790ae25fb71008593905fe2b640f9640N

Sharing

Copy URL Twitter E-mail

General

Target

790ae25fb71008593905fe2b640f9640N
Size

96KB
MD5

790ae25fb71008593905fe2b640f9640
SHA1

adc14e03e9096d307eedfaa1469dd7304c4eb1c3
SHA256

61127ea21628456ee7b4e7731c7dc4398662061bedc09b4ed3a8e40dfc6a4e09
SHA512

dbb20eb74d926f2ab843154089241fcc27dab135d6f3a0084f35d0510110f2aa3a8422bdbb07e4f7e20159594aa7250f89a6b2db0bf6abb5c78219b416f35111
SSDEEP

1536:uCz5/b0z7gCIS0xA+0QRyRQc8tdsWjcd0A5yzS4u1L7SaWiF1wJe1L7S:uCz5T0z8S4xw0A5Jx1fSaWiFoe1fS

Score

1^/10

Malware Config

Signatures

Files

790ae25fb71008593905fe2b640f9640N
.dll windows:6 windows x86 arch:x86

9cd8588b77b51eeaa6ee14a258130579

Code Sign

77:b7:47:c0:f9:a6:61:7a:8f:c8:3c:1c
Certificate

Issuer

CN=AO-X Code CA C2,O=AO-X

Not Before

28/05/2024, 00:00

Not After

27/05/2025, 23:59

Subject

CN=慕讯公益加速器,OU=免费,O=慕讯,L=苏州,ST=江苏,C=CN,1.2.840.113549.1.9.1=#0c103730323533333639384071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature

16:c6:34:23:2a:9d:17:50:0b:e5:08:7d
Certificate

Issuer

CN=AO-X Root CA R2,O=AO-X

Not Before

01/01/2020, 00:00

Not After

31/12/2029, 23:59

Subject

CN=AO-X Code CA C2,O=AO-X

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageDataEncipherment
KeyUsageCertSign
KeyUsageCRLSign

36:e6:54:e3:0a:47:73:87:4e:50:13:07
Certificate

Issuer

CN=AO-X Root CA R0,O=AO-X

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=AO-X Root CA R2,O=AO-X

Extended Key Usages

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5
Certificate

Issuer

CN=AO-X Root CA R0,O=AO-X

Not Before

01/01/2000, 00:00

Not After

31/12/2999, 23:59

Subject

CN=AO-X Root CA R0,O=AO-X

Extended Key Usages

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:df:bb:07:9d:74:ee:64:38:0e:6f:e6
Certificate

Issuer

CN=AO-X Code CA C1,O=AO-X

Not Before

28/05/2024, 00:00

Not After

27/05/2025, 23:59

Subject

CN=Muxun Public Welfare Accelerator,OU=Free,O=MuXun,L=SuZhou,ST=JiangSu,C=CN,1.2.840.113549.1.9.1=#0c103730323533333639384071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature

36:c3:23:48:9f:6d:07:87:eb:bd:4a:1c
Certificate

Issuer

CN=AO-X Root CA R1,O=AO-X

Not Before

01/01/2020, 00:00

Not After

31/12/2029, 23:59

Subject

CN=AO-X Code CA C1,O=AO-X

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageDataEncipherment
KeyUsageCertSign
KeyUsageCRLSign

59:c7:ed:ee:d2:5d:5e:9a:e9:9b:be:a8
Certificate

Issuer

CN=AO-X Root CA R0,O=AO-X

Not Before

01/01/2000, 00:00

Not After

31/12/2099, 23:59

Subject

CN=AO-X Root CA R1,O=AO-X

Extended Key Usages

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5
Certificate

Issuer

CN=AO-X Root CA R0,O=AO-X

Not Before

01/01/2000, 00:00

Not After

31/12/2999, 23:59

Subject

CN=AO-X Root CA R0,O=AO-X

Extended Key Usages

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:6f:fb:6a:15:71:ad:e9:49:d7:74:9d:2e:cb:68:78:c8:cb:94:8d
Signer

Actual PE Digest

01:6f:fb:6a:15:71:ad:e9:49:d7:74:9d:2e:cb:68:78:c8:cb:94:8d

Digest Algorithm

sha1

PE Digest Matches

true

1e:59:9e:7c:17:e4:e3:2a:02:16:df:09:dc:49:f7:ff:2b:fe:d8:49:93:ef:f6:9c:b9:38:11:de:d2:b3:b5:31
Signer

Actual PE Digest

1e:59:9e:7c:17:e4:e3:2a:02:16:df:09:dc:49:f7:ff:2b:fe:d8:49:93:ef:f6:9c:b9:38:11:de:d2:b3:b5:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\git\mxacceler_new_develop\routewrapper\mxacceler\bin\x86\Release\routewrapper.pdb

Imports

iphlpapi

InitializeIpForwardEntry
DeleteIpForwardEntry2
CreateIpForwardEntry2

kernel32

GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW

Exports

Exports

CreateIpForwardEntry2Wrapper
CreateIpForwardEntry2WrapperEx
DeleteIpForwardEntry2Wrapper

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd8588b77b51eeaa6ee14a258130579

Code Sign

77:b7:47:c0:f9:a6:61:7a:8f:c8:3c:1cCertificate

Extended Key Usages

Key Usages

16:c6:34:23:2a:9d:17:50:0b:e5:08:7dCertificate

Extended Key Usages

Key Usages

36:e6:54:e3:0a:47:73:87:4e:50:13:07Certificate

Extended Key Usages

Key Usages

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

18:df:bb:07:9d:74:ee:64:38:0e:6f:e6Certificate

Extended Key Usages

Key Usages

36:c3:23:48:9f:6d:07:87:eb:bd:4a:1cCertificate

Extended Key Usages

Key Usages

59:c7:ed:ee:d2:5d:5e:9a:e9:9b:be:a8Certificate

Extended Key Usages

Key Usages

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

01:6f:fb:6a:15:71:ad:e9:49:d7:74:9d:2e:cb:68:78:c8:cb:94:8dSigner

1e:59:9e:7c:17:e4:e3:2a:02:16:df:09:dc:49:f7:ff:2b:fe:d8:49:93:ef:f6:9c:b9:38:11:de:d2:b3:b5:31Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

kernel32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

77:b7:47:c0:f9:a6:61:7a:8f:c8:3c:1c
Certificate

16:c6:34:23:2a:9d:17:50:0b:e5:08:7d
Certificate

36:e6:54:e3:0a:47:73:87:4e:50:13:07
Certificate

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

18:df:bb:07:9d:74:ee:64:38:0e:6f:e6
Certificate

36:c3:23:48:9f:6d:07:87:eb:bd:4a:1c
Certificate

59:c7:ed:ee:d2:5d:5e:9a:e9:9b:be:a8
Certificate

5f:20:4f:18:d7:a0:14:07:95:f9:99:e5
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

01:6f:fb:6a:15:71:ad:e9:49:d7:74:9d:2e:cb:68:78:c8:cb:94:8d
Signer

1e:59:9e:7c:17:e4:e3:2a:02:16:df:09:dc:49:f7:ff:2b:fe:d8:49:93:ef:f6:9c:b9:38:11:de:d2:b3:b5:31
Signer

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB