95998efa4f9bd641ce623767edeba621_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

95998efa4f9bd641ce623767edeba621_JaffaCakes118
Size

364KB
MD5

95998efa4f9bd641ce623767edeba621
SHA1

06d3cb4bd5a11352d1dfafdf65a899e687ab0897
SHA256

3f643eaa0d412d97d3cfe4cd763e1653094a6cfcee551574ffd92fc35f1563cc
SHA512

a1471b09deec3110fad4dd237e73ea523cc4dfb7bb5662b2ea8587ab81ebdc4888fa1877861e5c3ccabb3a5d1f2acd4f3e9f106c759f719ce7d666ab76506df2
SSDEEP

6144:ypPWstrgwuRSwDoph7ms8VxOsYCHACUqaWkK2ej39PbFWH9vYhLqs3TxK1:ypPtrg3S3r7mcsYCgCUFWTFI9oLT3tK1

Score

1^/10

Malware Config

Signatures

Files

95998efa4f9bd641ce623767edeba621_JaffaCakes118
.rar
QMUpdate.exe
.exe windows:4 windows x86 arch:x86

0bf9df53ce96da572802da80d230ea84

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

24/06/2009, 00:00

Not After

23/06/2012, 23:59

Subject

CN=Beijing Lihuacheng Inc.,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing Lihuacheng Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

37:13:2e:98:9d:23:29:9e:df:68:cf:c3:e5:e4:e7:b5:16:c1:be:e6
Signer

Actual PE Digest

37:13:2e:98:9d:23:29:9e:df:68:cf:c3:e5:e4:e7:b5:16:c1:be:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3402
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3698
ord765
ord2614
ord567
ord4275
ord860
ord2379
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3706
ord3571
ord1776
ord755
ord640
ord5785
ord2414
ord6172
ord5781
ord1641
ord5875
ord2754
ord6194
ord1640
ord323
ord470
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord641
ord795
ord609
ord2514
ord2621
ord1134
ord5265
ord4998
ord6052
ord1775
ord5280
ord4425
ord3597
ord2575
ord4396
ord3574
ord3721
ord1146
ord1168
ord324
ord2302
ord4234
ord6199
ord537
ord1105
ord4710
ord4224
ord4078
ord6055
ord6394
ord5450
ord823
ord2044
ord5834
ord2818
ord6663
ord6282
ord2764
ord4277
ord535
ord858
ord924
ord800
ord2448
ord825
ord533
ord540
ord798
ord3626
ord3663
ord1576

msvcrt

_setmbcp
__dllonexit
_onexit
_exit
_XcptFilter
_controlfp
_except_handler3
exit
malloc
_ftol
_mbsnbcpy
_mbscmp
__CxxFrameHandler
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln

kernel32

GetStartupInfoA
GetFileAttributesA
GetCommandLineA
GetTempPathA
GetCurrentDirectoryA
GetModuleHandleA
DeleteFileA
WinExec

user32

IsWindow
InvalidateRect
TabbedTextOutA
DrawTextA
GetSysColor
RedrawWindow
GetClientRect
IsIconic
GetSystemMetrics
DrawIcon
SendMessageA
MessageBoxA
LoadIconA
EnableWindow
GrayStringA

gdi32

ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
BitBlt
Escape

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0Init@ios_base@std@@QAE@XZ

wininet

DeleteUrlCacheEntry

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
QQMate.exe
.exe windows:4 windows x86 arch:x86

00b69c52bb08456d11703c8c5d8b2837

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

24/06/2009, 00:00

Not After

23/06/2012, 23:59

Subject

CN=Beijing Lihuacheng Inc.,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing Lihuacheng Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:40:7e:20:fe:df:4c:72:63:ad:b0:f8:8a:7d:4a:be:ae:3e:a8:39
Signer

Actual PE Digest

07:40:7e:20:fe:df:4c:72:63:ad:b0:f8:8a:7d:4a:be:ae:3e:a8:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\MyFiles\myProject\BullProject\QQFarm\release\QQMate.pdb

Imports

winmm

PlaySoundA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
GetFileAttributesA
GetFileTime
SetErrorMode
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
SetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
Sleep
GetTimeZoneInformation
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CreateFileW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
SetEnvironmentVariableA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
CloseHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
MoveFileA
GetCurrentProcessId
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
FormatMessageA
LocalFree
MulDiv
GetModuleFileNameW
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
SetLastError
lstrcmpW
GetModuleHandleA
GetVersionExA
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
InterlockedDecrement
HeapFree
GlobalAlloc
HeapAlloc
FreeLibrary
GetLocalTime
GetProcessHeap
CreateDirectoryA
DeleteFileA
SetFileAttributesA
GetTempPathA
CreateProcessA
GetCommandLineW
GlobalFree
FreeResource
GetPrivateProfileStringA
FindClose
FindNextFileA
FindFirstFileA
lstrcatA
lstrcpyA
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
GlobalUnlock
GlobalLock
SetThreadPriority
CreateThread
TerminateThread
WaitForSingleObject
GetTickCount
SizeofResource
LoadResource
GetModuleFileNameA
FindResourceA
WritePrivateProfileStringA
LockResource
GetLastError
lstrlenA
InterlockedExchange
GetVersion
CompareStringW
WideCharToMultiByte
CompareStringA
MultiByteToWideChar
HeapSize

