675de7c3d007171c61de5549c79db9c4ac399468cb81aec273e7f8e31882786d

Sharing

Copy URL Twitter E-mail

General

Target

675de7c3d007171c61de5549c79db9c4ac399468cb81aec273e7f8e31882786d
Size

1.4MB
MD5

a1b2bc11cc64c30d9ee1165719f3e05b
SHA1

dcfee5539ccfd28d7bb5e9474a1c5dbd6bc19379
SHA256

675de7c3d007171c61de5549c79db9c4ac399468cb81aec273e7f8e31882786d
SHA512

5d83e1a88c14804ba05069478970b4a3d3e34f1ed64d0b5ec359a00f7f295d82ca0c06a0006f5d2ff58d1b12bfae84f7350d6b6a16c8d1d001a9e51b8662f00d
SSDEEP

24576:RKlY9Y2ZKUcfWB0/4duz3EGMWlgByZ0DZgIIIIIIRhyHqVjFEsEdEgESECEfETE2:Rs25cfWBtuYGpgBdHqVjX7zKcDUbcgLR

Score

1^/10

Malware Config

Signatures

Files

675de7c3d007171c61de5549c79db9c4ac399468cb81aec273e7f8e31882786d
.dll windows:4 windows x64 arch:x64

2fda53f790bf9de53b35134dc92e3cb9

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

06/09/2023, 06:47

Not After

06/09/2026, 06:47

Subject

SERIALNUMBER=91110108766259016Q,CN=DVDFab Software Inc.,O=DVDFab Software Inc.,STREET=海淀区北四环西路9号2108,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c8:2f:8d:c9:db:43:5c:c6:b6:34:9f:53:2a:4f:1a:6e:a3:99:02:8e
Signer

Actual PE Digest

c8:2f:8d:c9:db:43:5c:c6:b6:34:9f:53:2a:4f:1a:6e:a3:99:02:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

gdi32

BitBlt
ChoosePixelFormat
CombineRgn
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
ExtTextOutW
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetObjectA
GetPixelFormat
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsW
Rectangle
SelectObject
SetBkMode
SetDeviceGammaRamp
SetPixelFormat
SetTextColor
SwapBuffers

imm32

ImmAssociateContext
ImmGetCandidateListW
ImmGetCompositionStringW
ImmGetContext
ImmGetIMEFileNameA
ImmNotifyIME
ImmReleaseContext
ImmSetCompositionStringW
ImmSetCompositionWindow

kernel32

CancelIo
CloseHandle
CompareStringA
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileA
CreateFileW
CreateMutexA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetLastError
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetSystemInfo
GetSystemPowerStatus
GetTickCount
GlobalAlloc
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MulDiv
MultiByteToWideChar
OutputDebugStringW
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetThreadExecutionState
SetThreadPriority
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
lstrcatW
lstrlenW

msvcrt

___lc_codepage_func
___mb_cur_max_func
__iob_func
__setusermatherr
_amsg_exit
_errno
_exit
_filelengthi64
_fileno
_i64toa
_initterm
_lock
_ltoa
_stricmp
_strlwr
_strnicmp
_strrev
_strupr
_ui64toa
_ultoa
_unlock
_wcsicmp
_wcsnicmp
abort
acos
asin
atan
atof
atoi
calloc
fclose
ferror
fflush
fgetpos
fgets
fputc
fputs
fread
free
fsetpos
fwrite
getc
islower
isspace
isupper
isxdigit
localeconv
log10
malloc
memcpy
memmove
memset
qsort
realloc
signal
strchr
strcmp
strerror
strlen
strncmp
strrchr
strstr
strtok
strtol
strtoul
tan
tolower
toupper
ungetc
vfprintf
wcscmp
wcscpy
wcslen
wcsncmp
wcsstr
_write
_wcsdup
_open
_itoa
_close

ole32

CoCreateInstance
CoGetMalloc
CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CreateBindCtx
OleLoadFromStream
OleSaveToStream
PropVariantClear

oleaut32

OleCreatePropertyFrame
SysFreeString

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

shell32

DragAcceptFiles
DragFinish
DragQueryFileW
ExtractIconExW
SHGetFolderPathW
ShellExecuteW

