5e8b6f8205ded6b1707b4a5e6cc8b83e5bdeef3a0d3f6302fe774866bd9023e0

Sharing

Copy URL

Twitter E-mail

General

Target

5e8b6f8205ded6b1707b4a5e6cc8b83e5bdeef3a0d3f6302fe774866bd9023e0
Size

2.4MB
MD5

dabb63a0c264fb493741df0e4571ea7d
SHA1

120d512f23154b6b56327b0cb15ff0f1084761b0
SHA256

5e8b6f8205ded6b1707b4a5e6cc8b83e5bdeef3a0d3f6302fe774866bd9023e0
SHA512

05a46f6901434fbd92b69b4cc71aec333721947515021bd1a43dce0bc5ae7262e2ec4750be69bf6a2286e4de82ee0e4e2c8b29bbb977fc00612b7d80146f43a4
SSDEEP

24576:crpmbxPYBv9bqu8Q4lprhK4urPaGeOseNqrQSW6nWdEduGSJpBu3VpaakmO8b1Km:cpeqJ4xK4VOseYkH6W+dBSJKmmNO8fUU

Score

1^/10

Malware Config

Signatures

Files

5e8b6f8205ded6b1707b4a5e6cc8b83e5bdeef3a0d3f6302fe774866bd9023e0
.exe windows:4 windows x86 arch:x86

9232f5c5efa7335d78086f0418d98db5

Code Sign

06:cd:53:28:49:6e:09:da:53:27:ba:46:57:d0:9f:15
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20-07-2013 00:00

Not After

17-09-2016 23:59

Subject

CN=量产部落��,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=量产部落��,L=Mongkok,ST=Kowloon,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e8:6b:43:10:f9:44:68:50:f4:9b:cd:be:e5:e8:11:f3:32:45:e5:98
Signer

Actual PE Digest

e8:6b:43:10:f9:44:68:50:f4:9b:cd:be:e5:e8:11:f3:32:45:e5:98

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

CM_Locate_DevNodeA
CM_Remove_SubTree
CM_Get_Sibling
CM_Get_Parent
CM_Get_DevNode_Registry_PropertyA
CM_Get_Child
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList

kernel32

RtlUnwind
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetTimeZoneInformation
GetSystemTime
IsBadReadPtr
RaiseException
GetStartupInfoA
GetCommandLineA
ExitThread
SetStdHandle
GetFileType
GetACP
HeapReAlloc
HeapSize
FatalAppExitA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
GetLocaleInfoW
GetTickCount
CompareStringW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetProfileStringA
InterlockedExchange
OutputDebugStringA
GetPrivateProfileStringA
GetModuleHandleA
CreateDirectoryA
lstrcpyA
WritePrivateProfileStringA
GetSystemDefaultLangID
GetLastError
CloseHandle
SetCommState
GetCommState
SetCommTimeouts
GetCommTimeouts
GetPrivateProfileIntA
CreateFileA
ReadFile
WriteFile
Sleep
SetThreadPriority
CreateThread
CreateEventA
SetPriorityClass
GetCurrentProcess
WaitForSingleObject
SetEvent
ResetEvent
FindClose
FindNextFileA
FindFirstFileA
SetCurrentDirectoryA
CopyFileA
GetLocalTime
DeleteFileA
GetFileAttributesA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
SetErrorMode
GetOEMCP
GetCPInfo
GetProcessVersion
SizeofResource
GlobalFlags
SetFileAttributesA
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GetCurrentThread
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
lstrcmpA
MulDiv
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
MoveFileA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
SuspendThread
ResumeThread
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LockResource
FindResourceA
LoadResource
LocalFree
MultiByteToWideChar
lstrlenA
InterlockedDecrement
InterlockedIncrement
SetLastError
GlobalFree
WideCharToMultiByte
FormatMessageA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
SetFilePointer
GetSystemDirectoryA
GetDriveTypeA
GetVersionExA
GetExitCodeThread
TerminateThread
GetFileSize
DeviceIoControl
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateProcessA
FreeLibrary
GetModuleFileNameA
LoadLibraryA
GlobalSize
CompareStringA

