455a984bf6e702197d3341e0249e5e70N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

455a984bf6e702197d3341e0249e5e70N.exe
Size

397KB
MD5

455a984bf6e702197d3341e0249e5e70
SHA1

6190593d3911925d735cef1f195fad724cbb2946
SHA256

76ade1ba4b55b314b2223506d3b20da434e1c8da7e4d2132cec01b4a1920a05b
SHA512

96b611951cec43d5ad0ea2bb51d491a5bcfa1a5b9b117520fa2406fb3e133a3778a746236b853e0d672a96410338c29affdb9883283abf6b90fa41c111b0fd81
SSDEEP

6144:N7DbMqt4ZiKqtc7w2fgm+9OwpiyOfDHN1aaPvGxBJROQOWn/Cc1Yx:r4ZJq2OpiyOR1aaPvuJAy/Cc1Yx

Score

1^/10

Malware Config

Signatures

Files

455a984bf6e702197d3341e0249e5e70N.exe
.dll regsvr32 windows:5 windows x86 arch:x86

54035fdfffe102db6559065ba6bc874d

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/04/2012, 00:00

Not After

24/04/2015, 23:59

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:4f:ed:40:61:d8:9b:0a:da:b3:4b:bd:5f:b9:2d:ae:71:80:7b:9c
Signer

Actual PE Digest

88:4f:ed:40:61:d8:9b:0a:da:b3:4b:bd:5f:b9:2d:ae:71:80:7b:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\clientci\workspace\nbrowser_xui_m7_branch\xui\BDBrowserOutput\Win32\Release\VS100\bdxctrl.pdb

Imports

bdcommon

?CreateObjectAgrgtByIID@Com@Util@@YGJABU_GUID@@PAPAXPAUIUnknown@@@Z
?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z
?SetOneTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
?CreateObjectByIID@Com@Util@@YGJABU_GUID@@PAPAX@Z
?SetMulTimer@Timer@Common@Util@@YAJIPAUITimerCallback@@I@Z
?EraseTimerCallback@Timer@Common@Util@@YAJPAUITimerCallback@@I@Z
GetLogController

kernel32

GetTickCount
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
lstrcmpW
MulDiv
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
GlobalFree
SetThreadLocale
GetThreadLocale
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
LeaveCriticalSection
TlsAlloc
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
EncodePointer
lstrlenW
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
EnterCriticalSection
GetModuleFileNameW
TlsGetValue
lstrcmpiW
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
FindResourceExW
Sleep
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
SetStdHandle
WriteConsoleW
CreateFileW
CloseHandle
FlushFileBuffers
ReadFile
DecodePointer

user32

GetDlgItem
GetClassNameW
EndPaint
BeginPaint
InvalidateRgn
DestroyAcceleratorTable
SetFocus
GetClassInfoExW
RegisterClassExW
CreateWindowExW
GetDesktopWindow
IsChild
CreateAcceleratorTableW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
RedrawWindow
UnregisterClassA
InvalidateRect
ReleaseDC
GetDC
MoveWindow
GetSysColor
DefWindowProcW
CallWindowProcW
GetMessagePos
LoadCursorW
SetCursor
ClientToScreen
GetClientRect
WindowFromPoint
ScreenToClient
GetFocus
GetCapture
ReleaseCapture
SetCapture
GetKeyState
TranslateMessage
DispatchMessageW
EqualRect
SetRectEmpty
IsRectEmpty
GetSystemMetrics
mouse_event
DestroyWindow
SetWindowLongW
GetWindowLongW
PostMessageW
GetWindow
IsWindowVisible
GetParent
SendMessageW
SetLayeredWindowAttributes
CharNextW
IsWindow
GetCursorPos
SetWindowPos
FillRect
GetWindowRect
UpdateLayeredWindow
IntersectRect
MonitorFromPoint
GetMonitorInfoW
OffsetRect
PtInRect
CopyRect
GetAncestor

gdi32

CreateDIBSection
SelectObject
CreateCompatibleDC
GetStockObject
DeleteObject
CombineRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateSolidBrush
GetObjectW
DeleteDC

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFileInfoW

ole32

CoGetClassObject
OleLockRunning
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CLSIDFromString

oleaut32

UnRegisterTypeLi
VariantCopy
OleCreateFontIndirect
DispCallFunc
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocString
SysFreeString
RegisterTypeLi

msimg32

AlphaBlend

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipCreateSolidFill
GdipCreateFromHDC
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 285KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54035fdfffe102db6559065ba6bc874d

Code Sign

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

88:4f:ed:40:61:d8:9b:0a:da:b3:4b:bd:5f:b9:2d:ae:71:80:7b:9cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bdcommon

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msimg32

gdiplus

imm32

Exports

Exports

Sections

.text Size: 285KB - Virtual size: 285KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 13KB - Virtual size: 20KB

.rsrc Size: 512B - Virtual size: 416B

.reloc Size: 28KB - Virtual size: 28KB

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

88:4f:ed:40:61:d8:9b:0a:da:b3:4b:bd:5f:b9:2d:ae:71:80:7b:9c
Signer

.text
Size: 285KB - Virtual size: 285KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 13KB - Virtual size: 20KB

.rsrc
Size: 512B - Virtual size: 416B

.reloc
Size: 28KB - Virtual size: 28KB