f2fb344053fd0c8e73318859175369b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f2fb344053fd0c8e73318859175369b0N.exe
Size

7.2MB
MD5

f2fb344053fd0c8e73318859175369b0
SHA1

8f4ae2edaf1a439279d9454c25c6e9373b3d0391
SHA256

2902acbcecaa43938af2d31b0b9ffdf65195c9b6d46488a427cba220ecc433fd
SHA512

61e78c75159e7f201c0718900e5bb21b05faa8d2746993f7569d8a442730d281155dd862f4f784a460a5c3164be5ae88bd9bf85184abf1770e35a1cd61b5771d
SSDEEP

98304:uuJb2VnHfRTxImhVoQflHgDVEOF1HDqeeURtTEV9M9nwZe94d9x/vMN2rj0g:uuk1USeEQDljRaVmn94d9ag

Score

1^/10

Malware Config

Signatures

Files

f2fb344053fd0c8e73318859175369b0N.exe
.dll windows:5 windows x86 arch:x86

995bc93ecfea7232571cde92f16ba034

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/03/2013, 00:00

Not After

05/04/2016, 23:59

Subject

CN=Kingsoft Security Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=毒霸研发部,O=Kingsoft Security Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:2f:8f:94:e5:95:d3:75:d1:c2:0a:2b:91:26:37:88:b3:59:f5:8c
Signer

Actual PE Digest

94:2f:8f:94:e5:95:d3:75:d1:c2:0a:2b:91:26:37:88:b3:59:f5:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\relink_service\temp\dcbad7d14b1f11e5aa1974d02b7a9112\output_all\liebao_dll.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA

ws2_32

htonl
inet_addr

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetModuleInformation
GetMappedFileNameW
GetProcessImageFileNameW

shlwapi

SHGetValueA
SHStrDupW
PathFileExistsA
PathIsUNCA
PathIsUNCW
PathRemoveExtensionW
SHGetValueW
StrFormatByteSizeW
PathFindFileNameW
StrStrIW
ord12
PathFindExtensionW
UrlCreateFromPathA
PathRemoveFileSpecA
PathFindFileNameA
SHSetValueW
SHSetValueA
StrCatW
PathRemoveFileSpecW
UrlCreateFromPathW
PathFileExistsW

kernel32

MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
GetDiskFreeSpaceExW
Process32NextW
Process32FirstW
lstrlenW
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
WriteFile
GlobalMemoryStatusEx
GetComputerNameA
LocalFree
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetProcessId
CreateRemoteThread
TerminateProcess
ExitProcess
SetUnhandledExceptionFilter
GetTempPathW
SetEnvironmentVariableA
GetCommandLineW
GetTickCount
SetThreadPriority
GetEnvironmentVariableW
SetErrorMode
WaitForMultipleObjects
FreeLibrary
VirtualFree
VirtualAlloc
GetSystemInfo
CreateEventW
lstrcmpW
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetLastError
CreateMutexA
ReleaseMutex
WaitForSingleObject
CopyFileW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
CreateThread
GetOverlappedResult
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
UnregisterWait
SwitchToThread
GetUserDefaultUILanguage
SetCurrentDirectoryW
FlushInstructionCache
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
SetLastError
SetEnvironmentVariableW
LoadLibraryW
GetModuleHandleW
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
lstrcmpiW
GlobalFree
GetLocalTime
QueryDosDeviceW
OpenProcess
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
LoadLibraryA
SetFilePointer
CreateMutexW
HeapDestroy
GetCurrentProcessId
GetCurrentThreadId
InterlockedPushEntrySList
InterlockedPopEntrySList
RaiseException
InitializeSListHead
IsBadWritePtr
IsBadReadPtr
lstrcpyW
VirtualAllocEx
ReadProcessMemory
OutputDebugStringW
WriteConsoleW
GetDriveTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
EnumSystemLocalesW
GetUserDefaultLCID
DecodePointer
ReadFile
GetFileSize
IsValidLocale
LCMapStringW
CompareStringW
GetStringTypeW
GetCPInfo
GetOEMCP
IsValidCodePage
GetStartupInfoW
UnhandledExceptionFilter
ReadConsoleW
ExitThread
CreateFileW
WideCharToMultiByte
OpenFileMappingA
OpenMutexA
GetFullPathNameW
GetConsoleMode
GetConsoleCP
GetFileType
InitializeCriticalSection
FindClose
FindFirstFileW
FindNextFileW
GetFileInformationByHandle
GetFileSizeEx
CreateFileMappingW
TlsAlloc
TlsGetValue
TlsSetValue
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetLocaleInfoA
GetNumberFormatW
GetCurrencyFormatW
SetEvent
ResetEvent
GetSystemTimeAsFileTime
GetACP
GetThreadLocale
CreateFileA
GetVersionExW
GetGeoInfoW
GetUserGeoID
VirtualQuery
VirtualProtectEx
GetCurrentThread
IsDebuggerPresent
OutputDebugStringA
SystemTimeToFileTime
QueryPerformanceCounter
TzSpecificLocalTimeToSystemTime
QueryPerformanceFrequency
DuplicateHandle
GetNativeSystemInfo
GetTempFileNameW
MoveFileExW
GetLogicalDriveStringsW
ReplaceFileW
GetCurrentDirectoryW
GetLongPathNameW
MoveFileW
RemoveDirectoryW
GetFileAttributesExW
SetFileAttributesW
GetVolumeInformationW
RtlCaptureStackBackTrace
GetModuleHandleExA
HeapSetInformation
SetEndOfFile
SetFilePointerEx
SetFileTime
FlushFileBuffers
CreateProcessW
AssignProcessToJobObject
GetStdHandle
CreatePipe
ResumeThread
GetUserDefaultLangID
ExpandEnvironmentStringsW
LocalAlloc
OpenFileMappingW
lstrcmpiA
VirtualProtect
FindFirstFileExW
GetExitCodeProcess
GetModuleHandleExW
GetSystemDirectoryW
GetWindowsDirectoryW
TlsFree
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
RegisterWaitForSingleObject
UnregisterWaitEx
VirtualQueryEx
GetProcessTimes
GlobalSize
GetPrivateProfileStringW
RtlCaptureContext
ReleaseSemaphore
CreateSemaphoreW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
DeleteFileA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTempPathA
EncodePointer
IsProcessorFeaturePresent
RtlUnwind
CreateProcessA
AreFileApisANSI
GetCommandLineA
SetStdHandle