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx
BeginPaint
CallWindowProcW
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CreateIconFromResource
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DialogBoxIndirectParamW
DispatchMessageA
DispatchMessageW
DrawIcon
DrawTextW
EmptyClipboard
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplayMonitors
EnumDisplaySettingsW
FindWindowA
FrameRect
GetAsyncKeyState
GetClassInfoExW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardSequenceNumber
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDoubleClickTime
GetFocus
GetIconInfo
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMessageExtraInfo
GetMessageW
GetMonitorInfoW
GetParent
GetPropW
GetRawInputData
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetSystemMetrics
GetUpdateRect
GetWindowLongPtrA
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsRectEmpty
IsWindowVisible
KillTimer
LoadCursorA
LoadCursorW
LoadIconW
MapVirtualKeyW
MessageBoxA
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageW
PostThreadMessageW
PtInRect
RegisterClassExA
RegisterClassExW
RegisterClassW
RegisterDeviceNotificationW
RegisterRawInputDevices
ReleaseDC
RemovePropW
ScreenToClient
SendMessageA
SendMessageW
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetPropW
SetTimer
SetWindowLongPtrA
SetWindowLongPtrW
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
ToUnicode
TrackMouseEvent
TranslateMessage
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
ValidateRect
WindowFromPoint

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime
waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

avcodec-58

av_get_pcm_codec
av_new_packet
av_packet_add_side_data
av_packet_move_ref
av_packet_pack_dictionary
av_packet_unref
avcodec_find_decoder
avpriv_find_pix_fmt
avpriv_get_raw_pix_fmt_tags

avfilter-7

av_buffersink_get_channel_layout
av_buffersink_get_channels
av_buffersink_get_format
av_buffersink_get_frame_flags
av_buffersink_get_h
av_buffersink_get_sample_aspect_ratio
av_buffersink_get_sample_rate
av_buffersink_get_time_base
av_buffersink_get_type
av_buffersink_get_w
avfilter_get_by_name
avfilter_graph_alloc
avfilter_graph_config
avfilter_graph_create_filter
avfilter_graph_dump
avfilter_graph_free
avfilter_graph_parse_ptr
avfilter_inout_free
avfilter_link
avfilter_pad_get_type

avformat-58

av_codec_get_id
av_find_input_format
avformat_alloc_context
avformat_alloc_output_context2
avformat_free_context
avformat_get_riff_video_tags
avformat_new_stream
avio_closep
avio_open2
avio_read_to_bprint
avpriv_register_devices
avpriv_set_pts_info

avutil-56

av_bprint_chars
av_bprint_finalize
av_bprint_init
av_default_item_name
av_dict_copy
av_dict_free
av_dict_set
av_frame_alloc
av_frame_free
av_frame_get_side_data
av_frame_unref
av_free
av_freep
av_get_bytes_per_sample
av_get_padded_bits_per_pixel
av_get_pix_fmt_name
av_get_sample_fmt_name
av_gettime
av_gettime_relative
av_image_copy_to_buffer
av_image_fill_arrays
av_image_get_buffer_size
av_int_list_length_for_size
av_log
av_malloc
av_malloc_array
av_mallocz
av_mul_q
av_opt_set_bin
av_opt_set_defaults
av_opt_set_dict2
av_opt_set_int
av_parse_video_rate
av_parse_video_size
av_pix_fmt_desc_get
av_rescale
av_rescale_q_rnd
av_strdup
av_usleep
avpriv_report_missing_feature

Exports

Exports

av_device_capabilities
av_device_ffversion
av_input_audio_device_next
av_input_video_device_next
av_output_audio_device_next
av_output_video_device_next
avdevice_app_to_dev_control_message
avdevice_capabilities_create
avdevice_capabilities_free
avdevice_configuration
avdevice_dev_to_app_control_message
avdevice_free_list_devices
avdevice_license
avdevice_list_devices
avdevice_list_input_sources
avdevice_list_output_sinks
avdevice_register_all
avdevice_version

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 700B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fda53f790bf9de53b35134dc92e3cb9

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73Certificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

c8:2f:8d:c9:db:43:5c:c6:b6:34:9f:53:2a:4f:1a:6e:a3:99:02:8eSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

imm32

kernel32

msvcrt

ole32

oleaut32

setupapi

shell32

shlwapi

user32

version

avicap32

winmm

avcodec-58

avfilter-7

avformat-58

avutil-56

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.data Size: 23KB - Virtual size: 22KB

.rdata Size: 270KB - Virtual size: 269KB

.pdata Size: 47KB - Virtual size: 46KB

.xdata Size: 40KB - Virtual size: 40KB

.bss Size: - Virtual size: 12KB

.edata Size: 1024B - Virtual size: 700B

.idata Size: 18KB - Virtual size: 17KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 6KB - Virtual size: 6KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

2a:e8:06:75:b7:45:87:6b:e6:9e:15:73
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

c8:2f:8d:c9:db:43:5c:c6:b6:34:9f:53:2a:4f:1a:6e:a3:99:02:8e
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 23KB - Virtual size: 22KB

.rdata
Size: 270KB - Virtual size: 269KB

.pdata
Size: 47KB - Virtual size: 46KB

.xdata
Size: 40KB - Virtual size: 40KB

.bss
Size: - Virtual size: 12KB

.edata
Size: 1024B - Virtual size: 700B

.idata
Size: 18KB - Virtual size: 17KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 6KB - Virtual size: 6KB