c7b9124f381eab2bbf5bfe5099e20d8ab97916e721ce636d12c9b6c0ea660d5d

Sharing

Copy URL

Twitter E-mail

General

Target

c7b9124f381eab2bbf5bfe5099e20d8ab97916e721ce636d12c9b6c0ea660d5d
Size

1.2MB
MD5

8c05ed36597ccfdea266dcaf6ed13560
SHA1

224539ac3df5176af4c6452970d2b72e01fe6eb8
SHA256

c7b9124f381eab2bbf5bfe5099e20d8ab97916e721ce636d12c9b6c0ea660d5d
SHA512

e5203caf52dd4b6323599f839b1c6508d88108a6c542b65cefd836eaf61c0e035ca76e550554ca23f24b3aa406a21f7b1d4dcb60ac37097c281f3cf5e3290a3c
SSDEEP

24576:r4d6BXjg0V1ZZjA4mBmtIt8+akUKhTuA2YgEEfg:rCMTg0VbumtIt8+anito

Score

1^/10

Malware Config

Signatures

Files

c7b9124f381eab2bbf5bfe5099e20d8ab97916e721ce636d12c9b6c0ea660d5d
.dll windows:4 windows x86 arch:x86

7afaea75df24fe9f6c69879141e96508

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

11/12/2023, 00:00

Not After

30/12/2024, 23:59

Subject

SERIALNUMBER=9111000070003202XF,CN=Feitian Technologies Co.\, Ltd.,O=Feitian Technologies Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:0d:33:7f:9a:67:b0:51:54:31:08:40:b1:80:b6:01:1d:28:7b:27:9d:69:61:83:88:d9:99:cc:5b:4f:a4:da
Signer

Actual PE Digest

8e:0d:33:7f:9a:67:b0:51:54:31:08:40:b1:80:b6:01:1d:28:7b:27:9d:69:61:83:88:d9:99:cc:5b:4f:a4:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFindExtension
CryptDecodeObject
CryptVerifyCertificateSignature
CertGetNameStringW
CertCreateCertificateContext
CertFreeCertificateContext

msimg32

AlphaBlend

msvcrt

memcmp
__CxxFrameHandler
??3@YAXPAX@Z
memset
wcscmp
_wcslwr
isalnum
_wfopen
??1exception@@UAE@XZ
strncpy
wcslen
_wcsupr
toupper
strcpy
strlen
difftime
_purecall
??0exception@@QAE@XZ
memcpy
_wcsicmp
_except_handler3
rand
srand
time
wcscat
_wsplitpath
sprintf
??2@YAPAXI@Z
memmove
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_strcmpi
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_EH_prolog
sscanf
strstr
_stricmp
fseek
ftell
fread
fopen
fclose
fwrite
fgets
malloc
free
printf
_sleep
_endthreadex
_beginthreadex
_ftol
abs
swprintf
strcat
isprint
localtime
strftime
_vsnprintf
_wtol
wcscpy
strcmp

msvcp60

?move@?$char_traits@G@std@@SAPAGPAGPBGI@Z
?assign@?$char_traits@G@std@@SAXAAGABG@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?compare@?$char_traits@G@std@@SAHPBG0I@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?length@?$char_traits@G@std@@SAIPBG@Z
?eq@?$char_traits@G@std@@SA_NABG0@Z
?move@?$char_traits@D@std@@SAPADPADPBDI@Z
?eq@?$char_traits@D@std@@SA_NABD0@Z
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
?assign@?$char_traits@G@std@@SAPAGPAGIABG@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z

mfc42u

ord6376
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord4616
ord4418
ord3733
ord561
ord815
ord3948
ord2717
ord858
ord5706
ord5679
ord538
ord1808
ord795
ord6051
ord1768
ord5286
ord3397
ord3716
ord567
ord4155
ord5977
ord4279
ord2858
ord3084
ord2859
ord2108
ord640
ord5785
ord323
ord1633
ord613
ord609
ord6316
ord2070
ord535
ord289
ord2567
ord4390
ord3569
ord1761
ord5446
ord6390
ord5436
ord6379
ord860
ord5871
ord5777
ord3701
ord536
ord2559
ord2746
ord6211
ord6466
ord1172
ord2078
ord2634
ord693
ord2281
ord2294
ord6896
ord6898
ord3281
ord2606
ord2293
ord4118
ord755
ord470
ord2574
ord4396
ord3365
ord3635
ord6003
ord269
ord826
ord600
ord1571
ord1250
ord1248
ord1563
ord1194
ord1240
ord342
ord1179
ord1570
ord1568
ord1173
ord1115
ord6193
ord2371
ord2637
ord6451
ord6195
ord3087
ord6330
ord5947
ord2362
ord1143
ord1165
ord540
ord861
ord800
ord4470
ord2855
ord1634
ord4704
ord4282
ord4294
ord4229
ord2406
ord3658
ord3621
ord3568
ord324
ord641
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4847
ord4370
ord5261
ord3697
ord501
ord773
ord1083
ord4128
ord4292
ord2810
ord537
ord6640
ord5596
ord5568
ord3871
ord5784
ord472
ord2854
ord2966
ord5755
ord6188
ord5752
ord6182
ord941
ord6770
ord4124
ord3688
ord2910
ord283
ord3614
ord5781
ord4324
ord3566
ord3591
ord5860
ord6057
ord5567
ord5575
ord5732
ord5674
ord5790
ord5869
ord6168
ord6017
ord6185

