de5e77d4941e3ecaf95a651e17a9628447d884ab628a2b9b6163b03d46fff0fd

Sharing

Copy URL Twitter E-mail

General

Target

de5e77d4941e3ecaf95a651e17a9628447d884ab628a2b9b6163b03d46fff0fd
Size

1.6MB
MD5

0fd246b5e1cb5d5feb0cc6d4e332113f
SHA1

f96b644c91665b0a4d07bb3facadc90f63586a41
SHA256

de5e77d4941e3ecaf95a651e17a9628447d884ab628a2b9b6163b03d46fff0fd
SHA512

0e970bad20f6177dc453b2c148b74440fa477b558bfa5657fa7886a40f3348ca148e2d4b7ed733240bf6dfed6517f0bad9b7826aced878db481f9e2ac0211841
SSDEEP

24576:cWLg6FLC87XERkxSW3wNHfoxaYdBl4vkQTZ6iIRzsHBgJ:oqLr7URqSW3wN/ocQT+I1nJ

Score

1^/10

Malware Config

Signatures

Files

de5e77d4941e3ecaf95a651e17a9628447d884ab628a2b9b6163b03d46fff0fd
.exe windows:5 windows x64 arch:x64

cd7ef70ebbdb135ed6808a6bb7dd3548

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

33:b6:f5:65:ed:70:52:f8:a3:93:6b:7d:48:c8:20:56
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/02/2015, 00:00

Not After

09/02/2016, 23:59

Subject

CN=ShenZhen Enode Techology co\,.Ltd,OU=Security,O=ShenZhen Enode Techology co\,.Ltd,L=ShenZhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:c4:aa:f9:b4:66:db:bf:75:98:ea:13:83:d0:f3:07:5f:20:5d:1c
Signer

Actual PE Digest

22:c4:aa:f9:b4:66:db:bf:75:98:ea:13:83:d0:f3:07:5f:20:5d:1c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\jenkins\workspace\weather\Release\x64\weather.pdb

Imports

kernel32

LocalFree
GetFileSize
GetModuleHandleExW
WritePrivateProfileStringW
GetCommandLineW
AreFileApisANSI
OpenProcess
GetModuleHandleW
GetVersionExW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetCurrentProcessId
ProcessIdToSessionId
GetCurrentThreadId
CreateThread
SetCurrentDirectoryW
CreateMutexW
GetLocalTime
GetModuleFileNameW
GetTempPathW
CopyFileW
ExpandEnvironmentStringsW
WideCharToMultiByte
FreeLibrary
MoveFileW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
GetLastError
GlobalFree
MultiByteToWideChar
LoadLibraryW
GetProcAddress
CreateFileW
ReadFile
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetTickCount
DeleteFileW
GetProcessHeap
CreateFileA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryA
HeapDestroy
HeapSetInformation
GetModuleFileNameA
GetStdHandle
HeapSize
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetCPInfo
LCMapStringW
LCMapStringA
HeapReAlloc
Sleep
CloseHandle
CreateDirectoryW
HeapFree
GetStartupInfoW
ExitProcess
RtlCaptureContext
DosDateTimeToFileTime
SetFilePointer
SystemTimeToFileTime
GetCurrentProcess
SetFileTime
WriteFile
GetCurrentDirectoryW
GetFileType
DuplicateHandle
GetACP
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
MulDiv
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
RaiseException
IsDebuggerPresent
SetEndOfFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
DeviceIoControl
CreateTimerQueue
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
UnregisterWaitEx
RegisterWaitForSingleObject
FindResourceExW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
VirtualProtect
HeapCreate
HeapAlloc
CreateEventW
AddVectoredExceptionHandler
SetUnhandledExceptionFilter
RemoveVectoredExceptionHandler
CreateProcessW
TerminateProcess
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
SwitchToThread
GetFileSizeEx
ReadProcessMemory
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
RtlUnwindEx
ExitThread
RtlPcToFileHeader
UnhandledExceptionFilter
RtlVirtualUnwind

