5a369884895ac65c19c9d97012d418a0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5a369884895ac65c19c9d97012d418a0N.exe
Size

2.9MB
MD5

5a369884895ac65c19c9d97012d418a0
SHA1

81d6ae13c51f43c38451bea757b4afa31f7ecfe4
SHA256

60b1b309d8f1056b12efa9292a1fd5cff9bdbbf79a944b28f6b1cbd5a271cb5b
SHA512

41d4bd357bcf98a1555fc041b5fd7e3f318e4776bd8f5db58767e105f9f13f15134dfbe76d5ec1babb31fa0e0f81e8c3d3f9b02c756bb805d27bf5260ea6f167
SSDEEP

49152:PEujpV+oe5Nx6Tkxo0wJInHDvAwahZtYwJInHD3hQgIZq3tMgT:PEujr+vY0wJInHD4wAYwJInHD3egfvT

Score

1^/10

Malware Config

Signatures

Files

5a369884895ac65c19c9d97012d418a0N.exe
.dll windows:4 windows x86 arch:x86

bdf2595c38d0624d2ae5325431a5ba16

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9f:0f:9c:1f:7e:35:77:3b:e5:7b:dd:27:0d:39:09:2e:4f:f2:d8:63
Signer

Actual PE Digest

9f:0f:9c:1f:7e:35:77:3b:e5:7b:dd:27:0d:39:09:2e:4f:f2:d8:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\jenkins_Trunk\workspace\CEN_Hive_QQPCDownload_ForDCom\qqpcmgr_proj\bin\Release\QQPCDownload.pdb

Imports

ws2_32

htonl
WSCEnumProtocols
WSCInstallProvider
WSCWriteProviderOrder
WSCDeinstallProvider
htons
ntohl

psapi

GetModuleFileNameExW

kernel32

DuplicateHandle
CreateEventW
CreateMutexW
InitializeCriticalSection
TerminateThread
WaitForMultipleObjects
InterlockedCompareExchange
DeleteCriticalSection
EnterCriticalSection
WritePrivateProfileStringW
GetCPInfo
CreateFileMappingW
MapViewOfFileEx
OpenFileMappingW
UnmapViewOfFile
GetProcessTimes
SystemTimeToFileTime
OutputDebugStringW
CreateProcessW
SetFilePointer
OpenMutexW
GetFullPathNameW
HeapFree
SearchPathW
TerminateProcess
SetUnhandledExceptionFilter
ReadProcessMemory
VirtualAllocEx
lstrcpynW
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
GetExitCodeProcess
CreateDirectoryW
OpenThread
CreateThread
Module32FirstW
Module32NextW
CreateRemoteThread
ReleaseMutex
GetExitCodeThread
GetModuleHandleExW
ResumeThread
GetTempPathW
MapViewOfFile
MoveFileW
MoveFileExW
GetTempFileNameW
RemoveDirectoryW
GetSystemDefaultLangID
GetSystemInfo
LoadLibraryA
ResetEvent
InitializeCriticalSectionAndSpinCount
IsBadReadPtr
GetModuleFileNameA
GetCommandLineW
GetFileAttributesW
IsDebuggerPresent
TlsGetValue
CreateIoCompletionPort
TlsFree
PostQueuedCompletionStatus
TlsAlloc
GetQueuedCompletionStatus
TlsSetValue
OpenEventW
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
VirtualProtectEx
GetThreadContext
SetThreadContext
VirtualFree
VirtualAlloc
CreateFileA
UnhandledExceptionFilter
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapReAlloc
ExitThread
GetCommandLineA
GetVersionExA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapDestroy
HeapCreate
GetStdHandle
GetCurrentDirectoryA
WaitForSingleObject
SetDllDirectoryW
SetEvent
GetPrivateProfileIntW
LoadLibraryExW
GetPrivateProfileStringW
GetConsoleCP
GetConsoleMode
CompareStringA
CompareStringW
GetTimeZoneInformation
FlushFileBuffers
SetHandleCount
GetVersion
WideCharToMultiByte
RaiseException
InterlockedDecrement
FlushInstructionCache
GetCurrentThreadId
SetLastError
lstrcmpiW
lstrlenA
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
OpenProcess
GetTickCount
InterlockedExchange
LeaveCriticalSection
FreeResource
InterlockedIncrement
Sleep
IsBadWritePtr
VirtualProtect
GetModuleHandleW
GetSystemDirectoryW
WriteProcessMemory
lstrlenW
GlobalAlloc
GetCurrentProcessId
Process32NextW
Process32FirstW
GetCurrentProcess
CreateToolhelp32Snapshot
GlobalFree
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
WriteFile
ReadFile
GetFileSize
MultiByteToWideChar
DeleteFileW
GetDiskFreeSpaceExW
CopyFileW
FreeLibrary
GetDriveTypeW
GetLogicalDrives
CloseHandle
DeviceIoControl
CreateFileW
GetVersionExW
GetLastError
GetProcAddress
LoadLibraryW
FindResourceW
GetModuleFileNameW
FindResourceExW
LoadResource
LockResource
SizeofResource
GlobalLock
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetDriveTypeA
SetEndOfFile
SetEnvironmentVariableA
IsProcessorFeaturePresent
GetThreadLocale
ExitProcess
VirtualQueryEx
GetLocalTime

