2cccbc4bfcf5009f77c10ca47b502bf58325bc897ecb9aa4e5027b3e88e793e7

Sharing

Copy URL Twitter E-mail

General

Target

2cccbc4bfcf5009f77c10ca47b502bf58325bc897ecb9aa4e5027b3e88e793e7
Size

1.0MB
MD5

97e88344bacfce9263d883d2f083e18b
SHA1

eb82a51617191c5cf59306d8b517524cc4cd7dfb
SHA256

2cccbc4bfcf5009f77c10ca47b502bf58325bc897ecb9aa4e5027b3e88e793e7
SHA512

7192116ce1e08079afd3f4e74a80aadabd4b70f3695681f5eb7252c43430e3a56b4fc2e8587fe1103d02408664947a95febe1373f981f1fc6d724ffab86d234f
SSDEEP

12288:9Tf7whLHD5u2OkAgYfU2KKQNwBzfTEgFbGj3mQT9qZNhgypIk5:57C5OkAgYaKrBsgFqzDT9qZYyOa

Score

1^/10

Malware Config

Signatures

Files

2cccbc4bfcf5009f77c10ca47b502bf58325bc897ecb9aa4e5027b3e88e793e7
.exe windows:4 windows x86 arch:x86

a670f72011b9114fb69c8daf0611a761

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/07/2008, 00:00

Not After

11/07/2009, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D Center,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\sogoupy_R_4_2\Bin\SogouInput\PinyinUp.pdb

Imports

wininet

InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
InternetGetLastResponseInfoW
HttpAddRequestHeadersW
HttpEndRequestW
InternetWriteFile
InternetQueryOptionW
HttpSendRequestExW
InternetSetCookieW
InternetConnectW
HttpOpenRequestW
InternetQueryDataAvailable
HttpSendRequestW
HttpQueryInfoW

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon

shlwapi

StrToIntW
StrStrIW
StrCmpIW
StrToIntA

ws2_32

inet_ntoa
WSAStartup
gethostbyname

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
GetTempPathW
FreeLibrary
SetUnhandledExceptionFilter
lstrcmpiW
GetModuleFileNameW
SizeofResource
LoadLibraryExW
InterlockedIncrement
FindResourceW
LoadResource
InterlockedDecrement
lstrlenW
GetDriveTypeA
SetEndOfFile
CreateFileA
GetStringTypeW
GetStringTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetCurrentDirectoryA
GetFullPathNameW
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
FindNextFileW
GetConsoleMode
GetConsoleCP
HeapSize
GetModuleFileNameA
GetStdHandle
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetDriveTypeW
FileTimeToLocalFileTime
RtlUnwind
GetStartupInfoW
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FindFirstFileW
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetVersionExA
LCMapStringW
GetTickCount
WaitNamedPipeW
OpenEventW
LocalAlloc
CreateMutexW
ReleaseMutex
OpenMutexW
RemoveDirectoryW
CreateFileMappingW
GetSystemDirectoryW
MultiByteToWideChar
GetCurrentProcessId
HeapAlloc
FormatMessageW
TerminateProcess
InitializeCriticalSection
WideCharToMultiByte
TerminateThread
CreateProcessW
GetProcessHeap
LocalFree
GetCommandLineW
SetLastError
SetThreadPriority
GetCurrentThreadId
GetCurrentProcess
ResumeThread
RaiseException
Sleep
SuspendThread
FlushInstructionCache
HeapFree
CloseHandle
GetExitCodeProcess
WaitForSingleObject
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
GetSystemInfo
GetLocalTime
GetLastError
GetVersionExW
CompareStringA
CompareStringW
SetEnvironmentVariableA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
InterlockedCompareExchange
FlushFileBuffers
ReadFile
GetFileSize
CreateThread
SetFilePointer
ExitThread
DuplicateHandle
WaitForMultipleObjects
WriteFile
CreateEventW
CreateDirectoryW
MoveFileExW
CreateFileW
VirtualAlloc
FileTimeToSystemTime
FindClose
SetFileAttributesW
GetTimeZoneInformation
CopyFileW
DeleteFileW
GetFileTime
GlobalFree
GlobalAlloc

user32

InvalidateRect
GetWindowRect
SetCursor
GetWindow
ScreenToClient
UnregisterClassA
PostQuitMessage
PeekMessageW
CharNextW
TranslateMessage
DestroyWindow
GetMessageW
DispatchMessageW
GetSysColor
DialogBoxParamW
FillRect
GetWindowLongW
GetWindowTextW
SetWindowPos
GetSystemMenu
ShowWindow
RegisterClassW
SetWindowTextW
RegisterClassExW
SetWindowLongW
DefWindowProcW
FindWindowW
IsWindow
CreateWindowExW
GetSystemMetrics
SendMessageW
SetTimer
GetParent
BeginPaint
IntersectRect
SystemParametersInfoW
IsIconic
PostMessageW
PtInRect
GetClientRect
EndPaint
LoadIconW
EndDialog
LoadCursorW
MapWindowPoints
CallWindowProcW
DrawTextW
GetCursorPos
LoadImageW
KillTimer
SubtractRect
UpdateWindow
MessageBoxW
GetDlgItem
EnableWindow
EnableMenuItem

gdi32

SetTextColor
CreateRectRgn
GetStockObject
CreatePen
MoveToEx
LineTo
SelectObject
CreateSolidBrush
CreateFontIndirectW
SelectClipRgn
GetROP2
SetBkMode
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExW
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
RegQueryValueExW
AllocateAndInitializeSid
EqualSid
GetTokenInformation
LookupAccountSidW
GetSidLengthRequired
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
FreeSid

shell32

SHFileOperationW
CommandLineToArgvW
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
OleInitialize
OleCreate
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
CoTaskMemFree
OleSetContainedObject

oleaut32

SysFreeString
SysAllocString
VarUI4FromStr
VariantClear
VariantInit

imm32

ImmDisableIME

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

hwsignature

GenHWID

Sections

.text
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a670f72011b9114fb69c8daf0611a761

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

wininet

comctl32

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

imm32

version

hwsignature

Sections

.text Size: 487KB - Virtual size: 487KB

.rdata Size: 173KB - Virtual size: 173KB

.data Size: 18KB - Virtual size: 49KB

.rsrc Size: 350KB - Virtual size: 350KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:f6:33:b2:64:72:f3:36:7c:84:ce:a1:b3:46:c2:5b
Certificate

.text
Size: 487KB - Virtual size: 487KB

.rdata
Size: 173KB - Virtual size: 173KB

.data
Size: 18KB - Virtual size: 49KB

.rsrc
Size: 350KB - Virtual size: 350KB