7797749a1f359ca2075b29737bdd1b783cef967c1e2b25bf5a033ff2a545a843

Sharing

Copy URL Twitter E-mail

General

Target

7797749a1f359ca2075b29737bdd1b783cef967c1e2b25bf5a033ff2a545a843
Size

999KB
MD5

eb1ed4db34e6d26c31028a1d39b2874e
SHA1

0f175203e580faec9958e5263287d820d8d4fc8e
SHA256

7797749a1f359ca2075b29737bdd1b783cef967c1e2b25bf5a033ff2a545a843
SHA512

f292703774a2744531a09ae63095ac5e539a18237de9aaabf670a8c4701495ebe0949d609bf20e11f6bf3ee0b1a4bb014cf99e8b5753556129f805971ff07f15
SSDEEP

24576:fLoYic/78XM7sAl+wDV3QCBqiLNhdKisQ:fsXc/wXYbBqiLNhwZQ

Score

1^/10

Malware Config

Signatures

Files

7797749a1f359ca2075b29737bdd1b783cef967c1e2b25bf5a033ff2a545a843
.exe windows:5 windows x86 arch:x86

51c5d42386610e9e310bf7c227edbe87

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:17:1a:6c:13:4e:71:95:7d:ce:f3:5d:91:4c:22:d5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2013, 00:00

Not After

18/12/2015, 23:59

Subject

CN=Wuhan Yu Ku of Network Technology Co.\, Ltd,OU=Ministry of Technology,O=Wuhan Yu Ku of Network Technology Co.\, Ltd,L=wuhan,ST=hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b3:ee:6a:19:38:94:58:02:2b:d3:5b:ac:d3:30:ef:80:80:48:0c:d1
Signer

Actual PE Digest

b3:ee:6a:19:38:94:58:02:2b:d3:5b:ac:d3:30:ef:80:80:48:0c:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Works\wuliang\XKGameBox2.0\Release\XKFlashGameBrowser.pdb

Imports

kernel32

GetExitCodeThread
OutputDebugStringW
MulDiv
FreeResource
ReadFile
GetACP
ExitProcess
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetFileType
DuplicateHandle
SetEnvironmentVariableA
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetStringTypeW
GetLocaleInfoW
SetLastError
TlsFree
TlsSetValue
GetCurrentDirectoryW
TlsAlloc
IsValidCodePage
GetOEMCP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapCreate
IsProcessorFeaturePresent
SetHandleCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CompareStringW
GetCPInfo
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
GetStdHandle
WriteConsoleW
DecodePointer
EncodePointer
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
lstrlenA
GetCurrentProcessId
GetCurrentThreadId
GetThreadPriority
GetSystemInfo
VirtualProtectEx
VirtualAlloc
FlushInstructionCache
SetThreadPriority
InitializeCriticalSection
VirtualFree
GetCurrentProcess
VirtualQuery
GetThreadContext
CreateDirectoryW
CreateProcessW
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
RaiseException
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedIncrement
LoadLibraryExW
FreeLibrary
GetLastError
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
GetTickCount
CreateThread
ResumeThread
SuspendThread
LockResource
OpenThread
SizeofResource
InterlockedDecrement
LoadResource
FindResourceW
FindResourceExW
Sleep
GetCurrentThread
LocalFree
WriteFile
CloseHandle
GetProcAddress
GetFileSize
CreateFileW
GetVersionExW
LoadLibraryW
TlsGetValue

