdipMeasureString
GdipResetWorldTransform
GdipDrawString
GdipSetInterpolationMode
GdipSetImageAttributesColorMatrix
GdipPrivateAddFontFile
GdipRotateWorldTransform
GdipDeletePrivateFontCollection
GdipFillPath
GdipDisposeImageAttributes
GdipSetTextRenderingHint
GdipCreateImageAttributes
GdipAddPathArcI
GdipDisposeImage
GdipSetPixelOffsetMode
GdipFillRectangleI
GdipGetImageHeight
GdipFillRectangle
GdipSetPenMode
GdipGetImageWidth
GdipGraphicsClear
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipClosePathFigure
GdipAlloc
GdipCreateFromHDC
GdipCloneImage
GdipDrawPath
GdipDeletePath
GdipSetPenEndCap
GdipLoadImageFromFile
GdipSetPenStartCap
GdipSetClipPath
GdipCreateSolidFill
GdipCreatePath
GdipGetFontSize
GdipDeletePen
GdipCloneBrush
GdipDrawRectangleI
GdipDeleteBrush
GdipGetFamily
GdipCreatePen1
GdipDeleteFont
GdipSetStringFormatTrimming
GdipCreateFont
GdipCreateFontFromLogfontW
GdipDrawLinesI
GdipDrawLineI
GdipDrawImageRectRectI
GdipDrawLine
GdipAddPathStringI
GdipSetStringFormatLineAlign
GdipCreateBitmapFromScan0
GdipDrawImageRectRect
GdipSetStringFormatAlign
GdipAddPathPieI
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipDrawImageRectI
GdipDrawImageI
GdipCreateStringFormat
GdiplusShutdown
GdipAddPathRectangleI
GdipFree
GdipDeleteFontFamily
GdipSetPenDashStyle
GdipCreateLineBrushFromRectWithAngleI
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipCloneFontFamily

ws2_32

connect
__WSAFDIsSet
WSASetLastError
ioctlsocket
WSAStartup
socket
closesocket
gethostbyname
WSACleanup
inet_ntoa
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
setsockopt
select

Sections

.text
Size: 732KB - Virtual size: 729KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 789KB - Virtual size: 789KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2076454e3bc2f7af010726663900cf84

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

3f:9b:b5:7b:3b:ff:32:f7:bc:dd:23:43:2f:1c:f1:75:a0:33:36:a4:65:53:a2:cb:1f:04:64:61:70:3c:7c:7bSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

msimg32

version

gdiplus

ws2_32

Sections

.text Size: 732KB - Virtual size: 729KB

.rdata Size: 144KB - Virtual size: 142KB

.data Size: 16KB - Virtual size: 24KB

Size: 789KB - Virtual size: 789KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

3f:9b:b5:7b:3b:ff:32:f7:bc:dd:23:43:2f:1c:f1:75:a0:33:36:a4:65:53:a2:cb:1f:04:64:61:70:3c:7c:7b
Signer

.text
Size: 732KB - Virtual size: 729KB

.rdata
Size: 144KB - Virtual size: 142KB

.data
Size: 16KB - Virtual size: 24KB