37af38288a6025b7d455023b8260b5fae680f9936686938e9fd400abb3a30c71[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

37af38288a6025b7d455023b8260b5fae680f9936686938e9fd400abb3a30c71.exe
Size

35KB
MD5

d2b15c102ffb91e2d965d7aa9bbc27a0
SHA1

9a2b3105e8d387e2f843d64fbec364752f5f1a8e
SHA256

37af38288a6025b7d455023b8260b5fae680f9936686938e9fd400abb3a30c71
SHA512

640b8746f177ca3807ab550651b927974cb0fef3c72883a558e40cc91eee0b42e07cdf93a3d5ccbac35120f11c9f952fc9a5248a30a2ca886a3106540512ce09
SSDEEP

384:Y/gtC2mQjnVBtw2Xs1KZwCwAtnwNLzX2IWlJQDx3ty9Hith5kCdel4x7gMDgf2hl:PYwjnVXE93n/Wgd3tGi3hUf2hl

Score

1^/10

Malware Config

Signatures

Files

37af38288a6025b7d455023b8260b5fae680f9936686938e9fd400abb3a30c71.exe
.dll windows:4 windows x86 arch:x86

92e0003133f32328f06fa8c3e9e68d79

Code Sign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:36:7d:92:03:09:9d:db:9d:a9:c4:3c:8a:9d:bb:83
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

26/05/2020, 00:00

Not After

26/05/2021, 23:59

Subject

SERIALNUMBER=91440101MA5CQXNH4R,CN=广州晓知智能科技有限公司,O=广州晓知智能科技有限公司,POSTALCODE=511447,STREET=广州市番禺区石楼镇人民路134号3号楼C405室,L=广州市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:73:a8:4f:b5:a3:ef:91:fe:6c:c6:86:16:37:d7:02:55:7c:84:1e
Signer

Actual PE Digest

0a:73:a8:4f:b5:a3:ef:91:fe:6c:c6:86:16:37:d7:02:55:7c:84:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgcc_s_dw2-1

__deregister_frame_info
__register_frame_info

kernel32

DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
strcmp
strlen
strncmp
vfprintf

libstdc++-6

_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZdlPv
_Znwj
__cxa_guard_acquire
__cxa_guard_release

qt5core

_Z7qstrcmpRK10QByteArrayPKc
_ZN10QArrayData10deallocateEPS_jj
_ZN10QByteArrayC1EPKci
_ZN15QtSharedPointer20ExternalRefCountData9getAndRefEPK7QObject
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject5eventEP6QEvent
_ZN7QString17fromLatin1_helperEPKci
_ZN8QVariantC1ERK5QSize
_ZN8QVariantC1Ei
_ZN9QIODevice4readEPcx
_ZN9QIODevice5writeEPKcx
_ZN9QIODevice7getCharEPc
_ZN9QIODevice7putCharEc
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK14QMessageLogger7warningEPKcz
_ZNK9QIODevice10isReadableEv
_ZNK9QIODevice10isWritableEv
_ZNK9QIODevice6isOpenEv

qt5gui

_ZN12QPaintDeviceC2Ev
_ZN14QImageIOPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN14QImageIOPlugin11qt_metacastEPKc
_ZN14QImageIOPlugin16staticMetaObjectE
_ZN14QImageIOPluginC2EP7QObject
_ZN14QImageIOPluginD2Ev
_ZN15QImageIOHandler11jumpToImageEi
_ZN15QImageIOHandler15jumpToNextImageEv
_ZN15QImageIOHandler9setFormatERK10QByteArray
_ZN15QImageIOHandler9setOptionENS_11ImageOptionERK8QVariant
_ZN15QImageIOHandlerC2Ev
_ZN15QImageIOHandlerD2Ev
_ZN6QImage12invertPixelsENS_10InvertModeE
_ZN6QImage4fillEj
_ZN6QImage8scanLineEi
_ZN6QImageC1ERKS_
_ZN6QImageC1EiiNS_6FormatE
_ZN6QImageC1Ev
_ZN6QImageD1Ev
_ZN6QImageaSERKS_
_ZNK15QImageIOHandler10imageCountEv
_ZNK15QImageIOHandler14nextImageDelayEv
_ZNK15QImageIOHandler16currentImageRectEv
_ZNK15QImageIOHandler18currentImageNumberEv
_ZNK15QImageIOHandler4nameEv
_ZNK15QImageIOHandler6deviceEv
_ZNK15QImageIOHandler9loopCountEv
_ZNK15QImageIOHandler9setFormatERK10QByteArray
_ZNK6QImage10colorTableEv
_ZNK6QImage13constScanLineEi
_ZNK6QImage22convertToFormat_helperENS_6FormatE6QFlagsIN2Qt19ImageConversionFlagEE
_ZNK6QImage5widthEv
_ZNK6QImage6formatEv
_ZNK6QImage6heightEv
_ZNK6QImage6isNullEv
_ZTV6QImage

Exports

Exports

qt_plugin_instance
qt_plugin_query_metadata

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1000B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 114B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92e0003133f32328f06fa8c3e9e68d79

Code Sign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

49:36:7d:92:03:09:9d:db:9d:a9:c4:3c:8a:9d:bb:83Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0a:73:a8:4f:b5:a3:ef:91:fe:6c:c6:86:16:37:d7:02:55:7c:84:1eSigner

Headers

File Characteristics

Imports

libgcc_s_dw2-1

kernel32

msvcrt

libstdc++-6

qt5core

qt5gui

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 52B

.rdata Size: 2KB - Virtual size: 2KB

.qtmetad Size: 512B - Virtual size: 320B

.eh_fram Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 1000B

.edata Size: 512B - Virtual size: 114B

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 1024B - Virtual size: 816B

.reloc Size: 1024B - Virtual size: 876B

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

49:36:7d:92:03:09:9d:db:9d:a9:c4:3c:8a:9d:bb:83
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0a:73:a8:4f:b5:a3:ef:91:fe:6c:c6:86:16:37:d7:02:55:7c:84:1e
Signer

.text
Size: 10KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 52B

.rdata
Size: 2KB - Virtual size: 2KB

.qtmetad
Size: 512B - Virtual size: 320B

.eh_fram
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 1000B

.edata
Size: 512B - Virtual size: 114B

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 1024B - Virtual size: 876B