user32

FindWindowW
IsWindowVisible
SendMessageW
FindWindowExW
GetWindowThreadProcessId
PostThreadMessageW
PostMessageW
GetSystemMetrics
SystemParametersInfoW
ShowOwnedPopups
SetForegroundWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
GetParent
KillTimer
SetTimer
ShowWindow
IsWindow
PostQuitMessage
InvalidateRect
GetWindowRect
DestroyWindow
GetKeyState
GetWindowLongPtrW
GetMessageW
wsprintfW
DispatchMessageW
GetFocus
SetFocus
SetCapture
ReleaseCapture
PtInRect
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
FillRect
UpdateLayeredWindow
GetWindow
MapWindowPoints
CreateWindowExW
ScreenToClient
GetCursorPos
DefWindowProcW
SetWindowLongPtrW
EnableWindow
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
SetPropW
GetPropW
OffsetRect
GetDC
wvsprintfW
SetCursor
CharNextW
SetWindowTextW
ClientToScreen
GetWindowTextLengthW
GetWindowTextW
IntersectRect
CreateCaret
ShowCaret
HideCaret
SetCaretPos
GetSysColor
DrawTextW
SetRect
CharPrevW
InvalidateRgn
CreateAcceleratorTableW
MoveWindow
ReleaseDC
RegisterWindowMessageW
TranslateMessage
GetClientRect

gdi32

SetWindowOrgEx
GetTextExtentPoint32W
SetBkMode
SetTextColor
CreateSolidBrush
Rectangle
SaveDC
CreateCompatibleDC
GetTextMetricsW
SelectObject
RestoreDC
SetBrushOrgEx
GetStockObject
CreateCompatibleBitmap
BitBlt
DeleteDC
DPtoLP
GetObjectW
GetDeviceCaps
GetCurrentObject
SelectClipRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
CreateRoundRectRgn
CombineRgn
DeleteObject
CreatePen
CreateFontIndirectW
StretchBlt
SetBkColor
CreateDIBSection
TextOutW
GetCharABCWidthsW
CreateRectRgn
RoundRect
Polygon
LineTo
MoveToEx
CreatePenIndirect
CreateBrushIndirect
ExtTextOutW
SetStretchBltMode

advapi32

DuplicateTokenEx
RegEnumKeyExW
RevertToSelf
SetTokenInformation
CreateProcessAsUserW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegDeleteValueW

shell32

ord165
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHFileOperationW

ole32

CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoUninitialize
CoInitialize
CoCreateInstance
CoCreateGuid
StringFromGUID2

weatherentrydll

?SetHook@@YAHK@Z
?ResetHook@@YAHXZ

comctl32

_TrackMouseEvent
ord17
DrawShadowText

msimg32

AlphaBlend

winhttp

WinHttpReceiveResponse
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

shlwapi

PathRemoveExtensionW
PathFindExtensionW
PathFileExistsW
PathIsDirectoryW
PathCombineW
PathAppendW
PathRemoveFileSpecW
PathIsURLW
StrStrIW
PathFindFileNameW
PathIsRelativeW

gdiplus

GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipDisposeImage
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipFillRectangle
GdipDrawImageRectRect
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

psapi

GetModuleInformation
GetModuleFileNameExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

Sections

.text
Size: 895KB - Virtual size: 894KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd7ef70ebbdb135ed6808a6bb7dd3548

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

33:b6:f5:65:ed:70:52:f8:a3:93:6b:7d:48:c8:20:56Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:c4:aa:f9:b4:66:db:bf:75:98:ea:13:83:d0:f3:07:5f:20:5d:1cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

weatherentrydll

comctl32

msimg32

winhttp

shlwapi

gdiplus

iphlpapi

version

oleaut32

psapi

userenv

wtsapi32

Sections

.text Size: 895KB - Virtual size: 894KB

.rdata Size: 252KB - Virtual size: 251KB

.data Size: 16KB - Virtual size: 42KB

.pdata Size: 60KB - Virtual size: 59KB

.rsrc Size: 368KB - Virtual size: 367KB

.reloc Size: 14KB - Virtual size: 13KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

33:b6:f5:65:ed:70:52:f8:a3:93:6b:7d:48:c8:20:56
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:c4:aa:f9:b4:66:db:bf:75:98:ea:13:83:d0:f3:07:5f:20:5d:1c
Signer

.text
Size: 895KB - Virtual size: 894KB

.rdata
Size: 252KB - Virtual size: 251KB

.data
Size: 16KB - Virtual size: 42KB

.pdata
Size: 60KB - Virtual size: 59KB

.rsrc
Size: 368KB - Virtual size: 367KB

.reloc
Size: 14KB - Virtual size: 13KB