user32

GetClassInfoExW
SetPropW
TranslateMessage
IsWindow
RegisterClassW
GetPropW
CallWindowProcW
DispatchMessageW
HideCaret
ShowCaret
GetSysColor
CreateCaret
LoadImageW
IsRectEmpty
GetFocus
GetWindowTextLengthW
GetKeyState
GetMessageW
DestroyIcon
DrawIconEx
GetUpdateRect
SetRect
CharPrevW
GetWindow
DefWindowProcW
GetClassNameW
RegisterClassExW
SetFocus
LoadCursorW
PostQuitMessage
ReleaseDC
MoveWindow
GetDC
DrawTextW
LoadIconW
OffsetRect
InflateRect
wvsprintfW
SetCaretPos
KillTimer
SetTimer
SendMessageW
ShowWindow
GetClientRect
SetWindowLongW
GetWindowLongW
GetWindowTextW
EnableWindow
SetWindowTextW
PtInRect
EndPaint
IsIconic
GetWindowRect
ScreenToClient
SetWindowRgn
MessageBoxW
SetWindowPos
CharNextW
GetMonitorInfoW
IsWindowVisible
GetSystemMetrics
CreateWindowExW
SetLayeredWindowAttributes
MonitorFromWindow
GetParent
AnimateWindow
IsZoomed
PostMessageW
DestroyWindow
ClientToScreen
MapWindowPoints
GetDesktopWindow
IntersectRect
SetForegroundWindow
GetCursorPos
InvalidateRect
FillRect
SetCursor
ReleaseCapture
BeginPaint
CreateAcceleratorTableW
InvalidateRgn
SetCapture

gdi32

DeleteObject
CreateRoundRectRgn
GetObjectW
CombineRgn
PtInRegion
RestoreDC
CreatePen
SaveDC
Rectangle
GetTextMetricsW
SetWindowOrgEx
TextOutW
CreateSolidBrush
RoundRect
GetClipBox
SetStretchBltMode
GetCharABCWidthsW
ExtTextOutW
CreateRectRgnIndirect
CreatePenIndirect
SelectClipRgn
SetBkColor
StretchBlt
CreateDIBSection
LineTo
MoveToEx
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteDC
BitBlt
GetDeviceCaps
GetTextExtentPoint32W
GetStockObject
SetBkMode
GetObjectA
CreateFontIndirectW
GetPixel
ExtSelectClipRgn
SetTextColor
CreateRectRgn

advapi32

RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW

shell32

Shell_NotifyIconW
SHGetFolderPathW

ole32

CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoTaskMemAlloc
CoInitialize
OleUninitialize
OleInitialize
CoTaskMemRealloc
CoInitializeEx
CoTaskMemFree
PropVariantClear
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
VariantClear
VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathFileExistsW

winmm

timeGetDevCaps
timeBeginPeriod
timeKillEvent
timeEndPeriod
timeGetTime
timeSetEvent

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipDeleteFont
GdipSetTextRenderingHint
GdipSetStringFormatLineAlign
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipDeleteBrush
GdiplusStartup
GdipSetStringFormatAlign
GdipDrawImageI
GdiplusShutdown
GdipImageGetFrameCount
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipCreateFromHDC
GdipGetPropertyItemSize
GdipDisposeImage
GdipAlloc
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipLoadImageFromFile
GdipDeleteGraphics
GdipFree
GdipCreateFontFromDC
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateLineBrushI
GdipDrawString

wininet

InternetReadFile
InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetOpenW
InternetCrackUrlW
InternetConnectW

Sections

.text
Size: 650KB - Virtual size: 649KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51c5d42386610e9e310bf7c227edbe87

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

22:17:1a:6c:13:4e:71:95:7d:ce:f3:5d:91:4c:22:d5Certificate

Extended Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

b3:ee:6a:19:38:94:58:02:2b:d3:5b:ac:d3:30:ef:80:80:48:0c:d1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

comctl32

gdiplus

wininet

Sections

.text Size: 650KB - Virtual size: 649KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 164KB - Virtual size: 188KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 49KB - Virtual size: 49KB

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

22:17:1a:6c:13:4e:71:95:7d:ce:f3:5d:91:4c:22:d5
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

b3:ee:6a:19:38:94:58:02:2b:d3:5b:ac:d3:30:ef:80:80:48:0c:d1
Signer

.text
Size: 650KB - Virtual size: 649KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 164KB - Virtual size: 188KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 49KB - Virtual size: 49KB