user32

GetFocus
GetWindowTextW
GetWindowTextLengthW
EndDialog
LoadIconW
EndPaint
BeginPaint
SetWindowTextW
TrackPopupMenu
GetSysColor
MsgWaitForMultipleObjects
CharUpperW
GetForegroundWindow
GetWindowThreadProcessId
DestroyIcon
KillTimer
DrawFrameControl
DrawTextW
EqualRect
LoadImageW
GetDlgCtrlID
PtInRect
DrawIconEx
PostThreadMessageW
SetTimer
SetCursor
ReleaseCapture
IsWindowVisible
GetSystemMenu
CallWindowProcW
GetQueueStatus
GetClassInfoExW
UnregisterClassW
SetActiveWindow
MapWindowPoints
DefWindowProcW
GetMonitorInfoW
SetWindowsHookExW
FindWindowW
SendMessageTimeoutW
CallNextHookEx
FindWindowExW
wsprintfW
UnhookWindowsHookEx
IsIconic
FindWindowA
MsgWaitForMultipleObjectsEx
PostQuitMessage
SendMessageW
GetWindowLongW
CopyRect
GetActiveWindow
MonitorFromWindow
GetDlgItem
RegisterWindowMessageW
SetWindowRgn
CreateWindowExW
EnableWindow
MoveWindow
PostMessageW
IsWindowEnabled
CharNextW
DestroyWindow
IsWindow
GetWindow
GetDesktopWindow
ReleaseDC
GetDC
GetParent
ClientToScreen
GetClientRect
InvalidateRect
GetWindowRect
GetKeyState
SystemParametersInfoW
SetWindowPos
DispatchMessageW
ShowWindow
TranslateMessage
RegisterClassExW
GetMessageW
SetWindowLongW
OffsetRect
LoadCursorW
WaitMessage
PeekMessageW
InflateRect
MessageBoxW
SetRect
CopyImage
LoadStringW
UnregisterClassA
SetCapture

gdi32

CreateBitmap
SetTextColor
GetStockObject
GetObjectW
CreateFontIndirectW
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteObject
Rectangle
CreateCompatibleBitmap
SelectObject
SetBkColor
ExtTextOutW
SetRectRgn
DeleteDC
OffsetRgn
CombineRgn
CreatePen
CreateRectRgnIndirect
SaveDC
RestoreDC
GetCurrentObject
CreateSolidBrush
GetClipRgn
SelectClipRgn
RoundRect
TextOutW
MoveToEx
GetTextExtentPoint32W
LineTo
RectInRegion
SetBkMode
StretchBlt
CreateRectRgn

advapi32

RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyW
InitializeSecurityDescriptor
GetUserNameW
SetSecurityDescriptorDacl
RegQueryInfoKeyW
StartServiceW
DeleteService
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
QueryServiceStatus

shell32

SHCreateDirectoryExW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW
SHGetSpecialFolderPathW

ole32

CoInitialize
CoCreateGuid
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CLSIDFromProgID
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoFreeLibrary
CoLoadLibrary
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

SysStringLen
SysAllocStringByteLen
VarUI4FromStr
SysAllocString
SysFreeString
SysStringByteLen
VarBstrCmp
OleLoadPicture

shlwapi

StrToIntA
PathCombineW
PathRemoveExtensionW
PathFileExistsW
PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathQuoteSpacesW
PathFindFileNameW
PathAddBackslashW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

netapi32

Netbios
NetApiBufferFree
NetWkstaTransportEnum

comctl32

_TrackMouseEvent

gdiplus

GdipDisposeImageAttributes
GdipDeleteGraphics
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipCreateImageAttributes
GdipDisposeImage
GdipFree
GdipAlloc
GdipLoadImageFromStream
GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawImageI
GdiplusShutdown
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI

rpcrt4

UuidCreate

wininet

HttpQueryInfoW
InternetCloseHandle
InternetReadFile
InternetGetConnectedState
InternetOpenW
InternetOpenUrlW

Exports

Exports

CreateTxdlController
EntryPoint
TxDl_AsyncStartDownload
TxDl_Finalize
TxDl_GetChildLaucherParam
TxDl_GetCurrentLaucherIndex
TxDl_GetLaucher
TxDl_InitDownloadEngine
TxDl_Initialize
TxDl_IsDownloading
TxDl_LoadRoutine
TxDl_Main
TxDl_NotifyQuit
TxDl_RegisterCompleteEvent
TxDl_ReleaseLaucher
Txdl_GetVersion

Sections

.text
Size: 736KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ShareInj
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Downlaod
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DLLShare
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdf2595c38d0624d2ae5325431a5ba16

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

9f:0f:9c:1f:7e:35:77:3b:e5:7b:dd:27:0d:39:09:2e:4f:f2:d8:63Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

netapi32

comctl32

gdiplus

rpcrt4

wininet

Exports

Exports

Sections

.text Size: 736KB - Virtual size: 733KB

.rdata Size: 152KB - Virtual size: 148KB

.data Size: 112KB - Virtual size: 119KB

ShareInj Size: 4KB - Virtual size: 1KB

Downlaod Size: 28KB - Virtual size: 24KB

DLLShare Size: 4KB - Virtual size: 1KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.vmp0 Size: 48KB - Virtual size: 45KB

.vmp1 Size: 140KB - Virtual size: 136KB

.reloc Size: 36KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

9f:0f:9c:1f:7e:35:77:3b:e5:7b:dd:27:0d:39:09:2e:4f:f2:d8:63
Signer

.text
Size: 736KB - Virtual size: 733KB

.rdata
Size: 152KB - Virtual size: 148KB

.data
Size: 112KB - Virtual size: 119KB

ShareInj
Size: 4KB - Virtual size: 1KB

Downlaod
Size: 28KB - Virtual size: 24KB

DLLShare
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.vmp0
Size: 48KB - Virtual size: 45KB

.vmp1
Size: 140KB - Virtual size: 136KB

.reloc
Size: 36KB - Virtual size: 32KB