0367d21cbf232a33ed3318c6c1b9fd892650f5314f8d83a6cff42f9f64eee97c

Sharing

Copy URL

Twitter E-mail

General

Target

0367d21cbf232a33ed3318c6c1b9fd892650f5314f8d83a6cff42f9f64eee97c
Size

88KB
MD5

2893fa557009b046cd72b0b765e6543b
SHA1

faea27095384bac3c35d44aca591f0c03c8bcdf9
SHA256

0367d21cbf232a33ed3318c6c1b9fd892650f5314f8d83a6cff42f9f64eee97c
SHA512

b80a48cee52a297f7d34e768b7a9275d0922e5239e008db42d02d0b5fc614ddc6008f6a09b503bf1c232510574d1cf195fb9452b1932ad27c9819aa03c5cba70
SSDEEP

1536:t6TMUUhpip4BK6yL8Br5+wtBv3smw8crsWjcdq/RtWRYsO:ZhPBK6G8fXwGqZtGYsO

Score

1^/10

Malware Config

Signatures

Files

0367d21cbf232a33ed3318c6c1b9fd892650f5314f8d83a6cff42f9f64eee97c
.dll windows:5 windows x86 arch:x86

5f1b696ee24c5902e0cb73300f9d1c67

Code Sign

21:85:f8:ba:fa:5f:47:a6:00:f3:4f:75:d2:7d:50:f5
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

24-04-2015 00:35

Not After

24-05-2016 01:35

Subject

CN=北京众橙世纪传媒技术有限公司,O=北京众橙世纪传媒技术有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17-09-2006 22:46

Not After

31-12-2019 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:91:f5:41:69:b2:99:7f:79:2a:1b:09:1b:88:ee:c2:9d:84:d7:df
Signer

Actual PE Digest

1e:91:f5:41:69:b2:99:7f:79:2a:1b:09:1b:88:ee:c2:9d:84:d7:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
DeleteCriticalSection
DecodePointer
GetVersion
DeleteFileA
CreateFileW
FlushFileBuffers
GetLastError
MultiByteToWideChar
CloseHandle
InitializeCriticalSectionAndSpinCount
WriteConsoleW
SetStdHandle
SetFilePointerEx
ReadConsoleW
ReadFile
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
HeapFree
EncodePointer
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WideCharToMultiByte
HeapSize
RtlUnwind
GetStdHandle
GetFileType
GetStartupInfoW
WriteFile
GetConsoleCP
GetConsoleMode
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapReAlloc
GetStringTypeW
LCMapStringW
HeapAlloc
GetModuleFileNameW
LoadLibraryExW
SetEndOfFile

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

shlwapi

PathFileExistsA

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f1b696ee24c5902e0cb73300f9d1c67

Code Sign

21:85:f8:ba:fa:5f:47:a6:00:f3:4f:75:d2:7d:50:f5Certificate

Extended Key Usages

Key Usages

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

1e:91:f5:41:69:b2:99:7f:79:2a:1b:09:1b:88:ee:c2:9d:84:d7:dfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 4KB - Virtual size: 3KB

21:85:f8:ba:fa:5f:47:a6:00:f3:4f:75:d2:7d:50:f5
Certificate

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

19:c2:85:30:e9:3b:36
Certificate

1e:91:f5:41:69:b2:99:7f:79:2a:1b:09:1b:88:ee:c2:9d:84:d7:df
Signer

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 4KB - Virtual size: 3KB