General

Malware Config

Signatures

Files

• 328256138d4de1ad16ea72dc993333296f09e32b2c5c409d02f653b7daf25c3b

  .exe windows:5 windows x86 arch:x86

  4ce4d9bd2ad48a1803ee7c2b202c0f52

  
  

  Code Sign

  0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

  Certificate

  Issuer

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  11-02-2011 12:00

  Not After

  10-02-2026 12:00

  Subject

  CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:1c:b2:8a:00:00:00:00:00:26

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  15-04-2011 19:41

  Not After

  15-04-2021 19:51

  Subject

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-11-2019 00:00

  Not After

  04-02-2023 12:00

  Subject

  CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Not Before

  06-04-2022 07:45

  Not After

  08-05-2033 07:45

  Subject

  CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  20-06-2018 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  10-12-2014 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5f:ac:9b:47:35:4b:79:e4:21:e0:bb:34:23:07:c0:e8:d7:6f:cb:a4:61:d8:10:f4:e5:90:8d:f0:9d:d6:b9:1a

  Signer

  Actual PE Digest

  5f:ac:9b:47:35:4b:79:e4:21:e0:bb:34:23:07:c0:e8:d7:6f:cb:a4:61:d8:10:f4:e5:90:8d:f0:9d:d6:b9:1a

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  bd:c9:86:f7:0c:52:11:78:86:ff:d7:c2:b1:e8:47:a4:af:61:7f:e5

