349caa408b1419fa56d399d1ff0238b85f3610a6a0fb7c591c6d74a2343f07d4

Sharing

Copy URL Twitter E-mail

General

Target

349caa408b1419fa56d399d1ff0238b85f3610a6a0fb7c591c6d74a2343f07d4
Size

2.4MB
MD5

e2150b61a1a066b3c0d0f6eb8b12b25c
SHA1

07e539c03dbec1f3592412105715266261036e84
SHA256

349caa408b1419fa56d399d1ff0238b85f3610a6a0fb7c591c6d74a2343f07d4
SHA512

11a3e505430c3391e4b838294f5426b189be469ba22ac7781c1ff0d5b278b1e5151b6810333f886e8ac444b92fe8c43120c1911fad1e5e510a40a5d29f36ceec
SSDEEP

49152:ZdiFdzTlm4gvVIE39hnLjP6Oc2wqf20PL:ZQFdzTI4SVIENMIwqO0

Score

1^/10

Malware Config

Signatures

Files

349caa408b1419fa56d399d1ff0238b85f3610a6a0fb7c591c6d74a2343f07d4
.exe windows:5 windows x86 arch:x86

8cda7f949c37849270f8119202a0eeb2

Code Sign

01:0b:0a:87:4d:e8:39:4c:73:9a:31:7c:51:80:fc:e0
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/04/2020, 00:00

Not After

21/04/2023, 12:00

Subject

CN=Shenzhen DriveTheLife Software Technology Co.Ltd,O=Shenzhen DriveTheLife Software Technology Co.Ltd,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:1b:fc:20:0d:7a:09:4f:68:85:e6:4d:c0:f0:df:07
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17/04/2020, 00:00

Not After

21/04/2023, 12:00

Subject

CN=Shenzhen DriveTheLife Software Technology Co.Ltd,O=Shenzhen DriveTheLife Software Technology Co.Ltd,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

19/05/2021, 05:42

Not After

18/05/2032, 05:42

Subject

CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:cc:d1:55:4d:f1:a4:7a:a6:f3:cb:f0:98:0c:8b:62:35:b8:43:b5:a4:2d:67:6f:4c:a4:38:79:97:70:08:e9
Signer

Actual PE Digest

0a:cc:d1:55:4d:f1:a4:7a:a6:f3:cb:f0:98:0c:8b:62:35:b8:43:b5:a4:2d:67:6f:4c:a4:38:79:97:70:08:e9

Digest Algorithm

sha256

PE Digest Matches

false

98:ad:26:0f:eb:cc:a0:64:36:09:d1:66:a5:f3:83:98:41:12:46:b1
Signer

Actual PE Digest

98:ad:26:0f:eb:cc:a0:64:36:09:d1:66:a5:f3:83:98:41:12:46:b1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\WorkCode\PC\Shutters\trunk_Chinese\bin\Release_En\UserFeedback.pdb

Imports

kernel32

GetFileAttributesW
DecodePointer
RaiseException
WriteFile
CreateMutexW
OpenMutexW
CreateFileW
SetFileAttributesW
GetCommandLineW
CloseHandle
GetFileAttributesExW
GetSystemDirectoryA
LoadLibraryA
GetTimeZoneInformation
CreateThread
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
GetPrivateProfileStringW
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
CreateDirectoryW
GetLastError
GetCurrentDirectoryW
GetModuleHandleW
LoadLibraryW
GetCurrentProcess
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetPrivateProfileStringA
GetModuleHandleExA
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
GetModuleFileNameA
GetLocalTime
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetStdHandle
GetFullPathNameW
DeleteFileW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
InterlockedDecrement
InterlockedIncrement
DosDateTimeToFileTime
SystemTimeToFileTime
LeaveCriticalSection
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
GetCPInfo
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
MulDiv
GetACP
IsBadReadPtr
FreeResource
GetFileSize
ReadFile
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
GetModuleFileNameW