user32

SetRect
InvalidateRgn
SetCapture
ReleaseCapture
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
CharNextA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetNextDlgTabItem
EndDialog
ReleaseDC
GetDC
SendDlgItemMessageA
WinHelpA
IsChild
IsRectEmpty
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageA
MapWindowPoints
TrackPopupMenu
IsWindowVisible
UpdateWindow
GetMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
OffsetRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
CopyIcon
ScreenToClient
GetMessagePos
DrawIcon
GetSystemMetrics
IsIconic
RegisterWindowMessageA
RegisterHotKey
AppendMenuA
SetClipboardData
UnregisterHotKey
GetSystemMenu
EmptyClipboard
CopyAcceleratorTableA
UnregisterClassA
GetSysColorBrush
DestroyMenu
SetWindowContextHelpId
MapDialogRect
GetSubMenu
LoadMenuA
GetMessageA
ValidateRect
PostQuitMessage
GetWindowThreadProcessId
GetCapture
SetForegroundWindow
IntersectRect
wsprintfA
InvalidateRect
KillTimer
GetWindowRect
GetCursorPos
SetCursor
SetTimer
GetSysColor
LoadCursorA
CopyRect
FillRect
MessageBeep
CloseClipboard
GetClipboardData
OpenClipboard
PostMessageA
DispatchMessageA
TranslateMessage
GetKeyState
GetFocus
GetClientRect
PtInRect
GetParent
GetWindowLongA
LoadIconA
CharUpperA
EnableWindow
SendMessageA
DestroyWindow

gdi32

TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
RectVisible
GetMapMode
GetRgnBox
PtVisible
GetWindowExtEx
GetViewportExtEx
CreateCompatibleDC
DeleteDC
SetDIBColorTable
GetObjectA
SelectObject
ExcludeClipRect
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetBkColor
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetStockObject
CreateRectRgnIndirect
CreateFontIndirectA
GetTextExtentPoint32A
GetTextColor
CreateSolidBrush
StretchBlt
DeleteObject
CreateDIBSection
SelectClipRgn

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegOpenKeyA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegQueryValueExA

shell32

CommandLineToArgvW
Shell_NotifyIconA
ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA

oledlg

ord8

ole32

CoTaskMemAlloc
CoCreateInstance
OleRun
CoInitialize
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoRegisterMessageFilter
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

OleLoadPicture
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
OleCreateFontIndirect
SysStringLen
SysAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SysFreeString
SysAllocString
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo

gdiplus

GdiplusStartup
GdipFree
GdiplusShutdown
GdipAlloc
GdipGetImageWidth
GdipCloneImage
GdipDisposeImage
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDrawImageI
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipDeleteGraphics

ws2_32

htonl

wininet

HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryDataAvailable

Sections

.text
Size: 532KB - Virtual size: 530KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
farm.dll
.dll windows:4 windows x86 arch:x86

0cbf970c7b2931021b41a9689023109b

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

24/06/2009, 00:00

Not After

23/06/2012, 23:59

Subject

CN=Beijing Lihuacheng Inc.,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing Lihuacheng Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9e:64:59:eb:9a:13:07:f3:d2:f3:84:36:18:f6:de:9a:60:ae:9e:ad
Signer

Actual PE Digest

9e:64:59:eb:9a:13:07:f3:d2:f3:84:36:18:f6:de:9a:60:ae:9e:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

msvbvm60

EVENT_SINK_GetIDsOfNames

Exports

Exports

ExpFunc

Sections

.text
Size: 28KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
parameters.ini
partner.ini
sound/新云软件.url
.url
sound/音频1.wav
sound/音频2.wav
sound/音频3.wav

Sharing

General

Malware Config

Signatures

Files

0bf9df53ce96da572802da80d230ea84

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

37:13:2e:98:9d:23:29:9e:df:68:cf:c3:e5:e4:e7:b5:16:c1:be:e6Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

shell32

urlmon

msvcp60

wininet

version

Sections

.text Size: 16KB - Virtual size: 12KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 828B

.rsrc Size: 20KB - Virtual size: 16KB

00b69c52bb08456d11703c8c5d8b2837

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

07:40:7e:20:fe:df:4c:72:63:ad:b0:f8:8a:7d:4a:be:ae:3e:a8:39Signer

Headers

File Characteristics

PDB Paths

Imports

winmm

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

ws2_32

wininet

Sections

.text Size: 532KB - Virtual size: 530KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 16KB - Virtual size: 1.1MB

.rsrc Size: 40KB - Virtual size: 38KB

0cbf970c7b2931021b41a9689023109b

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

37:13:2e:98:9d:23:29:9e:df:68:cf:c3:e5:e4:e7:b5:16:c1:be:e6
Signer

.text
Size: 16KB - Virtual size: 12KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 828B

.rsrc
Size: 20KB - Virtual size: 16KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

07:40:7e:20:fe:df:4c:72:63:ad:b0:f8:8a:7d:4a:be:ae:3e:a8:39
Signer

.text
Size: 532KB - Virtual size: 530KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 16KB - Virtual size: 1.1MB

.rsrc
Size: 40KB - Virtual size: 38KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

8b:04:0e:8a:26:4a:ff:09:6b:b1:da:2f:dd:78:22:b2
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

9e:64:59:eb:9a:13:07:f3:d2:f3:84:36:18:f6:de:9a:60:ae:9e:ad
Signer

.text
Size: 28KB - Virtual size: 100KB

.rsrc
Size: 6KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB