77b6a47cab9db360b113993ac880e77d9932ab8946070059e6e5211da9b21ac5

Sharing

Copy URL Twitter E-mail

General

Target

77b6a47cab9db360b113993ac880e77d9932ab8946070059e6e5211da9b21ac5
Size

2.3MB
MD5

83e9b7aed755002262639f1d21cd72dc
SHA1

581f81db123a8a9267bb5b80c2b3a602281dc96e
SHA256

77b6a47cab9db360b113993ac880e77d9932ab8946070059e6e5211da9b21ac5
SHA512

8fa0f76bd0c8af346aea76bdf6da7e0bb4392302e4a9a369ef48dc7edcd1fd61165765496d4a26b1c64f72e8cab8e936da276065f945305b42a18c4292a4fffe
SSDEEP

49152:DCCFbljXPznMoHo4/g5kp7KieVCOxaRjDROJ:V5Pxo4/lKienIRs

Score

1^/10

Malware Config

Signatures

Files

77b6a47cab9db360b113993ac880e77d9932ab8946070059e6e5211da9b21ac5
.exe windows:5 windows x86 arch:x86

04982533b8e120784d9f62ccef93091e

Code Sign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:7d:83:2e:82:ed:54:68:7a:b4:5c:3d:9c:22:9a:e4
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

28/11/2023, 23:59

Subject

CN=上海睦欣网络科技有限公司,O=上海睦欣网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:e6:3a:c9:92:ef:67:ba
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09/09/2020, 07:00

Not After

09/09/2025, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:32:68:45:4d:c4:ec:56:1d:cb:f9:62:31:b2:3e:09
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/11/2020, 00:00

Not After

28/11/2023, 23:59

Subject

CN=上海睦欣网络科技有限公司,O=上海睦欣网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:e6:3a:c9:92:ef:67:ba
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09/09/2020, 07:00

Not After

09/09/2025, 07:00

Subject

CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8e:ae:b7:99:dd:f8:a6:cd:2f:76:9a:4d:3e:80:4c:e3:34:a5:df:a5:a8:95:57:7b:45:8b:e6:03:13:5c:aa:76
Signer

Actual PE Digest

8e:ae:b7:99:dd:f8:a6:cd:2f:76:9a:4d:3e:80:4c:e3:34:a5:df:a5:a8:95:57:7b:45:8b:e6:03:13:5c:aa:76

Digest Algorithm

sha256

PE Digest Matches

false

3d:14:e6:0d:c7:c5:fd:3f:f4:b0:51:93:82:24:06:e2:9b:c4:fc:e7
Signer

Actual PE Digest

3d:14:e6:0d:c7:c5:fd:3f:f4:b0:51:93:82:24:06:e2:9b:c4:fc:e7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleExW
GetModuleFileNameA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
ExpandEnvironmentStringsA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
GetCommandLineW
ReadProcessMemory
GlobalUnlock
GlobalLock
GetCurrentProcessId
GetComputerNameExA
CreateEventW
TerminateThread
OpenProcess
GetModuleHandleA
DuplicateHandle
CreateProcessW
Sleep
CopyFileW
ExpandEnvironmentStringsW
GetLocalTime
OpenMutexW
GetFileSizeEx
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
GetProcessTimes
CreateMutexW
GetEnvironmentVariableW
GetCurrentThreadId
lstrcmpiW
GetModuleFileNameW
WaitForSingleObject
SetEvent
MultiByteToWideChar
CreateFileW
CloseHandle
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
FlushInstructionCache
WideCharToMultiByte
GlobalAlloc
TerminateProcess
InterlockedDecrement
GetTickCount
ExitProcess
SetErrorMode
DosDateTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
MulDiv
lstrlenW
WriteConsoleW
ConnectNamedPipe
WaitNamedPipeW
TransactNamedPipe
GetOverlappedResult
ResetEvent
DeleteCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
LoadLibraryExW
CreateThread
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
FindFirstFileW
WaitForSingleObjectEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
DeleteFileW
MoveFileExW
RemoveDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableA
GetFullPathNameW
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
GetSystemInfo
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
FormatMessageW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
VerSetConditionMask
VerifyVersionInfoA
SleepEx
FormatMessageA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
SetUnhandledExceptionFilter
FreeResource
IsWow64Process
lstrcpyW
WriteProcessMemory
InterlockedIncrement
GetFileSize
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
ResumeThread
SetThreadAffinityMask
GetVolumeInformationW
DeviceIoControl
GetSystemDirectoryW
CreateFileA
GetCurrentThread
GetComputerNameW
GetVersionExW
DisconnectNamedPipe
WriteFile
GetFileAttributesW
SetNamedPipeHandleState
CreateNamedPipeW
RtlUnwind

