095d07461c944daee6ce96aa1e50f4efd287ea78d698d60195cf08265fbddaba

Sharing

Copy URL Twitter E-mail

General

Target

095d07461c944daee6ce96aa1e50f4efd287ea78d698d60195cf08265fbddaba
Size

2.1MB
MD5

f6b884c9d06d90f9138739bab1252ca1
SHA1

6e89ecdb5dffe9945fdfe3c58f06ec728509079b
SHA256

095d07461c944daee6ce96aa1e50f4efd287ea78d698d60195cf08265fbddaba
SHA512

c0d4597bc84f3c28ab728627ee20ea67ccea1330511cc3f300f3c9cb78b1265151577e553d21073e26a84796d748a38c1688b27617869173bbacd6b42acf6068
SSDEEP

24576:tLbeeC/X7af+itZQNzIh6wP6dY7U4z85TM6p08c6ESQx56mFn:NbejluhidhM6p08jErx5dFn

Score

1^/10

Malware Config

Signatures

Files

095d07461c944daee6ce96aa1e50f4efd287ea78d698d60195cf08265fbddaba
.dll windows:5 windows x86 arch:x86

c8896dc994db2fee70466498d074c9e7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

85:d1:dc:dd:42:fa:e0:5b:18:71:73:6c:63:fa:71:48:10:88:a0:ce:42:26:b5:44:5c:b6:85:fd:71:b3:f2:e8
Signer

Actual PE Digest

85:d1:dc:dd:42:fa:e0:5b:18:71:73:6c:63:fa:71:48:10:88:a0:ce:42:26:b5:44:5c:b6:85:fd:71:b3:f2:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\webview\WebView\webview\Release\WebView.pdb

Imports

kernel32

CreateFileW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileW
MoveFileExW
MultiByteToWideChar
GetCurrentThreadId
OutputDebugStringA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
CreateEventW
RegisterWaitForSingleObject
UnregisterWait
GetCurrentProcessId
GetFileSizeEx
GetLocalTime
FreeLibrary
ReleaseMutex
GetTempFileNameW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
CreateProcessW
GetCommandLineW
RtlCaptureStackBackTrace
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetTickCount
CloseHandle
GetFileTime
SizeofResource
LoadResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
WriteConsoleW
SetEndOfFile
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
GetTempPathW
FindResourceExW
FindResourceW
CreateMutexW
OutputDebugStringW
RaiseException
GetExitCodeProcess
OpenProcess
GetProcessHeap
HeapSize
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetFileAttributesExW
CreateProcessA
GetACP
GetStringTypeW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
CreateTimerQueue
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
LockResource
DecodePointer
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
FormatMessageW
LoadLibraryExW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadFile
SetFilePointer
WriteFile
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedExchangeAdd
LocalFree
InitializeCriticalSectionEx
ConnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForMultipleObjectsEx
CreateSemaphoreW
DisconnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetFileSize
FlushFileBuffers
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
SetProcessAffinityMask
DuplicateHandle
ReleaseSemaphore
ResetEvent

user32

UnregisterClassW
SendMessageW
SendMessageTimeoutW
PostMessageW
DefWindowProcW
CallWindowProcW
CopyRect
LoadCursorW
FindWindowW
SetWindowLongW
GetWindowLongW
wsprintfW
SetWindowTextW
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW

gdi32

GetTextExtentPoint32W
GetStockObject
DeleteObject
SelectObject

advapi32

CryptSetKeyParam
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
RegGetValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptAcquireContextW
CryptContextAddRef

shell32

ShellExecuteW
SHGetFolderPathA
ShellExecuteExW
SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

ole32

StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize

oleaut32

SysFreeString

shlwapi

PathFindExtensionW
PathFindExtensionA
PathCompactPathW
PathCombineW
SHGetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathCanonicalizeW
PathAppendW
StrStrIA
StrStrIW
PathIsRootW
PathIsRelativeW
PathIsDirectoryW
PathAppendA
PathFindFileNameA

psapi

GetModuleFileNameExW
EnumProcessModules

urlmon

URLDownloadToCacheFileW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

crypt32

CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Exports

Exports

CreateMultiTabWebView
CreateMultiTabWebViewEx
GetWebViewFactory
IWebViewToIWebViewEx
IsSupportedWebViewEngine

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8896dc994db2fee70466498d074c9e7

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

85:d1:dc:dd:42:fa:e0:5b:18:71:73:6c:63:fa:71:48:10:88:a0:ce:42:26:b5:44:5c:b6:85:fd:71:b3:f2:e8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

urlmon

version

crypt32

wintrust

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 356KB - Virtual size: 355KB

.data Size: 25KB - Virtual size: 32KB

.idata Size: 9KB - Virtual size: 9KB

.shared Size: 512B - Virtual size: 260B

.00cfg Size: 512B - Virtual size: 260B

.tls Size: 1024B - Virtual size: 777B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 63KB - Virtual size: 62KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

85:d1:dc:dd:42:fa:e0:5b:18:71:73:6c:63:fa:71:48:10:88:a0:ce:42:26:b5:44:5c:b6:85:fd:71:b3:f2:e8
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 356KB - Virtual size: 355KB

.data
Size: 25KB - Virtual size: 32KB

.idata
Size: 9KB - Virtual size: 9KB

.shared
Size: 512B - Virtual size: 260B

.00cfg
Size: 512B - Virtual size: 260B

.tls
Size: 1024B - Virtual size: 777B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 63KB - Virtual size: 62KB