Talking_Points_for_China[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Talking_Points_for_China.exe
Size

500KB
MD5

c790ebfcb6a34953a371e32c9174fe46
SHA1

3ead08d8bbdb3afd851877cb50507b77ae18a4d8
SHA256

fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1
SHA512

74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554
SSDEEP

6144:79UJaPbttKBfvX/b9NX7NVdRbjCNK617o41Nptp7Nu+1:7qkbtts3X/b9NX7NVdtC37p7NuK

Score

1^/10

Malware Config

Signatures

Files

Talking_Points_for_China.exe
.exe windows:5 windows x86 arch:x86

5007e16b49e5fb060b690c46cb9316e8

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:f1:e5:b8:82:61:50:a7:8a:17:26:9c
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

15/10/2020, 15:19

Not After

15/11/2023, 15:19

Subject

SERIALNUMBER=P03000012052,CN=QFX Software Corporation,O=QFX Software Corporation,STREET=1573 Katie Cv,L=Sanford,ST=Florida,C=US,1.2.840.113549.1.9.1=#0c17716678736f667440716678736f6674776172652e636f6d,1.3.6.1.4.1.311.60.2.1.2=#1307466c6f72696461,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ee:40:c1:84:d0:80:f6:fb:58:11:36:9b:1f:50:cc:5e:d9:15:88:a0:95:20:97:71:cc:f2:84:f7:81:12:63:06
Signer

Actual PE Digest

ee:40:c1:84:d0:80:f6:fb:58:11:36:9b:1f:50:cc:5e:d9:15:88:a0:95:20:97:71:cc:f2:84:f7:81:12:63:06

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\qzwang\Documents\workspace\InputSafe\winsrc\browser\InputSafeOmni\Release\KeyScrambler.pdb

Imports

keyscramblerie

KSOptions
KSPromptForKey
KSSetKeyInfo
KSUpdate
KSSetOption
KSInit
KSUninit

kernel32

GetModuleHandleExW
OpenEventW
FlushInstructionCache
GetCurrentThreadId
lstrlenW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateFileW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
ResetEvent
SetEvent
Sleep
CreateEventW
SetEndOfFile
CreateFileA
SetStdHandle
GetProcAddress
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
IsValidCodePage
GetOEMCP
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
FatalAppExitA
GetFileType
SetHandleCount
HeapSize
HeapReAlloc
GetStdHandle
WriteFile
GetCurrentProcess
FreeLibrary
OpenProcess
WaitForSingleObject
CloseHandle
DeleteFileW
WriteConsoleW
LocalFree
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
VirtualAlloc
EnterCriticalSection
RaiseException
InterlockedPopEntrySList
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
RtlUnwind
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
WideCharToMultiByte
GetStartupInfoW
HeapSetInformation
ExitProcess
GetACP
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
GetCommandLineW

user32

GetClassInfoExW
LoadCursorW
DefWindowProcW
SetWindowLongW
LoadBitmapW
UpdateWindow
SetWindowRgn
MessageBoxW
BroadcastSystemMessageW
EndPaint
BeginPaint
CallWindowProcW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
KillTimer
SetTimer
PostMessageW
GetWindowLongW
RegisterClassExW
CreateWindowExW
DestroyWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA

gdi32

BitBlt
SelectObject
CreateCompatibleDC
DeleteObject
GetObjectW
CreateRoundRectRgn
DeleteDC

advapi32

RegOpenKeyExW
GetSecurityDescriptorSacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

PathCombineW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

Sections

.text
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5007e16b49e5fb060b690c46cb9316e8

Code Sign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

7a:f1:e5:b8:82:61:50:a7:8a:17:26:9cCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

ee:40:c1:84:d0:80:f6:fb:58:11:36:9b:1f:50:cc:5e:d9:15:88:a0:95:20:97:71:cc:f2:84:f7:81:12:63:06Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

keyscramblerie

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 192KB - Virtual size: 191KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 245KB - Virtual size: 245KB

.reloc Size: 10KB - Virtual size: 10KB

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

7a:f1:e5:b8:82:61:50:a7:8a:17:26:9c
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

ee:40:c1:84:d0:80:f6:fb:58:11:36:9b:1f:50:cc:5e:d9:15:88:a0:95:20:97:71:cc:f2:84:f7:81:12:63:06
Signer

.text
Size: 192KB - Virtual size: 191KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 245KB - Virtual size: 245KB

.reloc
Size: 10KB - Virtual size: 10KB