user32

DestroyIcon
SetRect
FillRect
DrawTextW
DispatchMessageW
PeekMessageW
TranslateMessage
GetWindowThreadProcessId
SetForegroundWindow
GetWindowLongW
SetWindowLongW
SetTimer
IsWindowVisible
ShowWindow
CallWindowProcW
GetWindowRect
SetCursor
GetLastInputInfo
DefWindowProcW
LoadCursorW
RegisterClassExW
CreateWindowExW
UpdateWindow
GetShellWindow
KillTimer
LoadImageW
GetCursorPos
DestroyWindow
EnableWindow
PostQuitMessage
TrackMouseEvent
LoadMenuW
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
DrawIconEx
GetSystemMetrics
IsWindow
IsIconic
IsZoomed
FindWindowExW
SetWindowPos
GetDesktopWindow
GetMonitorInfoW
MonitorFromWindow
PostMessageW
CharPrevW
MessageBoxW
SetWindowRgn
RegisterWindowMessageW
GetWindowRgn
MoveWindow
UpdateLayeredWindow
ClientToScreen
WindowFromPoint
PtInRect
IsRectEmpty
GetKeyboardLayout
IntersectRect
GetParent
GetIconInfo
HideCaret
ShowCaret
GetCaretPos
CreateAcceleratorTableW
InvalidateRgn
SendMessageW
OffsetRect
GetGUIThreadInfo
GetSysColor
MapWindowPoints
ScreenToClient
SetCaretPos
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
wsprintfW
GetUpdateRect
MapVirtualKeyExW
GetKeyNameTextW
InflateRect
UnionRect
GetMessageW
RegisterClassW
GetClassInfoExW
SetFocus
GetMenu
SetPropW
GetPropW
GetClientRect
AdjustWindowRectEx
GetWindow
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetCaretBlinkTime
InvalidateRect
CreateCaret

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
LookupAccountNameW
ConvertSidToStringSidA
EnumServicesStatusW
OpenSCManagerW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetUserNameA
RegOpenCurrentUser
RegQueryInfoKeyW

ole32

CLSIDFromString
DoDragDrop
RegisterDragDrop
CLSIDFromProgID
OleDuplicateData
ReleaseStgMedium
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoCreateGuid
OleLockRunning

oleaut32

VariantClear
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathAppendA
PathFindFileNameA
PathFileExistsA
PathAppendW
PathRemoveFileSpecW
StrStrIW
StrIsIntlEqualW
StrStrW
StrCpyW
PathFindFileNameW
StrStrIA

gdiplus

GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipFree
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDisposeImage
GdipAlloc
GdipStringFormatGetGenericTypographic
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawImageRectI

imagehlp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo

ws2_32

getaddrinfo
gethostname
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
gethostbyname
WSAIoctl
socket
setsockopt
ntohs
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
htons
htonl
ntohl

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301

msimg32

AlphaBlend

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdi32

CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRectRgn
PtInRegion
CreateDIBSection
CreateRoundRectRgn
CombineRgn
SelectObject
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
GetBitmapBits
SetBitmapBits
SaveDC
RestoreDC
CreatePenIndirect
GetStockObject

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 337KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04982533b8e120784d9f62ccef93091e

Code Sign

07Certificate

Key Usages

0c:7d:83:2e:82:ed:54:68:7a:b4:5c:3d:9c:22:9a:e4Certificate

Extended Key Usages

Key Usages

0b:e6:3a:c9:92:ef:67:baCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0b:32:68:45:4d:c4:ec:56:1d:cb:f9:62:31:b2:3e:09Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

0b:e6:3a:c9:92:ef:67:baCertificate

Extended Key Usages

Key Usages

8e:ae:b7:99:dd:f8:a6:cd:2f:76:9a:4d:3e:80:4c:e3:34:a5:df:a5:a8:95:57:7b:45:8b:e6:03:13:5c:aa:76Signer

3d:14:e6:0d:c7:c5:fd:3f:f4:b0:51:93:82:24:06:e2:9b:c4:fc:e7Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

gdiplus

imagehlp

iphlpapi

ws2_32

wldap32

msimg32

version

gdi32

imm32

comctl32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 337KB - Virtual size: 337KB

.data Size: 160KB - Virtual size: 183KB

.gfids Size: 1KB - Virtual size: 1KB

.rsrc Size: 91KB - Virtual size: 91KB

.reloc Size: 94KB - Virtual size: 93KB

07
Certificate

0c:7d:83:2e:82:ed:54:68:7a:b4:5c:3d:9c:22:9a:e4
Certificate

0b:e6:3a:c9:92:ef:67:ba
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0b:32:68:45:4d:c4:ec:56:1d:cb:f9:62:31:b2:3e:09
Certificate

07
Certificate

0b:e6:3a:c9:92:ef:67:ba
Certificate

8e:ae:b7:99:dd:f8:a6:cd:2f:76:9a:4d:3e:80:4c:e3:34:a5:df:a5:a8:95:57:7b:45:8b:e6:03:13:5c:aa:76
Signer

3d:14:e6:0d:c7:c5:fd:3f:f4:b0:51:93:82:24:06:e2:9b:c4:fc:e7
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 337KB - Virtual size: 337KB

.data
Size: 160KB - Virtual size: 183KB

.gfids
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 91KB - Virtual size: 91KB

.reloc
Size: 94KB - Virtual size: 93KB