5c0dc8ab419a092c918a584f745a734342d2d3c7bad00478dd1830a4dd48aa30

Sharing

Copy URL Twitter E-mail

General

Target

5c0dc8ab419a092c918a584f745a734342d2d3c7bad00478dd1830a4dd48aa30
Size

2.2MB
MD5

bfa7315ad27c6f9b83eca2d7462e263d
SHA1

4eff78037ecdb459e31b5ffd60fbf3f3a65e3bda
SHA256

5c0dc8ab419a092c918a584f745a734342d2d3c7bad00478dd1830a4dd48aa30
SHA512

f61998d5eb3dbfe1ce670c0fc4bf74cd639c02d21374dee42e9459ad24d5e3c665c21599ea2b9dcb4306a61a01869c52271e55290e3a6c8d24dfa2806c3d200d
SSDEEP

49152:iz5HFjfJxNa4veV93rdFQtTkXJA/lDb/Z8zOhp:iBhzvek6ZfiH

Score

1^/10

Malware Config

Signatures

Files

5c0dc8ab419a092c918a584f745a734342d2d3c7bad00478dd1830a4dd48aa30
.exe windows:5 windows x86 arch:x86

c356f1ba798015a0fe18974dd9f0079a

Code Sign

32:0e:2f:74:61:13:b1:bb:45:a4:3c:87:f7:67:34:65
Certificate

Issuer

CN=Beijing JJJsafe Technology

Not Before

04/04/2024, 09:36

Not After

31/12/2039, 23:59

Subject

CN=Beijing JJJsafe Technology

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

bd:02:a8:a4:28:a0:b6:72:22:93:d5:b1:f8:e1:a5:70:f0:d0:63:97
Signer

Actual PE Digest

bd:02:a8:a4:28:a0:b6:72:22:93:d5:b1:f8:e1:a5:70:f0:d0:63:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcesses
GetModuleFileNameExA

kernel32

GetSystemTimeAsFileTime
RaiseException
VirtualProtect
VirtualQuery
HeapReAlloc
HeapSize
HeapCreate
GetStdHandle
TerminateProcess
UnhandledExceptionFilter
SetStdHandle
GetFileType
SetHandleCount
GetConsoleCP
GetConsoleMode
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
Sleep
CloseHandle
ExitThread
ReadFile
SetFilePointer
CreateFileA
UnmapViewOfFile
MapViewOfFile
WriteFile
DeleteFileA
GetTickCount
GetFileSize
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
SizeofResource
LockResource
LoadResource
FindResourceA
CreateDirectoryA
GetFileAttributesA
CreateFileMappingA
GetSystemInfo
lstrcatA
lstrcpynA
WideCharToMultiByte
SetEndOfFile
FileTimeToLocalFileTime
GetFileAttributesExA
lstrcpyA
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetLastError
GetLastError
GetWindowsDirectoryA
GetLogicalDriveStringsA
GetModuleFileNameA
GetVolumeInformationA
GetDriveTypeA
MulDiv
WaitForSingleObject
TerminateThread
HeapFree
RtlUnwind
HeapAlloc
GetFileSizeEx
LocalFileTimeToFileTime
SetErrorMode
GetModuleHandleW
GetOEMCP
GetCPInfo
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
GetTempFileNameA
SetFileTime
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetPrivateProfileIntA
GetProfileIntA
SetThreadPriority
GetFullPathNameA
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiA
GetThreadLocale
GetStringTypeExA
MoveFileA
GetExitCodeThread
SetEvent
CreateEventA
GetTempPathA
MultiByteToWideChar
InterlockedDecrement
GetModuleFileNameW
FileTimeToSystemTime
GlobalUnlock
GlobalSize
FormatMessageA
lstrlenW
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
FreeResource
GetAtomNameA
VirtualFree
VirtualAlloc
CopyFileA
SetUnhandledExceptionFilter
IsDebuggerPresent
OutputDebugStringA
GetStartupInfoA
GetDiskFreeSpaceA
DeviceIoControl
WritePrivateProfileStringA
GetPrivateProfileStringA
GlobalMemoryStatusEx
SuspendThread
ResumeThread
GetFileTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrcmpA
GetDiskFreeSpaceExA
SetFileAttributesA
RemoveDirectoryA
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThread
LocalAlloc
LocalFree
GetCommandLineA
GetCurrentDirectoryA
ExitProcess
GetCurrentThreadId
GetShortPathNameA
CreateProcessA
GetExitCodeProcess
OpenProcess
GetVersionExA
GetSystemDirectoryA
GetCurrentProcess
DosDateTimeToFileTime
LoadLibraryExA
EnumResourceNamesA
GetLocalTime
FreeLibrary
lstrlenA
WinExec
GlobalFree
FindFirstFileA
FindNextFileA
FindClose
GlobalAlloc
GlobalLock
CreateThread