user32

SetForegroundWindow
FindWindowW
ShowWindow
KillTimer
SetTimer
IsZoomed
IsHungAppWindow
SetWindowTextW
ClientToScreen
InvalidateRgn
CreateAcceleratorTableW
MoveWindow
GetWindowTextLengthW
GetWindowTextW
DrawIconEx
DestroyIcon
GetSysColor
GetCaretPos
GetDesktopWindow
RedrawWindow
GetWindowDC
PostQuitMessage
PostMessageW
CharNextW
SetWindowPos
SendMessageW
GetMonitorInfoW
FillRect
DrawTextW
CharPrevW
MapWindowPoints
SetCaretPos
SetCursor
SetRect
CopyRect
InflateRect
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
IsIconic
SetFocus
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
GetClientRect
GetWindowRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
ShowCaret
MonitorFromWindow
IsWindowVisible
BringWindowToTop
SetWindowRgn
ScreenToClient
DestroyWindow
UpdateLayeredWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetCursorPos
CreateCaret
HideCaret

comdlg32

GetOpenFileNameW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
OleLockRunning

shlwapi

PathRemoveFileSpecW
PathCombineW
PathFileExistsW

ws2_32

WSAGetLastError
connect
htonl
htons
inet_addr
inet_ntoa
ntohs
recv
send
socket
gethostbyaddr
gethostbyname
getservbyport
closesocket
WSASetLastError
WSACleanup
WSAStartup
getservbyname

dnsapi

DnsQuery_W
DnsFree

gdiplus

GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipSetInterpolationMode
GdipReleaseDC
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateLineBrushI
GdipCreateStringFormat
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusStartup
GdipDrawImageRectRect
GdipDrawImageRectI

msimg32

AlphaBlend

comctl32

_TrackMouseEvent
ord17

gdi32

DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreateRoundRectRgn
DeleteDC
EnumFontFamiliesW
GetStockObject
Rectangle
RestoreDC
SaveDC
CreatePen
GetTextMetricsW
CreateDIBSection
GetObjectW
SetWindowOrgEx
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPointW
PatBlt
LineTo
RoundRect
SelectClipRgn
SelectObject
GetTextExtentPoint32W
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GetDeviceCaps

oleaut32

VariantClear
SysFreeString
VariantInit
SysAllocString

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

Sections

.text
Size: 776KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 465KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 980KB - Virtual size: 980KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8cda7f949c37849270f8119202a0eeb2

Code Sign

01:0b:0a:87:4d:e8:39:4c:73:9a:31:7c:51:80:fc:e0Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0b:1b:fc:20:0d:7a:09:4f:68:85:e6:4d:c0:f0:df:07Certificate

Extended Key Usages

Key Usages

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

0a:cc:d1:55:4d:f1:a4:7a:a6:f3:cb:f0:98:0c:8b:62:35:b8:43:b5:a4:2d:67:6f:4c:a4:38:79:97:70:08:e9Signer

98:ad:26:0f:eb:cc:a0:64:36:09:d1:66:a5:f3:83:98:41:12:46:b1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

comdlg32

advapi32

shell32

ole32

shlwapi

ws2_32

dnsapi

gdiplus

msimg32

comctl32

gdi32

oleaut32

imm32

Sections

.text Size: 776KB - Virtual size: 776KB

.rdata Size: 182KB - Virtual size: 181KB

.data Size: 10KB - Virtual size: 34KB

.gfids Size: 512B - Virtual size: 408B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 465KB - Virtual size: 464KB

.reloc Size: 980KB - Virtual size: 980KB

01:0b:0a:87:4d:e8:39:4c:73:9a:31:7c:51:80:fc:e0
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0b:1b:fc:20:0d:7a:09:4f:68:85:e6:4d:c0:f0:df:07
Certificate

f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

0a:cc:d1:55:4d:f1:a4:7a:a6:f3:cb:f0:98:0c:8b:62:35:b8:43:b5:a4:2d:67:6f:4c:a4:38:79:97:70:08:e9
Signer

98:ad:26:0f:eb:cc:a0:64:36:09:d1:66:a5:f3:83:98:41:12:46:b1
Signer

.text
Size: 776KB - Virtual size: 776KB

.rdata
Size: 182KB - Virtual size: 181KB

.data
Size: 10KB - Virtual size: 34KB

.gfids
Size: 512B - Virtual size: 408B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 465KB - Virtual size: 464KB

.reloc
Size: 980KB - Virtual size: 980KB