gdi32

EqualRgn
ExcludeClipRect
GetRgnBox
GetBkColor
SetLayout
SetWorldTransform
GetTextFaceW
GdiAlphaBlend
CreateBitmap
CombineRgn
CreatePolygonRgn
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
CreateRectRgnIndirect
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
StretchBlt
GetTextExtentPoint32W
CloseEnhMetaFile
CreateEnhMetaFileW
RemoveFontMemResourceEx
SetTextAlign
ExtTextOutW
GdiFlush
SetPolyFillMode
AbortPath
BeginPath
EndPath
PathToRegion
DeleteEnhMetaFile
EnumEnhMetaFile
GetTextMetricsW
SetMapMode
PolyBezier
GetGlyphOutlineW
CreateDIBSection
PatBlt
CreateFontW
SelectClipRgn
PtInRegion
CreateRectRgn
GetObjectA
SelectObject
GetStockObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateRoundRectRgn
BitBlt
CreateFontIndirectW
SetBrushOrgEx
SetViewportOrgEx
GetObjectW
SetArcDirection
SetTextColor
SetStretchBltMode
SetROP2
SetGraphicsMode
SetDCPenColor
SetDCBrushColor
SetBkColor
SaveDC
RestoreDC
GetDeviceCaps
SetBkMode
DeleteObject
CreateSolidBrush

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
LookupAccountNameA
ConvertSidToStringSidA
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
InitializeAcl
SystemFunction036
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
RegEnumValueW
ConvertSidToStringSidW
GetTokenInformation
CreateProcessAsUserW
RegQueryValueExA
RegOpenKeyExA

oleacc

AccessibleObjectFromWindow
LresultFromObject

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

riched20

ord4

gdiplus

GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdiplusShutdown
GdiplusStartup
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageI
GdipDrawImageRectI
GdipDeleteStringFormat
GdipSetStringFormatFlags

imm32

ImmSetCompositionWindow
ImmNotifyIME
ImmGetCompositionStringA
ImmIsIME
ImmGetProperty
ImmGetCompositionStringW
ImmGetContext
ImmAssociateContextEx
ImmAssociateContext
ImmReleaseContext
ImmSetCandidateWindow

usp10

ScriptFreeCache
ScriptItemize
ScriptLayout
ScriptShape
ScriptCPtoX
ScriptXtoCP
ScriptGetFontProperties
ScriptStringAnalyse
ScriptStringFree
ScriptStringOut
ScriptPlace

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

comctl32

ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

Exports

Exports

CrashForException
DumpProcess
DumpProcessWithoutCrash
GetCrashTracker
InjectDumpHungProcessWithoutCrash
InjectDumpProcessWithoutCrash
LeibaoDLLMain
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
SetActiveURL
SetClientId
SetCommandLine2
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
base_cs_cmd
get_scavenger_map_context
set_scavenger_map_context

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 239KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.syzygy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

995bc93ecfea7232571cde92f16ba034

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

94:2f:8f:94:e5:95:d3:75:d1:c2:0a:2b:91:26:37:88:b3:59:f5:8cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

psapi

shlwapi

kernel32

gdi32

comdlg32

advapi32

oleacc

userenv

riched20

gdiplus

imm32

usp10

winmm

comctl32

Exports

Exports

Sections

.text Size: 4.9MB - Virtual size: 4.9MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 239KB - Virtual size: 331KB

.tls Size: 512B - Virtual size: 2B

.syzygy Size: 1KB - Virtual size: 1KB

.rsrc Size: 303KB - Virtual size: 302KB

.reloc Size: 287KB - Virtual size: 286KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

55:41:51:e0:cf:fa:2c:95:13:07:ae:60:87:c2:80:52
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

94:2f:8f:94:e5:95:d3:75:d1:c2:0a:2b:91:26:37:88:b3:59:f5:8c
Signer

.text
Size: 4.9MB - Virtual size: 4.9MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 239KB - Virtual size: 331KB

.tls
Size: 512B - Virtual size: 2B

.syzygy
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 303KB - Virtual size: 302KB

.reloc
Size: 287KB - Virtual size: 286KB