user32

LoadAcceleratorsA
InsertMenuItemA
BringWindowToTop
TranslateAcceleratorA
SetRectEmpty
DrawIcon
IsRectEmpty
CharUpperA
GetWindowThreadProcessId
EndPaint
BeginPaint
AppendMenuA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
ScrollWindow
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
MessageBoxA
CreateWindowExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
IntersectRect
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
DefWindowProcA
TrackPopupMenuEx
GetWindow
GetMenuItemID
SetWindowsHookExA
GetMenu
CallNextHookEx
UnhookWindowsHookEx
AdjustWindowRect
IsZoomed
SetWindowPos
CallWindowProcA
IsWindowVisible
SetWindowRgn
MapWindowPoints
GetWindowDC
IsIconic
CreatePopupMenu
TrackPopupMenu
DestroyMenu
GetScrollBarInfo
GetClipboardData
MapVirtualKeyA
SendInput
MsgWaitForMultipleObjects
RegisterClipboardFormatA
SystemParametersInfoA
InsertMenuA
DeleteMenu
SetClassLongA
GetInputState
PostThreadMessageA
GetMenuItemInfoA
SetMenuItemInfoA
SetForegroundWindow
LoadMenuA
RemoveMenu
ModifyMenuA
GetSubMenu
GetMenuStringA
GetMenuItemCount
ShowScrollBar
UpdateWindow
CreateIconFromResource
KillTimer
SetTimer
SetWindowLongA
LoadCursorA
CopyIcon
MessageBeep
IsWindow
wsprintfA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadBitmapA
GetKeyState
GetFocus
PostMessageA
ReuseDDElParam
UnpackDDElParam
SetCursorPos
GetSystemMenu
SetParent
ValidateRect
PostQuitMessage
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
GetSysColorBrush
UnregisterClassA
GetDCEx
LockWindowUpdate
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
CreateMenu
GetTabbedTextExtentA
GetDesktopWindow
SetRect
GetSysColor
DrawIconEx
GetCursorPos
ReleaseDC
GetDC
ScreenToClient
PtInRect
GetSystemMetrics
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetCursor
ReleaseCapture
DestroyCursor
LoadImageA
GetIconInfo
GetWindowLongA
WindowFromPoint
SetCapture
GetCapture
GetActiveWindow
RedrawWindow
InvalidateRect
ClientToScreen
GetClientRect
GetWindowRect
DrawFocusRect
FrameRect
FillRect
OffsetRect
InflateRect
CopyRect
DrawStateA
LoadIconA
SendMessageA
DestroyIcon
GetParent
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
GetClassInfoExA

gdi32

CreateDCA
PatBlt
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
StartDocA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
CopyMetaFileA
ExtSelectClipRgn
SelectPalette
PtVisible
SetRectRgn
GetMapMode
DPtoLP
CreateEllipticRgn
LPtoDP
Ellipse
GetCharWidthA
StretchDIBits
GetBkColor
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetViewportOrgEx
GetTextMetricsA
GetTextColor
GetRgnBox
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetWindowOrgEx
GetClipBox
CreateFontA
CombineRgn
Rectangle
SetBkColor
SetTextColor
CreateRectRgn
CreateRectRgnIndirect
SetPixel
CreatePatternBrush
DeleteDC
CreateFontIndirectA
GetStockObject
StretchBlt
CreateBitmap
CreateDIBSection
GdiFlush
SelectObject
GetDIBColorTable
SetDIBitsToDevice
GetPixel
RealizePalette
GetDeviceCaps
GetObjectA
CreatePalette
CreateDiscardableBitmap
GetTextExtentPoint32A
RoundRect
DeleteObject
Escape
CreatePen
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
RectVisible
TextOutA
ExtTextOutA
BitBlt

msimg32

TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
GetJobA
DocumentPropertiesA

advapi32

SetFileSecurityA
GetUserNameA
RegOpenKeyA
RegEnumValueA
ImpersonateSelf
OpenThreadToken
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
RegSetValueA
RegCreateKeyA
RegDeleteValueA
RegFlushKey
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryInfoKeyA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueA
RegCloseKey
GetFileSecurityA

shell32

ord155
SHGetFileInfoA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetFolderLocation
SHGetMalloc
DragFinish
DragQueryFileA
SHFileOperationA
SHGetSpecialFolderPathA
ShellExecuteExA
ord716
SHChangeNotify
Shell_NotifyIconA
DragAcceptFiles
ExtractIconA
ExtractIconExA
ShellExecuteA

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA

oledlg

ord8

ole32

CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
IsAccelerator
OleTranslateAccelerator
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CoInitializeEx
CoCreateInstance
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleInitialize
OleUninitialize
CoInitialize
CoCreateGuid
CoUninitialize
CoTaskMemFree
CreateILockBytesOnHGlobal

oleaut32

SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
OleCreatePictureIndirect
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantChangeType
VariantClear
VariantInit
SysFreeString

msvfw32

DrawDibDraw
DrawDibClose
DrawDibRealize
DrawDibSetPalette

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

GetGlobalDataPointer

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 839KB - Virtual size: 838KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c356f1ba798015a0fe18974dd9f0079a

Code Sign

32:0e:2f:74:61:13:b1:bb:45:a4:3c:87:f7:67:34:65Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

bd:02:a8:a4:28:a0:b6:72:22:93:d5:b1:f8:e1:a5:70:f0:d0:63:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

msvfw32

version

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 226KB - Virtual size: 226KB

.data Size: 34KB - Virtual size: 3.0MB

.rsrc Size: 839KB - Virtual size: 838KB

32:0e:2f:74:61:13:b1:bb:45:a4:3c:87:f7:67:34:65
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

bd:02:a8:a4:28:a0:b6:72:22:93:d5:b1:f8:e1:a5:70:f0:d0:63:97
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 226KB - Virtual size: 226KB

.data
Size: 34KB - Virtual size: 3.0MB

.rsrc
Size: 839KB - Virtual size: 838KB