112cbbc5851c69e0b4551c4b5af7494c2c2c63dadca88c1417eb1e1ea8827c4d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

112cbbc5851c69e0b4551c4b5af7494c2c2c63dadca88c1417eb1e1ea8827c4d.exe
Size

1.6MB
MD5

43c9d2d6393e6d5c0a5b3c98a782dc21
SHA1

f850e78a25441d726fc7b1fafd7a270cfbc2dd7d
SHA256

112cbbc5851c69e0b4551c4b5af7494c2c2c63dadca88c1417eb1e1ea8827c4d
SHA512

9f4c5cb6c38570f02ec718988e6003059eb41176c963a4f76b5d126dee776339586f7e784a1c9a906791f53c84771a1a0ae39dddebe865776195b595adccec6b
SSDEEP

49152:lErSOG06fu8EirLITO8KlcsDsR40T4IlAiJbtptzfwhL:tOG0wFEirLb8KlnIJlAiDPzoR

Score

1^/10

Malware Config

Signatures

Files

112cbbc5851c69e0b4551c4b5af7494c2c2c63dadca88c1417eb1e1ea8827c4d.exe
.exe windows:5 windows x86 arch:x86

06dcd9d297638f7a91e2f3e5bc9927bf

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

78:0a:00:32:a6:ce:7d:0b:5d:54:52:f5:cd:e5:20:dc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/06/2016, 00:00

Not After

14/07/2018, 23:59

Subject

CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,OU=RDC,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:43:05:f9:f9:09:b2:48:81:d3:fe:25:21:ae:7e:d8
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/06/2016, 00:00

Not After

14/07/2018, 23:59

Subject

CN=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,OU=RDC,O=TAOBAO (CHINA) SOFTWARE CO.\,LTD.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:37:3e:06:fa:e7:77:a8:a1:d8:0c:a4:e8:aa:1b:09:4d:1d:bc:f5:e1:97:d3:0d:38:0b:3c:6c:2c:2d:96:df
Signer

Actual PE Digest

83:37:3e:06:fa:e7:77:a8:a1:d8:0c:a4:e8:aa:1b:09:4d:1d:bc:f5:e1:97:d3:0d:38:0b:3c:6c:2c:2d:96:df

Digest Algorithm

sha256

PE Digest Matches

true

5c:92:29:7e:89:b6:5f:97:32:cb:22:22:43:54:bd:68:cb:a9:bb:42
Signer

Actual PE Digest

5c:92:29:7e:89:b6:5f:97:32:cb:22:22:43:54:bd:68:cb:a9:bb:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\webapps\b\build\slave\repo\build\src\out\Release\online_installer.exe.pdb

Imports

gdiplus

GdipCreateBitmapFromResource
GdipCreateHBITMAPFromBitmap
GdipFree
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdiplusStartup

iphlpapi

GetNetworkParams

advapi32

RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegEnumKeyExW
CreateProcessAsUserW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW

gdi32

CreateCompatibleBitmap
GetTextFaceW
CreateDIBSection
PtInRegion
CreateRectRgn
SetWindowOrgEx
GetStockObject
CreateRoundRectRgn
GetObjectW
SetViewportOrgEx
ExtTextOutW
SetTextColor
SetBkMode
SetBkColor
SelectObject
PatBlt
GetTextExtentPoint32W
DeleteDC
CreatePatternBrush
CreateICW
CreateFontW
DeleteObject
BitBlt
CreateCompatibleDC

kernel32

IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
WriteConsoleW
GetTimeZoneInformation
ReadConsoleW
GetEnvironmentStringsW
GetACP
GetCommandLineW
DecodePointer
CloseHandle
RaiseException
GetLastError
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
GetCurrentProcess
GetCurrentThreadId
CreateProcessW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
SetDllDirectoryW
MultiByteToWideChar
GetCurrentProcessId
ProcessIdToSessionId
GetTickCount
FindResourceExW
LockResource
lstrlenW
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
GlobalFree
CreateFileW
WriteFile
CreateEventW
GetDiskFreeSpaceExW
WaitForSingleObject
GetExitCodeProcess
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleExW
LoadLibraryW
GetCurrentDirectoryW
DeleteFileW
OutputDebugStringA
FormatMessageA
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetVolumeInformationW
ReadFile
SetFileAttributesW
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
MoveFileExW
WideCharToMultiByte
GetVersionExW
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
IsDebuggerPresent
DuplicateHandle
CreateThread
TerminateProcess
GetStdHandle
SetHandleInformation
ResumeThread
AssignProcessToJobObject
GetUserDefaultLangID
ExpandEnvironmentStringsW
ReadProcessMemory
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
SetEvent
ResetEvent
WaitForMultipleObjects
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FlushFileBuffers
GetFileInformationByHandle
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
SetFileTime
GetProcessId
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetEnvironmentVariableW
SetEnvironmentVariableW
TryEnterCriticalSection
VirtualAlloc
VirtualFree
GetUserDefaultUILanguage
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
DeviceIoControl
CreateFileA
RtlCaptureContext
SetErrorMode
FormatMessageW
InitializeCriticalSection
SleepEx
GetFileType
PeekNamedPipe
GetSystemDirectoryW
GetWindowsDirectoryW
SetFilePointer
FreeLibraryAndExitThread
ExitThread
ExitProcess
SetStdHandle
GetFullPathNameW
GetConsoleMode
GetConsoleCP
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
RemoveDirectoryW
CreateMutexW