kernel32

GetTempPathW
DeleteFileW
CreateThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
DeviceIoControl
FormatMessageA
GlobalAlloc
GlobalFree
GetProcessHeap
HeapAlloc
HeapFree
TlsGetValue
IsBadReadPtr
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
OutputDebugStringW
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
OpenMutexW
CreateMutexW
WaitForSingleObject
SetEvent
OpenEventW
CreateEventW
GetSystemInfo
lstrcmpiW
lstrcatW
GetTickCount
GetStdHandle
SetConsoleTextAttribute
GetFileSize
ReadFile
GetCurrentThreadId
LocalAlloc
LocalFree
SetUnhandledExceptionFilter
GetCurrentProcessId
OpenProcess
GetCurrentThread
GetVersionExW
CompareFileTime
lstrlenW
GetSystemDirectoryW
GetShortPathNameW
lstrcmpW
VirtualQuery
GetVersion
GetFileAttributesW
GetModuleHandleA
OutputDebugStringA
LoadLibraryW
SetLastError
CreateFileW
WaitForMultipleObjects
GetLastError
Sleep
FreeLibrary
GetModuleFileNameW
GetUserDefaultUILanguage
TlsFree
TlsAlloc
GetModuleHandleW
GetProcAddress
lstrcpyW
GetCurrentProcess
CloseHandle

user32

GetDC
ReleaseDC
GetActiveWindow
SwitchDesktop
SystemParametersInfoW
CloseDesktop
GetDesktopWindow
EnableWindow
GetSystemMetrics
GetThreadDesktop
IsDlgButtonChecked
CheckDlgButton
GetWindowRect
GetClientRect
CreateDesktopW
MessageBoxW
EndDialog
GetDlgItem
IsWindowEnabled
DialogBoxParamW
SetThreadDesktop
UpdateWindow
PtInRect
InflateRect
GetSysColor
IsWindowVisible
GetWindowTextLengthW
GetAsyncKeyState
GetKeyboardState
ToAscii
GetWindowLongW
GetParent
SetPropW
CallWindowProcW
GetPropW
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
SetWindowTextW
GetWindow
GetDlgCtrlID
GetClassNameW
GetWindowThreadProcessId
AttachThreadInput
SetFocus
SetWindowPos
SetActiveWindow
GetWindowTextW
EnumWindows
BroadcastSystemMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassW
SetWindowLongW
DefWindowProcW
IsWindow
PostMessageW
ShowWindow
GetMessageW
DispatchMessageW
wsprintfW
MapDialogRect
GetIconInfo
GetFocus
SetForegroundWindow
GetSystemMenu
EnableMenuItem
MessageBeep
DestroyIcon
FillRect
CopyRect
TabbedTextOutW
DrawTextW
GrayStringW
SetRect
SetWindowRgn
CreateDesktopA
OpenDesktopA
GetPropA
SetPropA
SetWindowTextA
InvalidateRect
FindWindowW
GetForegroundWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
KillTimer
SendMessageW
SetTimer
LoadIconW
RegisterWindowMessageW
TranslateMessage

gdi32

Ellipse
GetObjectW
CreateDCW
GetTextExtentPoint32W
CreateEllipticRgn
Arc
CreateSolidBrush
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
CreateFontW
GetDIBits
CreatePatternBrush
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
DeleteObject
SelectObject
CreateRectRgnIndirect
GetStockObject

advapi32

CopySid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CloseServiceHandle
DeleteService
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
SetNamedSecurityInfoW
GetSecurityInfo
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
EqualSid
LookupAccountSidW
FreeSid
GetLengthSid
GetAce
GetAclInformation
RegOpenKeyW