  Signer

  Actual PE Digest

  bd:c9:86:f7:0c:52:11:78:86:ff:d7:c2:b1:e8:47:a4:af:61:7f:e5

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  seup.exe.pdb

  Imports

  advapi32

  CreateProcessAsUserW

  DuplicateTokenEx

  OpenProcessToken

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExA

  RegQueryValueExW

  RegSetValueExW

  gdi32

  BitBlt

  CombineRgn

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateDIBSection

  CreateFontIndirectW

  CreateFontW

  CreatePatternBrush

  CreateRectRgn

  CreateSolidBrush

  DeleteDC

  DeleteObject

  GetCurrentObject

  GetObjectW

  GetStockObject

  OffsetViewportOrgEx

  PtInRegion

  SelectObject

  SetBkMode

  SetTextColor

  SetViewportOrgEx

  msimg32

  AlphaBlend

  oleaut32

  VarUI4FromStr

  shell32

  CommandLineToArgvW

  SHGetFolderPathW

  SHGetSpecialFolderPathA

  SHGetSpecialFolderPathW

  Shell_NotifyIconW

  shlwapi

  PathAppendW

  PathFileExistsW

  PathFindFileNameA

  PathFindFileNameW

  PathGetDriveNumberW

  PathRemoveFileSpecW

  SHGetValueA

  SHGetValueW

  StrStrIW

  user32

  AdjustWindowRectEx

  AllowSetForegroundWindow

  AppendMenuW

  BeginPaint

  BringWindowToTop

  CallWindowProcW

  CharNextW

  ClientToScreen

  CreateDialogParamW

  CreatePopupMenu

  CreateWindowExW

  DefWindowProcW

  DestroyMenu

  DestroyWindow

  DispatchMessageW

  DrawEdge

  DrawFocusRect

  DrawTextW

  EnableWindow

  EndPaint

  FillRect

  FindWindowExW

  FindWindowW

  GetCapture

  GetClassInfoExW

  GetClientRect

  GetCursorPos

  GetDC

  GetDesktopWindow

  GetDlgCtrlID

  GetDlgItem

  GetMenu

  GetMessageW

  GetMonitorInfoW

  GetParent

  GetShellWindow

  GetSysColor

  GetSystemMetrics

  GetWindow

  GetWindowLongW

  GetWindowRect

  GetWindowRgn

  GetWindowTextLengthW

  GetWindowTextW

  GetWindowThreadProcessId

  InflateRect

  InvalidateRect

  IsIconic

  IsWindow

  IsWindowEnabled

  KillTimer

  LoadCursorW

  LoadImageW

  MapWindowPoints

  MessageBoxW

  MonitorFromPoint

  MonitorFromWindow

  MoveWindow

  OffsetRect

  PeekMessageW

  PostMessageW

  PostQuitMessage

  PtInRect

  RedrawWindow

  RegisterClassExW

  ReleaseCapture

  SendMessageW

  SetCapture

  SetCursor

  SetForegroundWindow

  SetTimer

  SetWindowLongW

  SetWindowPos

  SetWindowRgn

  SetWindowTextW

  ShowWindow

  SystemParametersInfoW

  TrackMouseEvent

  TrackPopupMenu

  TranslateMessage

  UnregisterClassW

  UpdateWindow

  WindowFromPoint

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  wininet

  FtpCommandW

  FtpGetFileSize

  FtpOpenFileW

  HttpEndRequestW

  HttpOpenRequestW

  HttpQueryInfoW

  HttpSendRequestExW

  InternetCloseHandle

  InternetConnectW

  InternetCrackUrlW

  InternetGetLastResponseInfoW

  InternetOpenW

  InternetQueryOptionW

  InternetReadFile

  InternetReadFileExA

  InternetSetOptionA

  InternetSetOptionW

  InternetSetStatusCallbackW

  InternetWriteFile

  psapi

  GetModuleFileNameExW

  GetProcessMemoryInfo

  kernel32

  AssignProcessToJobObject

  CancelWaitableTimer

  CloseHandle

  CompareStringW

  CreateEventW

  CreateFileA

  CreateFileW

  CreateMutexW

  CreateProcessW

  CreateThread

  CreateWaitableTimerW

  DecodePointer

  DeleteCriticalSection

  DeleteFileW

  DeviceIoControl

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  ExpandEnvironmentStringsW

  FindClose

  FindFirstFileExW

  FindNextFileW

  FindResourceW

  FlushFileBuffers

  FlushInstructionCache

  FormatMessageA

  FreeEnvironmentStringsW

  FreeLibrary

  FreeLibraryAndExitThread

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDiskFreeSpaceExW

  GetDriveTypeW

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesW

  GetFileSize

  GetFileSizeEx

  GetFileType

  GetFullPathNameW

  GetLastError

  GetLocalTime

  GetLocaleInfoW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNativeSystemInfo

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetProcessId

  GetProcessTimes

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetTempFileNameW

  GetTempPathW

  GetThreadPriority

  GetTickCount

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetUserDefaultLangID

  GetVersionExW

  GetWindowsDirectoryW

  GlobalAlloc

  GlobalFree

  GlobalMemoryStatusEx

  HeapAlloc

  HeapDestroy

  HeapFree

  HeapLock

  HeapReAlloc

  HeapSize

  HeapUnlock

  HeapWalk

  InitializeCriticalSection

  InitializeCriticalSectionAndSpinCount

  InitializeSListHead

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  IsBadReadPtr

  IsBadWritePtr

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  IsWow64Process

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalFileTimeToFileTime

  LocalFree

  LockResource

  MultiByteToWideChar

  OpenProcess

  OpenThread

  OutputDebugStringA

  OutputDebugStringW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadConsoleW

  ReadFile

  ReleaseMutex

  ResetEvent

  RtlCaptureStackBackTrace

  RtlUnwind

  SetEndOfFile

  SetEnvironmentVariableW

  SetEvent

  SetFilePointer

  SetFilePointerEx

  SetFileTime

  SetHandleInformation

  SetLastError

  SetStdHandle

  SetThreadPriority

  SetUnhandledExceptionFilter

  SetWaitableTimer

  SizeofResource

  Sleep

  SwitchToThread

  SystemTimeToFileTime

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  UnhandledExceptionFilter

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  lstrcmpA

  lstrcmpiA

  lstrcmpiW

  ole32

  CoCreateInstance

  CoInitialize

  CoTaskMemAlloc

  CoTaskMemFree

  CoTaskMemRealloc

  CoUninitialize

  CreateStreamOnHGlobal

  comctl32

  ImageList_Add

  ImageList_Create

  ImageList_Destroy

  ImageList_Draw

  ImageList_GetIconSize

  InitCommonControlsEx

  gdiplus

  GdipAlloc

  GdipCloneImage

  GdipCreateBitmapFromStream

  GdipCreateHBITMAPFromBitmap

  GdipDisposeImage

  GdipFree

  GdiplusShutdown

  GdiplusStartup

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  winmm

  timeGetTime

  netapi32

  Netbios

  Exports

  Exports

  GetHandleVerifier

  Sections

  .text

  Size: 623KB - Virtual size: 622KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 110KB - Virtual size: 110KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 430KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .00cfg

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 145B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .voltbl

  Size: 512B - Virtual size: 306B

  .rsrc

  Size: 112KB - Virtual size: 112KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 322KB - Virtual size: 322KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE