acc947feee758d01883624ecce5fa500N

Sharing

Copy URL Twitter E-mail

General

Target
acc947feee758d01883624ecce5fa500N
Size 479KB
Sample240910-ccqfds1glk
SHA256 3e542bbbe0f2665aa7de2c787e66adee3a418865a06b8edf6fb002e37b15b2de
MD5 acc947feee758d01883624ecce5fa500
SHA1 5814c8f0f76e7cbb8d64b4e921487049df39b700
SHA512 0c35d6490fbf26b1a3a547aa00209bf4a1b9558bcce7ad1be62eb86337986cf2681131777b145512856bdd6cb0dbb88a9535f2271a07288a7fc25c80835fa8af
SSDEEP 12288:FzRfZXnzR9O940USgdJASbh39b37BjvrEH7X:Z0Lgd6Sb1JBrEH7X
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

acc947feee758d01883624ecce5fa500N

.exe 479KB

acc947feee758d01883624ecce5fa500N

IMPHASH ca82a5627202369d5cd128342205d881
SHA256 3e542bbbe0f2665aa7de2c787e66adee3a418865a06b8edf6fb002e37b15b2de
MD5 acc947feee758d01883624ecce5fa500
SHA1 5814c8f0f76e7cbb8d64b4e921487049df39b700
SHA512 0c35d6490fbf26b1a3a547aa00209bf4a1b9558bcce7ad1be62eb86337986cf2681131777b145512856bdd6cb0dbb88a9535f2271a07288a7fc25c80835fa8af
SSDEEP 12288:FzRfZXnzR9O940USgdJASbh39b37BjvrEH7X:Z0Lgd6Sb1JBrEH7X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

89:53:ba:3c:11:69:62:ef:6d:2e:75:4c:db:57:98:69:d1:b5:e4:14:2f:e2:49:0f:a6:b5:6d:03:67:c5:7e:cb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 10, 2019

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

51:7d:b8:f6:08:89:7b:ad:69:d2:0e:96:bb:de:71:f4:37:c4:8b:79

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 10, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

158428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\362718\out\Release\360Tray.pdb

kernel32

SetFilePointer WriteFile DeviceIoControl CreateThread GetFileAttributesW SystemTimeToFileTime OpenEventW CopyFileW InterlockedExchange LCMapStringW LCMapStringA GetCPInfo GetStringTypeW RtlUnwind GetStartupInfoW ResumeThread GetSystemTimeAsFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetShortPathNameW LocalAlloc GetModuleHandleA SetLastError SetEvent CreateMutexW GetTickCount LoadLibraryW InterlockedCompareExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime lstrlenA lstrcmpiA lstrcmpA CreateFileA SetEndOfFile WriteConsoleW GetConsoleOutputCP ProcessIdToSessionId FreeResource GetSystemWindowsDirectoryW SetErrorMode MoveFileExW SetFileAttributesW DeleteFileW RemoveDirectoryW InterlockedIncrement InterlockedDecrement RaiseException CloseHandle lstrcmpiW lstrlenW OpenMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte LoadLibraryExW FreeLibrary ReadFile CreateFileW GetWindowsDirectoryW GetPrivateProfileStringW GetModuleFileNameW GetCommandLineW GetModuleHandleW GetProcAddress GetVersionExW MultiByteToWideChar FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError OpenProcess LocalFree GetVersion TerminateProcess WriteConsoleA GetLocaleInfoW SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP GetSystemDirectoryW VirtualAlloc VirtualFree LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentProcess WaitForSingleObject GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreateEventW ReleaseMutex GetACP GetOEMCP IsValidCodePage SetHandleCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType

user32

PostMessageW FindWindowW GetActiveWindow CharNextW SendMessageTimeoutW IsWindow MessageBoxW UnregisterClassA LoadStringW

advapi32

RegEnumKeyExA RegQueryValueExA QueryServiceStatus StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetSidSubAuthority RegCreateKeyExW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx RegSetValueExW RegQueryValueExW RegOpenKeyExW CheckTokenMembership CreateWellKnownSid DuplicateToken GetTokenInformation OpenProcessToken RegCloseKey ConvertSidToStringSidW LookupAccountSidW RegOpenKeyExA

shell32

SHGetFolderPathW ord680 ShellExecuteW ord165 SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize

oleaut32

VarUI4FromStr

shlwapi

StrCmpIW SHSetValueW StrStrIW SHGetValueW PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW ord437 wnsprintfW SHGetValueA SHSetValueA PathStripPathW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

rpcrt4

NdrAsyncClientCall RpcBindingFree RpcStringFreeW RpcAsyncCompleteCall RpcStringBindingComposeW RpcAsyncInitializeHandle RpcBindingFromStringBindingW

wininet

InternetOpenUrlW InternetCloseHandle HttpQueryInfoW InternetReadFile InternetSetOptionW DeleteUrlCacheEntryW InternetOpenW

userenv

GetUserProfileDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

acc947feee758d01883624ecce5fa500N

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

rpcrt4

wininet

userenv

generic