msimg32

AlphaBlend

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

VariantInit
SysFreeString
VarUI4FromStr
VariantClear
SysAllocString

psapi

GetModuleFileNameExW

shell32

ord680
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW

user32

SetTimer
KillTimer
IsWindowEnabled
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
GetWindowTextW
GetClientRect
GetWindowRect
SetCursor
MapWindowPoints
GetSysColor
OffsetRect
GetWindowLongW
GetParent
DestroyCursor
PostQuitMessage
EnableWindow
PostMessageW
GetSystemMetrics
SetWindowRgn
SetWindowTextW
ClientToScreen
FillRect
PtInRect
GetWindow
GetCapture
IsDialogMessageW
MonitorFromWindow
GetMonitorInfoW
RegisterClassExW
GetClassInfoExW
RedrawWindow
LoadCursorW
GetDlgItem
GetMenu
AdjustWindowRectEx
MoveWindow
SetForegroundWindow
LoadStringW
EnumChildWindows
GetClassNameW
GetWindowRgn
PeekMessageW
SetWindowLongW
MessageBoxW
CharNextW
CreateDialogParamW
ShowWindow
DestroyWindow
UnregisterClassW
DefWindowProcW
GetDlgCtrlID
IsWindowVisible
SetWindowPos
IsWindow
CreateWindowExW
CallWindowProcW
LoadImageW
SendMessageW
SetFocus

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

ws2_32

sendto
accept
listen
gethostname
setsockopt
ntohs
htons
getsockopt
getsockname
recvfrom
select
getpeername
connect
bind
send
recv
WSAGetLastError
socket
closesocket
WSACleanup
WSAStartup
ioctlsocket
__WSAFDIsSet
freeaddrinfo
getaddrinfo
WSASetLastError

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

comctl32

_TrackMouseEvent

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

GetHandleVerifier
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 740KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06dcd9d297638f7a91e2f3e5bc9927bf

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

78:0a:00:32:a6:ce:7d:0b:5d:54:52:f5:cd:e5:20:dcCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0d:43:05:f9:f9:09:b2:48:81:d3:fe:25:21:ae:7e:d8Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

83:37:3e:06:fa:e7:77:a8:a1:d8:0c:a4:e8:aa:1b:09:4d:1d:bc:f5:e1:97:d3:0d:38:0b:3c:6c:2c:2d:96:dfSigner

5c:92:29:7e:89:b6:5f:97:32:cb:22:22:43:54:bd:68:cb:a9:bb:42Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

iphlpapi

advapi32

gdi32

kernel32

msimg32

ole32

oleaut32

psapi

shell32

user32

version

winmm

ws2_32

userenv

comctl32

winhttp

Exports

Exports

Sections

.text Size: 740KB - Virtual size: 739KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 5KB - Virtual size: 34KB

.gfids Size: 1024B - Virtual size: 816B

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 733KB - Virtual size: 733KB

.reloc Size: 27KB - Virtual size: 27KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

78:0a:00:32:a6:ce:7d:0b:5d:54:52:f5:cd:e5:20:dc
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0d:43:05:f9:f9:09:b2:48:81:d3:fe:25:21:ae:7e:d8
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

83:37:3e:06:fa:e7:77:a8:a1:d8:0c:a4:e8:aa:1b:09:4d:1d:bc:f5:e1:97:d3:0d:38:0b:3c:6c:2c:2d:96:df
Signer

5c:92:29:7e:89:b6:5f:97:32:cb:22:22:43:54:bd:68:cb:a9:bb:42
Signer

.text
Size: 740KB - Virtual size: 739KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 5KB - Virtual size: 34KB

.gfids
Size: 1024B - Virtual size: 816B

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 733KB - Virtual size: 733KB

.reloc
Size: 27KB - Virtual size: 27KB