8b45fadead80513ca47c05dc08531950N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8b45fadead80513ca47c05dc08531950N.exe
Size

2.1MB
MD5

8b45fadead80513ca47c05dc08531950
SHA1

1d021a471388d5bf4162747b24809cc1b03286ef
SHA256

300d5d0d623c261c0da5580aeeb045634d7303c7a5909f5f0bc173033e9a829d
SHA512

a6873bc2f1275bae820f70abd897ee3043aefaa2dada1845a913b918a547b683c811cb0ea26e55a9083201a2f68cdd8fc0eda1fffb16f6a2a64dd0d4fa49f11d
SSDEEP

24576:ML4DSb7IpidUCTJSmGG4KLgytA8htr7spBq3hXE8ceh6e9jNrcA27Adpg/6bdEcR:MWS44gmGJHDffUj0Rw+m/YT/y0JeB

Score

1^/10

Malware Config

Signatures

Files

8b45fadead80513ca47c05dc08531950N.exe
.exe windows:5 windows x86 arch:x86

5dde073b4aff9186120418673221cddb

Code Sign

01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14/01/2020, 00:00

Not After

20/01/2021, 12:00

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:6e:de:36:46:25:fc:c0:ef:95:5e:52:d2:f2:d2:b2
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2020, 00:00

Not After

20/01/2021, 12:00

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:41:61:56:60:a0:a9:f2:a8:1c:17:bb:34:2f:bf:0d:cc:31:e1:3e:4b:be:eb:82:9f:1d:1d:24:5b:6f:59:42
Signer

Actual PE Digest

65:41:61:56:60:a0:a9:f2:a8:1c:17:bb:34:2f:bf:0d:cc:31:e1:3e:4b:be:eb:82:9f:1d:1d:24:5b:6f:59:42

Digest Algorithm

sha256

PE Digest Matches

false

90:db:63:db:39:5c:65:b2:3f:80:eb:b9:06:d5:33:ee:4e:7f:2a:4e
Signer

Actual PE Digest

90:db:63:db:39:5c:65:b2:3f:80:eb:b9:06:d5:33:ee:4e:7f:2a:4e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\QShuru\release_line\client\Release\QQPYLiveup.pdb

Imports

kernel32

LeaveCriticalSection
InitializeCriticalSection
OpenProcess
TerminateThread
CreateThread
DeleteCriticalSection
CreateProcessW
SetFileAttributesW
CopyFileW
Sleep
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
GetFileAttributesExW
TryEnterCriticalSection
DeleteFileW
CreateMutexW
GetCommandLineW
EnterCriticalSection
GetModuleHandleA
GetModuleFileNameA
ReadFile
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
VirtualQuery
lstrcpyW
GetCurrentProcessId
GetCurrentThread
FormatMessageW
GetCurrentThreadId
CreateFileW
WriteFile
IsBadWritePtr
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
TerminateProcess
MapViewOfFileEx
CreateFileMappingW
GetFileSize
GetLocalTime
UnmapViewOfFile
SetFilePointer
CloseHandle
GlobalFree
GlobalAlloc
SetEvent
GetLastError
CreateEventW
GetVersionExW
GetFileAttributesW
MoveFileExW
WideCharToMultiByte
GetTickCount
WaitForSingleObject
FindClose
WaitForMultipleObjects
GetModuleFileNameW
GetCurrentProcess
FindNextFileW
FindFirstFileW
HeapSize
WriteConsoleW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
FindNextFileA
FindFirstFileA
GetFileType
PeekNamedPipe
GetStdHandle
ExpandEnvironmentStringsA
FormatMessageA
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
VerifyVersionInfoA
ExitProcess
lstrcpyA
GetSystemDirectoryA
CreateFileA
CopyFileA
lstrcatA
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
GetStringTypeW
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
InterlockedDecrement
InterlockedIncrement
GetSystemTime
QueryDosDeviceW
GetLogicalDrives
DeviceIoControl
GetDiskFreeSpaceExW
GetDriveTypeW
LocalAlloc
GetSystemDirectoryW
GetFileTime
SetEndOfFile
ProcessIdToSessionId
LocalFree
FileTimeToSystemTime
HeapFree
GetProcessHeap
lstrlenA
HeapAlloc

