1048e0bbe8e2277cf0fcd1e68556af3dda6be66fb5a5b6d94eca9bdafa12429d

Sharing

Copy URL Twitter E-mail

General

Target

1048e0bbe8e2277cf0fcd1e68556af3dda6be66fb5a5b6d94eca9bdafa12429d
Size

587KB
MD5

db8d27df777a76db3e021e63671a3af4
SHA1

a7230af53589ed3c02885ae9e3a39574811221fb
SHA256

1048e0bbe8e2277cf0fcd1e68556af3dda6be66fb5a5b6d94eca9bdafa12429d
SHA512

30ddb03a212098969d6400ab8927fdf1c5f8cc45967a3cc6a8752459e510fb314e75a3a4d9763ea9c02fbb74f1e4c65db2e4684fb7dfb693da5230133eb01568
SSDEEP

6144:PfXms3pRL4+xNHvfQttg662z2RNiV3OxximssMm/BuCrWpG7q43tslGDrcVXAfh9:nmsPL4YAf2/iYDMiPeU5WcH8E

Score

1^/10

Malware Config

Signatures

Files

1048e0bbe8e2277cf0fcd1e68556af3dda6be66fb5a5b6d94eca9bdafa12429d
.dll windows:5 windows x64 arch:x64

94c0e75d0ff5ce3fb477a053a317dfbe

Code Sign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:64:5b:14:30:09:e6:10:22:3c:df:48
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

14/07/2023, 09:48

Not After

14/07/2026, 09:48

Subject

SERIALNUMBER=91370100MA3QA8QF0C,CN=Shandong Gooxion Software Co.\,Ltd.,O=Shandong Gooxion Software Co.\,Ltd.,STREET=舜华路1768号齐鲁软件大厦C604室,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:64:5b:14:30:09:e6:10:22:3c:df:48
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

14/07/2023, 09:48

Not After

14/07/2026, 09:48

Subject

SERIALNUMBER=91370100MA3QA8QF0C,CN=Shandong Gooxion Software Co.\,Ltd.,O=Shandong Gooxion Software Co.\,Ltd.,STREET=舜华路1768号齐鲁软件大厦C604室,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

02/11/2023, 10:30

Not After

04/12/2034, 10:30

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

dd:9a:a8:dc:73:a3:2e:b7:e1:53:01:61:41:16:bb:7f:b9:40:87:1d:69:69:8d:28:0f:f3:79:c6:71:64:66:2a
Signer

Actual PE Digest

dd:9a:a8:dc:73:a3:2e:b7:e1:53:01:61:41:16:bb:7f:b9:40:87:1d:69:69:8d:28:0f:f3:79:c6:71:64:66:2a

Digest Algorithm

sha256

PE Digest Matches

true

41:93:f3:d5:8f:a4:9f:e0:1d:a2:45:0e:53:1f:e6:03:35:f4:ba:89
Signer

Actual PE Digest

41:93:f3:d5:8f:a4:9f:e0:1d:a2:45:0e:53:1f:e6:03:35:f4:ba:89

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\po\trunk\modules\backup\Release\backup64.pdb

Imports

kernel32

GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
DeleteFileA
GetTempPathA
GetModuleFileNameA
GetVolumeInformationW
DebugBreak
TlsAlloc
TlsSetValue
GetTickCount
TlsGetValue
DisableThreadLibraryCalls
lstrcmpA
ReadFile
GetDriveTypeA
SetFilePointer
GetFileSize
CreateThread
lstrcpyW
DeleteFileW
CloseHandle
GetDiskFreeSpaceExW
DeleteCriticalSection
CreateIoCompletionPort
lstrcmpiW
GetLocalTime
EnterCriticalSection
lstrlenW
CreateFileW
lstrcpynW
LeaveCriticalSection
CreateEventA
CopyFileW
Sleep
InitializeCriticalSection
OutputDebugStringW
GetWindowsDirectoryW
GetFileTime
SetFileTime
lstrcpyA
Module32NextW
OpenEventW
GetFileAttributesExW
CreateToolhelp32Snapshot
FindNextFileW
GetWindowsDirectoryA
ReadDirectoryChangesW
GetLogicalDrives
SetEvent
WaitForSingleObject
GetQueuedCompletionStatus
GetDriveTypeW
GetModuleHandleA
Module32FirstW
DeviceIoControl
FindClose
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
HeapSize
GetModuleHandleW
GetProcAddress
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
WriteFile
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CreateFileA
FindFirstFileW
lstrlenA
VirtualQuery
lstrcpynA
SetEndOfFile
SystemTimeToFileTime
GetFileAttributesW
GetModuleFileNameW
lstrcmpW
GetCurrentDirectoryW
WriteConsoleW

shell32

SHGetSpecialFolderPathW
ord165

ole32

CoInitialize
CoCreateGuid

shlwapi

wnsprintfW
StrCmpNIW
PathIsDirectoryW
PathFindExtensionW
PathFindFileNameW
PathAddBackslashW
StrStrIW
SHDeleteValueW
PathFileExistsW
PathAppendW
StrCmpNW
PathMatchSpecW
PathRemoveBackslashW
PathFileExistsA
PathAppendA
wvnsprintfW
SHGetValueA
PathRemoveFileSpecW
SHSetValueW
StrChrA
wnsprintfA
wvnsprintfA
SHCreateStreamOnFileW
SHGetValueW
StrChrW

libcurl64

curl_slist_append
curl_free
curl_easy_setopt
curl_easy_perform
curl_easy_strerror
curl_easy_cleanup
curl_global_init
curl_easy_escape
curl_easy_getinfo
curl_formadd
curl_easy_reset
curl_easy_init
curl_slist_free_all
curl_formfree

advapi32

GetUserNameW
RegCloseKey
RegEnumValueW
RegOpenKeyExW

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94c0e75d0ff5ce3fb477a053a317dfbe

Code Sign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

2f:64:5b:14:30:09:e6:10:22:3c:df:48Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

2f:64:5b:14:30:09:e6:10:22:3c:df:48Certificate

Extended Key Usages

Key Usages

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

dd:9a:a8:dc:73:a3:2e:b7:e1:53:01:61:41:16:bb:7f:b9:40:87:1d:69:69:8d:28:0f:f3:79:c6:71:64:66:2aSigner

41:93:f3:d5:8f:a4:9f:e0:1d:a2:45:0e:53:1f:e6:03:35:f4:ba:89Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

ole32

shlwapi

libcurl64

advapi32

Sections

.text Size: 405KB - Virtual size: 404KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 15KB - Virtual size: 29KB

.pdata Size: 26KB - Virtual size: 25KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

2f:64:5b:14:30:09:e6:10:22:3c:df:48
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

2f:64:5b:14:30:09:e6:10:22:3c:df:48
Certificate

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

dd:9a:a8:dc:73:a3:2e:b7:e1:53:01:61:41:16:bb:7f:b9:40:87:1d:69:69:8d:28:0f:f3:79:c6:71:64:66:2a
Signer

41:93:f3:d5:8f:a4:9f:e0:1d:a2:45:0e:53:1f:e6:03:35:f4:ba:89
Signer

.text
Size: 405KB - Virtual size: 404KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 15KB - Virtual size: 29KB

.pdata
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB