TencentMeeting14100002872194427publishexe_b091884873[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

TencentMeeting14100002872194427publishexe_b091884873.exe
Size

3.7MB
MD5

e643a4909e0a8b0405da94cdf4d8ad27
SHA1

e349b9ebc06f0eda15cb5987c3e3465c69c7556c
SHA256

dda05ceaa993e1dd7a016ab4a929e50ce524e75508d836a9abec95d71aadcb50
SHA512

d1d1b5cbee2a389c4f46b4f2e8ad911100171c20a887b4d68cd01abb6eee91db4fe5d01191dc32d9ea8405d0baca8a562dfa8fea3d10815fe5789bcc5f94989c
SSDEEP

49152:anjt4e6/hkNWNR9FKsjiKCtfBe5oz34dFR3/8M0mTgcXGaPCquTDiH/p7sPkNkdX:a0T/Ks2pfs3RP8MjWKGiH/pBNkdt1

Score

1^/10

Malware Config

Signatures

Files

TencentMeeting14100002872194427publishexe_b091884873.exe
.exe windows:5 windows x86 arch:x86

33d406d67e75cb80b693bf082178e8a4

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

28-05-2024 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:36:df:87:e7:2c:4f:5a:06:74:b7:9b:77:29:9c:9e:36:ec:a6:17:ae:3d:55:81:41:dd:ee:f6:8d:f3:e9:be
Signer

Actual PE Digest

68:36:df:87:e7:2c:4f:5a:06:74:b7:9b:77:29:9c:9e:36:ec:a6:17:ae:3d:55:81:41:dd:ee:f6:8d:f3:e9:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\master_lu\inst_ui_market\Release\单词风暴_b015226917.pdb

Imports

kernel32

CreateFileW
CreateFileMappingW
MapViewOfFile
SetFilePointer
UnmapViewOfFile
CloseHandle
GetFileAttributesExW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
InitializeCriticalSection
CreateMutexW
EnterCriticalSection
LeaveCriticalSection
GetLastError
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
Process32NextW
GetLongPathNameW
OpenProcess
GetModuleFileNameW
SetLastError
WaitForSingleObject
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
RaiseException
GetProcAddress
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateEventW
SetEvent
GetModuleHandleW
GetCurrentProcess
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MulDiv
ReadFile
GetFileSize
GetTempPathW
LoadLibraryW
FreeLibrary
GetTickCount
MoveFileExW
SetFileAttributesW
GetStartupInfoW
CreateProcessW
DeleteFileA
WideCharToMultiByte
LockFile
UnlockFile
lstrcmpiW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
DecodePointer
LocalFree
GetFileAttributesW
FindFirstFileW
FindNextFileW
DeleteFileW
FindClose
RemoveDirectoryW
GetFullPathNameW
lstrlenW
GetLogicalDriveStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
WriteFile
GetTempFileNameW
Sleep
WaitForMultipleObjects
ReleaseMutex
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FlushFileBuffers
CopyFileW
FindFirstFileA
FindNextFileA
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentThread
TlsAlloc
SwitchToThread
GetStringTypeW
OpenThread
SetThreadPriority
FormatMessageW
GetFileSizeEx
OpenFileMappingW
OutputDebugStringW
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetThreadPriority
GetThreadContext
IsProcessorFeaturePresent
SuspendThread
ResumeThread
GetThreadSelectorEntry
DeviceIoControl
FlushInstructionCache
lstrcmpA
lstrcmpiA
CreateFileA
InterlockedExchange
InterlockedExchangeAdd
InterlockedCompareExchange
GetProcessAffinityMask
SetThreadContext
ResetEvent
ReleaseSemaphore
DuplicateHandle
CreateEventA
CreateSemaphoreA
InterlockedPushEntrySList
InterlockedPopEntrySList
TlsGetValue
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
InitializeSListHead
SleepEx
VerifyVersionInfoW
FormatMessageA
EncodePointer
LoadLibraryExA
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
GetFileType
GetModuleHandleA
QueryPerformanceCounter
VirtualQuery
VirtualProtect
GlobalMemoryStatus
GetSystemTime
SystemTimeToFileTime
FlushConsoleInputBuffer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
WaitForSingleObjectEx
GetSystemInfo

user32

GetWindowThreadProcessId
DefWindowProcW
SendMessageW
PostMessageW
DestroyWindow
UnregisterClassW
RegisterClassExW
GetClassInfoExW
LoadCursorW
wsprintfW
SetWindowLongW
GetWindowLongW
CallWindowProcW
GetWindowTextLengthW
GetWindowTextW
BeginPaint
EndPaint
GetClientRect
InvalidateRect
DrawTextW
FindWindowExW
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
UnregisterClassA
CreateWindowExW
SetTimer
TrackPopupMenu
SetForegroundWindow
GetCursorPos
AppendMenuW
CreatePopupMenu
RedrawWindow
SendMessageTimeoutW
FindWindowW
MoveWindow
PostQuitMessage
SetWindowTextW
LoadIconW
GetSystemMetrics
LoadImageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
WaitForInputIdle
GetShellWindow
SystemParametersInfoW
SetWindowRgn
UpdateLayeredWindow
ShowWindow
DialogBoxParamW
EndDialog
ScreenToClient
IsDialogMessageW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
MapWindowPoints
BringWindowToTop
SetWindowPos
IsRectEmpty
DrawFocusRect
SetCursor
CopyRect
PtInRect
SetRect
OffsetRect
IsWindow
ReleaseDC
GetDC
KillTimer
IsWindowVisible

