df8e3a9d315b112da2413d531447ae10N

Sharing

Copy URL Twitter E-mail

General

Target

df8e3a9d315b112da2413d531447ae10N
Size

319KB
MD5

df8e3a9d315b112da2413d531447ae10
SHA1

e49dc6552c2b7ce645eb1321bc693f3fdbbfa574
SHA256

a9f414ff05d13b1caf1aca4f20275f4ef99c6be7771041454d1d50bb46fb848d
SHA512

9981ea568bb57eb6e39f924eddd00a7784894baa4a3204a3697dc93fc1825f5da8f4328db760034a5c1ec55f0ebee3fd923de028a2eacedad63f35d24bbc40ab
SSDEEP

6144:30QiNG1yi9weTRYLjej+/Ti5ebwRPG1WYYcuRL8OSwMc:5AyJT2LKj+/TsYwU1JOSwMc

Score

1^/10

Malware Config

Signatures

Files

df8e3a9d315b112da2413d531447ae10N
.dll windows:5 windows x86 arch:x86

10325f4b6bd903e001820e8861b5bd39

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:06:5e:8b:94:f3:fc:ca:84:29:5e:83:f3:fd:73:bc:32
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/12/2014, 09:16

Not After

23/12/2016, 09:16

Subject

CN=Hangzhou Shunwang Technology Co.\,Ltd,OU=Hangzhou Shunwang Technology Co.\,Ltd,O=Hangzhou Shunwang Technology Co.\,Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\Visual Studio 2013\Projects\SW_LOL\Release\DataHelper.pdb

Imports

kernel32

GetProcessHeap
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
SizeofResource
HeapDestroy
RaiseException
GetLastError
HeapSize
LockResource
DecodePointer
GetModuleHandleA
VirtualProtect
DeleteCriticalSection
GetCurrentProcessId
MapViewOfFile
WaitForSingleObject
SetEvent
IsBadReadPtr
Sleep
CreateEventA
LeaveCriticalSection
MultiByteToWideChar
EnterCriticalSection
InterlockedExchangeAdd
CreateFileMappingA
CloseHandle
CreateThread
lstrcpyA
CreateFileA
GetFileSize
SetFilePointer
GetCurrentProcess
WriteFile
HeapFree
GetConsoleWindow
ReadFile
GetModuleFileNameW
CreateFileW
InterlockedExchange
GetProcAddress
GetSystemInfo
GetModuleFileNameA
CreateMutexA
OutputDebugStringA
DeleteFileA
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapAlloc
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSection
HeapReAlloc
LCMapStringW
CompareStringW
GetStringTypeW
HeapQueryInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
WriteConsoleW
GetFileType
LoadLibraryExW
WaitForSingleObjectEx
IsDebuggerPresent
OutputDebugStringW
EncodePointer
GetModuleHandleExW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
HeapValidate
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetStdHandle

user32

MoveWindow
SendMessageW
GetDesktopWindow
SetWindowTextA

shell32

ord165

oleaut32

SysAllocStringLen

shlwapi

PathFileExistsA

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sw0
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10325f4b6bd903e001820e8861b5bd39

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

11:21:06:5e:8b:94:f3:fc:ca:84:29:5e:83:f3:fd:73:bc:32Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

oleaut32

shlwapi

Sections

.text Size: 184KB - Virtual size: 184KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 6KB - Virtual size: 22KB

sw0 Size: 52KB - Virtual size: 52KB

.reloc Size: 11KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 469B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

11:21:06:5e:8b:94:f3:fc:ca:84:29:5e:83:f3:fd:73:bc:32
Certificate

.text
Size: 184KB - Virtual size: 184KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 6KB - Virtual size: 22KB

sw0
Size: 52KB - Virtual size: 52KB

.reloc
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 469B