787edf7098aa20b4fd3179039724a5e7a3abe844cb6c7307da0181a8ae145c03

Sharing

Copy URL Twitter E-mail

General

Target

787edf7098aa20b4fd3179039724a5e7a3abe844cb6c7307da0181a8ae145c03
Size

534KB
MD5

9052d231938f01e99059c24e83f4fd13
SHA1

47b9940081fc12f71b19a7a674810f23f57251d9
SHA256

787edf7098aa20b4fd3179039724a5e7a3abe844cb6c7307da0181a8ae145c03
SHA512

18d0e563cd662628cf0d4ca31b0889506a06aa90e79562c786986d9930b0d831da79def6192ed70df569f27d21da362fe77133ae26ec4b209df317950eb6acec
SSDEEP

12288:KiUPH4fXd0XViaCalXliL6dl2T+oFivGAxoFXA6zOK2+FC+VLF1g1h3RT8KGA7rN:KiSliRLyBT8zANGY

Score

1^/10

Malware Config

Signatures

Files

787edf7098aa20b4fd3179039724a5e7a3abe844cb6c7307da0181a8ae145c03
.dll windows:5 windows x86 arch:x86

a25867829d8ca5a66149e5b7c9e6c4cb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/03/2013, 00:00

Not After

05/04/2016, 23:59

Subject

CN=Kingsoft Security Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=毒霸研发部,O=Kingsoft Security Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e2:93:74:8c:04:87:a8:cf:1a:84:11:91:f9:c9:e7:46:7e:39:fc:9b
Signer

Actual PE Digest

e2:93:74:8c:04:87:a8:cf:1a:84:11:91:f9:c9:e7:46:7e:39:fc:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

K:\liebao_src_pool\release.branch_106\src_import\build\Release\dbginfo\ksmon.pdb

Imports

psapi

GetModuleBaseNameW

kernel32

GetTempPathW
GetCurrentDirectoryW
SetLastError
GetVolumeInformationW
CreateProcessW
AssignProcessToJobObject
GetStdHandle
ResumeThread
GetCommandLineW
CreateMutexW
SetFilePointer
GetTickCount
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
GetWindowsDirectoryW
FindFirstFileW
FindFirstFileExW
FindClose
FindNextFileW
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
ReadFile
TerminateProcess
DuplicateHandle
GetNativeSystemInfo
GetCurrentThread
Sleep
SetEvent
GetModuleHandleExW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetModuleHandleExA
GetDiskFreeSpaceExW
WideCharToMultiByte
DeleteFileA
SetEnvironmentVariableA
CreateMutexA
FindResourceExW
GetModuleFileNameA
LoadResource
LockResource
SizeofResource
CreateFileMappingA
FindResourceW
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTempPathA
MultiByteToWideChar
GetLocalTime
GetComputerNameA
SwitchToThread
GetFileAttributesW
WriteFile
CreateDirectoryW
UnmapViewOfFile
MapViewOfFile
ExpandEnvironmentStringsW
CreateEventW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DisableThreadLibraryCalls
CreateThread
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DeleteFileW
CreateFileW
LocalFree
GetModuleHandleW
GetModuleFileNameW
GetVersionExW
GetExitCodeProcess
GetCurrentProcess
WaitForSingleObject
GetLastError
CloseHandle
LoadLibraryW
lstrlenW
GetProcAddress
FreeLibrary
GetSystemDirectoryW
GetDriveTypeW
OutputDebugStringW
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
InitializeCriticalSection
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LoadLibraryExA
EncodePointer
GetStringTypeW
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
GetFullPathNameW
SetStdHandle
GetFileType
GetConsoleCP
GetConsoleMode
ExitProcess
AreFileApisANSI
ExitThread
LoadLibraryExW
ReadConsoleW

advapi32

CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shlwapi

PathFindFileNameA
PathRemoveFileSpecA
SHGetValueW
SHSetValueW
SHGetValueA
SHSetValueA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

iphlpapi

GetAdaptersInfo

ws2_32

inet_addr

version

VerQueryValueA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a25867829d8ca5a66149e5b7c9e6c4cb

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e2:93:74:8c:04:87:a8:cf:1a:84:11:91:f9:c9:e7:46:7e:39:fc:9bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

advapi32

shlwapi

userenv

winmm

iphlpapi

ws2_32

version

Exports

Exports

Sections

.text Size: 425KB - Virtual size: 425KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 8KB - Virtual size: 21KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 16KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e2:93:74:8c:04:87:a8:cf:1a:84:11:91:f9:c9:e7:46:7e:39:fc:9b
Signer

.text
Size: 425KB - Virtual size: 425KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 8KB - Virtual size: 21KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 16KB