shell32

SHChangeNotify
ShellExecuteExW

ole32

CoCreateGuid

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces

shlwapi

StrStrIW

imm32

ImmDisableIME

Exports

Exports

CPAcquireContext
CPCreateHash
CPDecrypt
CPDeriveKey
CPDestroyHash
CPDestroyKey
CPEncrypt
CPExportKey
CPGenKey
CPGenRandom
CPGetHashParam
CPGetKeyParam
CPGetProvParam
CPGetUserKey
CPHashData
CPHashSessionKey
CPImportKey
CPReleaseContext
CPSetHashParam
CPSetKeyParam
CPSetProvParam
CPSignHash
CPVerifySignature
C_CancelFunction
C_CloseAllSessions
C_CloseSession
C_CopyObject
C_CreateObject
C_Decrypt
C_DecryptDigestUpdate
C_DecryptFinal
C_DecryptInit
C_DecryptUpdate
C_DecryptVerifyUpdate
C_DeriveKey
C_DestroyObject
C_Digest
C_DigestEncryptUpdate
C_DigestFinal
C_DigestInit
C_DigestKey
C_DigestUpdate
C_Encrypt
C_EncryptFinal
C_EncryptInit
C_EncryptUpdate
C_Finalize
C_FindObjects
C_FindObjectsFinal
C_FindObjectsInit
C_GenerateKey
C_GenerateKeyPair
C_GenerateRandom
C_GetAttributeValue
C_GetFunctionList
C_GetFunctionStatus
C_GetInfo
C_GetMechanismInfo
C_GetMechanismList
C_GetObjectSize
C_GetOperationState
C_GetSessionInfo
C_GetSlotInfo
C_GetSlotList
C_GetTokenInfo
C_InitPIN
C_InitToken
C_Initialize
C_Login
C_Logout
C_OpenSession
C_SeedRandom
C_SetAttributeValue
C_SetOperationState
C_SetPIN
C_Sign
C_SignEncryptUpdate
C_SignFinal
C_SignInit
C_SignRecover
C_SignRecoverInit
C_SignUpdate
C_UnwrapKey
C_Verify
C_VerifyFinal
C_VerifyInit
C_VerifyRecover
C_VerifyRecoverInit
C_VerifyUpdate
C_WaitForSlotEvent
C_WrapKey
E_GetAuxFunctionList
SKF_ChangePIN
SKF_ClearSecureState
SKF_CloseApplication
SKF_CloseContainer
SKF_CloseHandle
SKF_ConnectDev
SKF_CreateContainer
SKF_DeleteContainer
SKF_Digest
SKF_DigestFinal
SKF_DigestInit
SKF_DigestUpdate
SKF_DisConnectDev
SKF_ECCSignData
SKF_EnumApplication
SKF_EnumContainer
SKF_EnumDev
SKF_ExportCertificate
SKF_ExportPublicKey
SKF_ExtECCVerify
SKF_GenECCKeyPair
SKF_GenRSAKeyPair
SKF_GetContainerType
SKF_GetDevInfo
SKF_GetDevState
SKF_GetPINInfo
SKF_ImportCertificate
SKF_ImportECCKeyPair
SKF_ImportRSAKeyPair
SKF_LockDev
SKF_OpenApplication
SKF_OpenContainer
SKF_RSASignData
SKF_SetLabel
SKF_UnblockPIN
SKF_UnlockDev
SKF_VerifyPIN
eb_RunNoElevated
eb_service

Sections

.text
Size: 886KB - Virtual size: 885KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ve_share
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7afaea75df24fe9f6c69879141e96508

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8e:0d:33:7f:9a:67:b0:51:54:31:08:40:b1:80:b6:01:1d:28:7b:27:9d:69:61:83:88:d9:99:cc:5b:4f:a4:daSigner

Headers

File Characteristics

Imports

crypt32

msimg32

msvcrt

msvcp60

mfc42u

kernel32

user32

gdi32

advapi32

shell32

ole32

setupapi

shlwapi

imm32

Exports

Exports

Sections

.text Size: 886KB - Virtual size: 885KB

.rdata Size: 125KB - Virtual size: 124KB

.data Size: 74KB - Virtual size: 103KB

ve_share Size: 2KB - Virtual size: 1KB

.rsrc Size: 106KB - Virtual size: 106KB

.reloc Size: 41KB - Virtual size: 41KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

04:1c:b9:ae:fa:dd:da:f7:85:7b:64:8c:c1:54:95:e8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8e:0d:33:7f:9a:67:b0:51:54:31:08:40:b1:80:b6:01:1d:28:7b:27:9d:69:61:83:88:d9:99:cc:5b:4f:a4:da
Signer

.text
Size: 886KB - Virtual size: 885KB

.rdata
Size: 125KB - Virtual size: 124KB

.data
Size: 74KB - Virtual size: 103KB

ve_share
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 106KB - Virtual size: 106KB

.reloc
Size: 41KB - Virtual size: 41KB