user32

GetDC
KillTimer
PostThreadMessageW
TranslateMessage
SetTimer
DispatchMessageW
GetMessageW
PtInRect
PostQuitMessage
IsIconic
PostMessageW
DrawTextW
SendMessageW
SystemParametersInfoW
ReleaseDC
DestroyWindow
GetWindowTextW
GetGUIThreadInfo
GetParent
GetSystemMetrics
IsWindowVisible
GetWindowRect
GetWindowThreadProcessId
GetWindowLongW
MessageBoxW
LoadImageW
wvsprintfW
ShowWindow
IsWindow
MonitorFromPoint
GetMonitorInfoW
GetCursorPos
LoadIconW
IsCharAlphaNumericW
wsprintfA
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
GetClientRect
SetCursor
SetCapture
LoadCursorW
SetPropW
IsWindowEnabled
TrackMouseEvent
RegisterClassExW
NotifyWinEvent
UnregisterClassW
ScreenToClient
CreateWindowExW
GetPropW
SetWindowPos
CallWindowProcW
GetKeyState
DefWindowProcW
GetDesktopWindow
UpdateLayeredWindow
FindWindowW
GetWindow
MapWindowPoints
MonitorFromWindow

gdi32

GetFontData
SelectObject
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
SetTextColor
SetBkMode
CreateFontIndirectW
DeleteObject

advapi32

RegOpenKeyExA
CryptGenRandom
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
GetLengthSid
AddAccessAllowedAceEx
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyExW
RegQueryValueExA
CryptAcquireContextW
CryptReleaseContext
OpenProcessToken
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
RegOpenKeyW
RegQueryValueExW

shell32

SHCreateDirectoryExW
SHFileOperationW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
Shell_NotifyIconW

ole32

CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoCreateInstance
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

imm32

ImmDisableIME

psapi

GetModuleFileNameExA
GetModuleFileNameExW

msimg32

AlphaBlend

ws2_32

WSACleanup
WSAGetLastError
htonl
recv
send
setsockopt
getsockopt
connect
ntohs
socket
getsockname
ntohl
WSASetLastError
closesocket
WSAStartup
htons
gethostname
accept
listen
recvfrom
sendto
getaddrinfo
freeaddrinfo
ioctlsocket
__WSAFDIsSet
select
WSAIoctl
bind
getpeername

wldap32

ord41
ord217
ord60
ord200
ord46
ord22
ord301
ord211
ord27
ord79
ord32
ord35
ord30
ord26
ord33
ord143
ord50

netapi32

Netbios
NetApiBufferFree
NetWkstaTransportEnum

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

HttpQueryInfoW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
InternetQueryOptionA

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 339KB - Virtual size: 339KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5dde073b4aff9186120418673221cddb

Code Sign

01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8eCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:6e:de:36:46:25:fc:c0:ef:95:5e:52:d2:f2:d2:b2Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

65:41:61:56:60:a0:a9:f2:a8:1c:17:bb:34:2f:bf:0d:cc:31:e1:3e:4b:be:eb:82:9f:1d:1d:24:5b:6f:59:42Signer

90:db:63:db:39:5c:65:b2:3f:80:eb:b9:06:d5:33:ee:4e:7f:2a:4eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

imm32

psapi

msimg32

ws2_32

wldap32

netapi32

wtsapi32

wininet

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 339KB - Virtual size: 339KB

.data Size: 41KB - Virtual size: 95KB

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 243KB - Virtual size: 243KB

01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:6e:de:36:46:25:fc:c0:ef:95:5e:52:d2:f2:d2:b2
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

65:41:61:56:60:a0:a9:f2:a8:1c:17:bb:34:2f:bf:0d:cc:31:e1:3e:4b:be:eb:82:9f:1d:1d:24:5b:6f:59:42
Signer

90:db:63:db:39:5c:65:b2:3f:80:eb:b9:06:d5:33:ee:4e:7f:2a:4e
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 339KB - Virtual size: 339KB

.data
Size: 41KB - Virtual size: 95KB

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 243KB - Virtual size: 243KB