b5bc56274ba9d36ae1754a98b94ef924533544305fad39d952ab3b68ede31ecb

Sharing

Copy URL Twitter E-mail

General

Target

b5bc56274ba9d36ae1754a98b94ef924533544305fad39d952ab3b68ede31ecb
Size

263KB
MD5

d3fece1ffc7fa7386ca28514655523ab
SHA1

83cfea56178a7b799501cd7e6034dc357014a021
SHA256

b5bc56274ba9d36ae1754a98b94ef924533544305fad39d952ab3b68ede31ecb
SHA512

be58a962188f2490a404a4eee616cbc7102b79cbc2daaa0845d87e16674727ee22cb9f40f062ff6afbedb2992f7fb3fd3f912a24998aa746cb2caaa4704b7233
SSDEEP

3072:TBOpX47QozSuIIvokpoBUiwrPGglnaiaU2VACIoFk7N254QjyJtBDMeQP0B:TWjoHpcoznV3Cpk7q4KyJDMeZB

Score

1^/10

Malware Config

Signatures

Files

b5bc56274ba9d36ae1754a98b94ef924533544305fad39d952ab3b68ede31ecb
.exe windows:6 windows x86 arch:x86

0690810c56b098de0faced747268551d

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/04/2023, 03:04

Not After

26/04/2026, 03:04

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:82:eb:2c:cc:1f:e1:e7:34:c3:79:99:d5:d9:69:7b:ce:dd:ed:e5:20:52:d8:f3:50:7b:55:20:6a:bb:2f:e0
Signer

Actual PE Digest

5d:82:eb:2c:cc:1f:e1:e7:34:c3:79:99:d5:d9:69:7b:ce:dd:ed:e5:20:52:d8:f3:50:7b:55:20:6a:bb:2f:e0

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\work\new\project\AsyncLoader\Release\source\0.pdb

Imports

kernel32

CopyFileA
CreateProcessA
GetModuleFileNameA
CreateThread
GetLastError
GetEnvironmentVariableA
GetProcAddress
DecodePointer
HeapReAlloc
HeapSize
WriteConsoleW
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetProcessHeap
GetConsoleCP
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WideCharToMultiByte
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CloseHandle
SetEvent
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetStdHandle
WriteFile
MultiByteToWideChar
GetACP
GetFileAttributesExW
GetStringTypeW
GetFileType
SetFilePointerEx
GetConsoleMode
LCMapStringW

user32

LoadStringW
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExW
CreateWindowExW
ShowWindow
EndDialog
PostQuitMessage
EndPaint
BeginPaint
DefWindowProcA
DestroyWindow
DialogBoxParamA
UpdateWindow

advapi32

SystemFunction036

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0690810c56b098de0faced747268551d

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:5b:f8:6e:85:26:53:40:33:13:83:7bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

5d:82:eb:2c:cc:1f:e1:e7:34:c3:79:99:d5:d9:69:7b:ce:dd:ed:e5:20:52:d8:f3:50:7b:55:20:6a:bb:2f:e0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 3KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 380B

.rsrc Size: 146KB - Virtual size: 145KB

.reloc Size: 5KB - Virtual size: 5KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

5d:82:eb:2c:cc:1f:e1:e7:34:c3:79:99:d5:d9:69:7b:ce:dd:ed:e5:20:52:d8:f3:50:7b:55:20:6a:bb:2f:e0
Signer

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 3KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 380B

.rsrc
Size: 146KB - Virtual size: 145KB

.reloc
Size: 5KB - Virtual size: 5KB