oleaut32

VariantClear
VariantInit
SysFreeString
VarUI4FromStr
SysAllocString

dbghelp

MakeSureDirectoryPathExists

vcruntime140

_except_handler4_common
strrchr
_setjmp3
longjmp
strchr
memcmp
memchr
__uncaught_exception
memcpy
_CxxThrowException
__std_type_info_destroy_list
memset
strstr
__std_type_info_compare
wcsrchr
wcsstr
_purecall
__std_exception_destroy
__std_exception_copy
wcschr
__std_terminate
__CxxFrameHandler3
memmove

api-ms-win-crt-string-l1-1-0

isgraph
wcscpy_s
isspace
_wcslwr_s
strncpy_s
_wcsupr_s
toupper
_wcsicmp
wcsncpy
isalnum
strcmp
islower
__strncnt
strnlen
towlower
_strlwr
_wcsdup
isupper
strcpy_s
wcsncmp
strncat
strncpy
isprint
strncat_s
wmemcpy_s
tolower
wcscat_s
wcspbrk
_strdup
_strnicmp
_stricmp
_strupr_s
wcsnlen
strpbrk
isalpha
wcsspn
isxdigit
strncmp
_strlwr_s
wcsncpy_s
isdigit
wcscspn
strcspn
iswspace

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
fgetc
feof
_setmode
fputs
fputc
_open
_chsize
fread
fclose
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vsprintf
_wsopen_s
fwrite
ftell
fseek
_fileno
fgets
ferror
clearerr
_write
_lseek
_close
_wfopen
fflush
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__p__commode
_lseeki64
_set_fmode
_read
fopen
setvbuf

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_errno
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
abort
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_invalid_parameter_noinfo_noreturn
raise
_configure_narrow_argv
_controlfp_s
terminate
_wassert
exit
_getpid
_seh_filter_dll
_invalid_parameter_noinfo
__sys_nerr
_beginthreadex
signal
_endthreadex
strerror
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

realloc
_recalloc
_callnewh
_set_new_mode
free
malloc
calloc

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func
_unlock_locales
___mb_cur_max_func
_lock_locales
_configthreadlocale
setlocale
___lc_codepage_func
localeconv
___lc_collate_cp_func
__pctype_func

api-ms-win-crt-math-l1-1-0

_fdopen
_dtest
_finite
_isnan
_libm_sse2_pow_precise
_CIpow
ldexp
ceil
frexp
modf
floor
_except1
__setusermatherr

api-ms-win-crt-convert-l1-1-0

atoi
atol
_wtoi
_ultoa_s
strtol
strtoll
strtod
strtof
strtoul
_strtoui64
atoll
atof

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-time-l1-1-0

_Strftime
_time64
_ftime64_s
_Getdays
_ftime64
_gmtime64
_Getmonths
_W_Getdays
_W_Getmonths
_Gettnames
_W_Gettnames
_Wcsftime
_localtime64
_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_mkdir
_wsplitpath_s
_stat64
remove
_access
_fstat64
_stat64i32
_wunlink
_chmod

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getch

winmm

timeGetTime

wldap32

ord46
ord127
ord26
ord27
ord147
ord14
ord301
ord142
ord216
ord118
ord145
ord133
ord208
ord167
ord41
ord79

Exports

Exports

TitanSDK_AddHttpHeaderBypassKey
TitanSDK_AsyncOpenSession
TitanSDK_CloseSession
TitanSDK_CloseSwarm
TitanSDK_GetDownloadUrl
TitanSDK_GetFlow
TitanSDK_GetFlowDone
TitanSDK_GetVodUrl
TitanSDK_OnNetworkChanged
TitanSDK_OpenSwarm
TitanSDK_PlayQuality
TitanSDK_PlayStatistics
TitanSDK_SetListenPort
TitanSDK_SetPauseTimeout
TitanSDK_SetSleepTimeout
TitanSDK_SetStartCallback
TitanSDK_SetToken
TitanSDK_SetWorkspace
TitanSDK_Start
TitanSDK_Stop
_Start@12
pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getunique_np
pthread_getw32threadhandle_np
pthread_getw32threadid_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_consistent
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_getrobust
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_setrobust
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_test_features_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 223KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33d406d67e75cb80b693bf082178e8a4

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

68:36:df:87:e7:2c:4f:5a:06:74:b7:9b:77:29:9c:9e:36:ec:a6:17:ae:3d:55:81:41:dd:ee:f6:8d:f3:e9:beSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

dbghelp

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

winmm

wldap32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 601KB - Virtual size: 601KB

.data Size: 223KB - Virtual size: 263KB

.rsrc Size: 250KB - Virtual size: 249KB

.reloc Size: 121KB - Virtual size: 121KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

68:36:df:87:e7:2c:4f:5a:06:74:b7:9b:77:29:9c:9e:36:ec:a6:17:ae:3d:55:81:41:dd:ee:f6:8d:f3:e9:be
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 601KB - Virtual size: 601KB

.data
Size: 223KB - Virtual size: 263KB

.rsrc
Size: 250KB - Virtual size: 249KB

.reloc
Size: 121KB - Virtual size: 121KB