user32

DestroyIcon
GetWindowThreadProcessId
RemoveMenu
GetMenuStringA
InsertMenuA
GetSysColorBrush
GetDialogBaseUnits
GetClassNameA
MapDialogRect
SetWindowContextHelpId
ShowOwnedPopups
DestroyMenu
IsClipboardFormatAvailable
LoadStringA
WindowFromPoint
GrayStringA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetMessageA
TranslateMessage
ValidateRect
wvsprintfA
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
CheckMenuItem
MoveWindow
IsDialogMessageA
ScrollWindowEx
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
MapWindowPoints
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
IsWindowVisible
ScrollWindow
GetScrollInfo
ShowScrollBar
SetScrollRange
GetTopWindow
IsChild
WinHelpA
GetMenu
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
PostThreadMessageA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
GetWindow
RegisterWindowMessageA
IntersectRect
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindowEnabled
OemToCharA
CharToOemA
WaitMessage
PeekMessageA
DispatchMessageA
GetCapture
GetMessagePos
SystemParametersInfoA
DrawFrameControl
GetScrollRange
GetScrollPos
SetRectEmpty
IsRectEmpty
ChildWindowFromPoint
LoadCursorA
DrawEdge
GetClassInfoA
DefWindowProcA
RegisterClassA
SetRect
InflateRect
CreateWindowExA
MessageBoxA
GetDesktopWindow
SendMessageA
UnregisterClassA
HideCaret
ExcludeUpdateRgn
DefDlgProcA
IsWindowUnicode
EnableWindow
SetWindowLongA
GetWindowLongA
GetWindowRect
SetTimer
KillTimer
ScreenToClient
GetCursorPos
PostQuitMessage
LockWindowUpdate
SetWindowsHookExA
GetDlgItem
SetFocus
SetWindowTextA
SetDlgItemTextA
UnhookWindowsHookEx
SetForegroundWindow
ReleaseDC
LoadMenuA
ModifyMenuA
GetSubMenu
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
SetMenu
TranslateAcceleratorA
LoadAcceleratorsA
MessageBeep
GetNextDlgGroupItem
CopyAcceleratorTableA
CharNextA
RemovePropA
DeleteMenu
GetMenuItemID
GetMenuItemCount
EnableMenuItem
LoadIconA
PostMessageA
IsIconic
GetSystemMenu
AppendMenuA
ShowWindow
DrawIcon
SetWindowPos
InvalidateRect
GetSysColor
GetSystemMetrics
CopyRect
FillRect
DrawFocusRect
RedrawWindow
GetClientRect
UpdateWindow
GetFocus
GetParent
GetDC
LoadBitmapA
SetCursor
IsWindow
OffsetRect
wsprintfA
CharUpperA
GetKeyNameTextA
DestroyCaret
SetScrollPos
DragDetect
EnableScrollBar
SetScrollInfo
ReleaseCapture
GetKeyState
RegisterClipboardFormatA
EmptyClipboard
PtInRect
DrawTextA
SetCapture
CreateCaret
SetCaretPos
ShowCaret
IsDlgButtonChecked

gdi32

ExtCreatePen
Polyline
PolyBezier
Ellipse
Polygon
CreateHatchBrush
CreatePalette
RealizePalette
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
PatBlt
CreateRectRgnIndirect
DeleteDC
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
EndDoc
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
Escape
GetMapMode
SetRectRgn
CombineRgn
DPtoLP
SetAbortProc
CreateDCA
GetTextMetricsA
CopyMetaFileA
GetTextColor
GetBkColor
LPtoDP
AbortDoc
EndPage
StartPage
StartDocA
ExtTextOutA
GetDeviceCaps
SetBoundsRect
GetCharWidthA
GetTextExtentPoint32A
TextOutA
SelectObject
CreateFontA
GetViewportOrgEx
SetViewportOrgEx
DeleteObject
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
StretchBlt
Rectangle
GetObjectA
CreateFontIndirectA
SetTextAlign
CreateDIBitmap
GetTextExtentPointA
CreatePen

comdlg32

GetSaveFileNameA
PageSetupDlgA
GetFileTitleA
ChooseColorA
PrintDlgA
CommDlgExtendedError
GetOpenFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyA
RegSetValueA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
RegQueryValueA
RegDeleteKeyA

shell32

DragQueryFileA
DragFinish
SHGetFileInfoA
DragAcceptFiles
SHFileOperationA
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA
ExtractIconA

comctl32

_TrackMouseEvent
ord17
ord13
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Merge
ImageList_Read
ImageList_Write

oledlg

ord8

ole32

CoTaskMemFree
StgCreateDocfileOnILockBytes
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
OleGetClipboard
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
OleDuplicateData
CoTaskMemAlloc
OleUninitialize
ReleaseStgMedium
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
CreateStreamOnHGlobal
CoGetClassObject
StgOpenStorageOnILockBytes
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
SetConvertStg
CoInitialize
OleInitialize
OleRun
CreateILockBytesOnHGlobal
CoUninitialize
CreateBindCtx
CoCreateGuid
CoFreeUnusedLibraries

olepro32

ord253

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantCopy
SysAllocString
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VarCyFromStr
VarBstrFromCy
LoadTypeLi
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysFreeString
SysAllocStringLen
VariantTimeToSystemTime
SysStringLen
SysReAllocStringLen

wsock32

send
sendto
recvfrom
inet_ntoa
WSAAsyncSelect
recv
gethostbyname
htonl
bind
accept
getsockname
getpeername
ntohs
inet_addr
WSAGetLastError
WSASetLastError
shutdown
WSAStartup
socket
ioctlsocket
htons
connect
closesocket
WSACleanup
listen

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 376KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9232f5c5efa7335d78086f0418d98db5

Code Sign

06:cd:53:28:49:6e:09:da:53:27:ba:46:57:d0:9f:15Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e8:6b:43:10:f9:44:68:50:f4:9b:cd:be:e5:e8:11:f3:32:45:e5:98Signer

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

wsock32

version

dbghelp

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 156KB - Virtual size: 155KB

.data Size: 376KB - Virtual size: 612KB

.rsrc Size: 120KB - Virtual size: 117KB

06:cd:53:28:49:6e:09:da:53:27:ba:46:57:d0:9f:15
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e8:6b:43:10:f9:44:68:50:f4:9b:cd:be:e5:e8:11:f3:32:45:e5:98
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 156KB - Virtual size: 155KB

.data
Size: 376KB - Virtual size: 612KB

.rsrc
Size: 120KB - Virtual size: 117KB