4cc86ad27886eed28a475c7062a7033f2e2710298961eeb0e3be9a5422647a8c

Sharing

Copy URL Twitter E-mail

General

Target

4cc86ad27886eed28a475c7062a7033f2e2710298961eeb0e3be9a5422647a8c
Size

1.3MB
MD5

95da719313814d30266fb64193a9ed72
SHA1

6b2aeed33f0274fb18fbbcbcd36ee2a2423d44ba
SHA256

4cc86ad27886eed28a475c7062a7033f2e2710298961eeb0e3be9a5422647a8c
SHA512

030ceec8805baa4ae13a133e37cd5dddc99b3a1716547689d5359f7cede2e29b4faf069b1b368d3e9a85048b627f3a0d6e7b5ccd2885f67869f44ec1d0f00413
SSDEEP

24576:ZglXd8sl5Rh7+Dp7VA4TzskdJi0Netgc0gWaTkqwOoA5d18Fh2jO4pYrY1qo8:GX+c7E7JTzzO0kBnbIqboA5d18Fh2C4

Score

1^/10

Malware Config

Signatures

Files

4cc86ad27886eed28a475c7062a7033f2e2710298961eeb0e3be9a5422647a8c
.dll windows:5 windows x86 arch:x86

b0f7de90a9baba17c308f8182df83f8c

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:56:20:6a:a4:c8:85:11:df:7e:da:c8
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24/11/2022, 09:58

Not After

24/11/2025, 09:58

Subject

CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:56:20:6a:a4:c8:85:11:df:7e:da:c8
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

24/11/2022, 09:58

Not After

24/11/2025, 09:58

Subject

CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:22:b6:de:1c:b7:f7:44:fb:7b:7d:06:56:19:d8:48:3a:1e:3f:3e:57:7e:72:44:2e:40:cd:e1:10:ff:62:94
Signer

Actual PE Digest

d8:22:b6:de:1c:b7:f7:44:fb:7b:7d:06:56:19:d8:48:3a:1e:3f:3e:57:7e:72:44:2e:40:cd:e1:10:ff:62:94

Digest Algorithm

sha256

PE Digest Matches

true

0c:62:9e:ed:55:6c:83:af:51:fc:7b:38:eb:52:7c:8f:a9:19:17:86
Signer

Actual PE Digest

0c:62:9e:ed:55:6c:83:af:51:fc:7b:38:eb:52:7c:8f:a9:19:17:86

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\Development\winsparkle\Release\WinSparkle.pdb

Imports

kernel32

MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
ExitProcess
SetLastError
GetCurrentThreadId
GetConsoleScreenBufferInfo
GetStdHandle
WriteConsoleA
ReadConsoleOutputCharacterA
FillConsoleOutputCharacterW
FreeConsole
WriteConsoleW
SetConsoleCursorPosition
GetLocaleInfoW
GetACP
GetUserDefaultLCID
IsValidLocale
FindFirstFileW
FindClose
CreateFileW
GetFileAttributesW
InterlockedDecrement
InterlockedIncrement
TlsSetValue
TlsAlloc
LoadLibraryW
TlsGetValue
TlsFree
OutputDebugStringW
FreeLibrary
WaitForMultipleObjects
CreateThread
SetCurrentDirectoryW
GetFileType
FindNextFileW
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
QueryPerformanceFrequency
SetStdHandle
GetDriveTypeW
GetFullPathNameW
SetFilePointerEx
ReadFile
GetConsoleMode
ReadConsoleW
FlushFileBuffers
WriteFile
GetConsoleCP
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
EnumSystemLocalesW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
GetCurrentDirectoryW
GetProcessHeap
FindFirstFileExA
FindNextFileA
GetCommandLineA
HeapSize
FindResourceW
IsValidCodePage
GetVersionExW
GetEnvironmentVariableW
TerminateProcess
GetCPInfo
SetErrorMode
GetSystemTimeAsFileTime
GetTempPathW
CreateDirectoryW
GetModuleHandleW
GetCurrentProcessId
EnumResourceNamesW
RaiseException
CloseHandle
SetEvent
Sleep
CreateEventW
ResumeThread
WaitForSingleObject
LoadResource
LockResource
FindResourceA
GetModuleFileNameW
SizeofResource
FormatMessageA
LocalFree
GetLastError
OutputDebugStringA
GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetThreadLocale
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoW
VerSetConditionMask

user32

CallWindowProcW
GetMessagePos
GetUpdateRgn
GetKeyState
GetMenuItemInfoW
DeferWindowPos
SetScrollInfo
GetDlgItem
CreateDialogParamW
LoadCursorW
MsgWaitForMultipleObjects
InvalidateRect
DrawFrameControl
DrawIconEx
OffsetRect
CreateIconIndirect
SystemParametersInfoW
GetDoubleClickTime
FindWindowExW
DestroyIcon
GetWindowTextW
GetClassNameW
GetWindowTextLengthW
SetActiveWindow
DrawTextW
SetRectEmpty
DrawFocusRect
DrawStateW
CopyRect
SetWindowRgn
PostThreadMessageW
EndPaint
BeginPaint
GetWindowDC
DestroyCursor
CreateMenu
AppendMenuW
RemoveMenu
InsertMenuW
DestroyMenu
SetMenuItemInfoW
GetSubMenu
CreatePopupMenu
ModifyMenuW
GetMenuState
ValidateRect
GetMessageW
EnumDisplaySettingsW
ChangeDisplaySettingsW
KillTimer
SetTimer
CheckMenuItem
GetMenuItemID
CheckMenuRadioItem
SetMenu
GetCapture
DispatchMessageW
RedrawWindow
IsDialogMessageW
VkKeyScanW
MapVirtualKeyW
PeekMessageW
MapWindowPoints
GetSysColor
IsWindowEnabled
UnhookWindowsHookEx
GetMessageTime
SetFocus
TranslateMessage
SetParent
SetCapture
EndDeferWindowPos
SetWindowsHookExW
SetCursor
EnableScrollBar
GetClientRect
PostQuitMessage
ScrollWindow
GetParent
PtInRect
UpdateWindow
ReleaseCapture
SetCursorPos
ReleaseDC
GetCursorPos
EnableWindow
GetWindowLongW
DefWindowProcW
GetSystemMenu
DestroyWindow
SetWindowPos
SendMessageW
UnregisterClassW
SetWindowTextW
GetWindowPlacement
ShowWindow
MoveWindow
GetDialogBaseUnits
FlashWindow
BringWindowToTop
DrawMenuBar
SetWindowLongW
IsZoomed
GetDesktopWindow
CreateDialogIndirectParamW
EnableMenuItem
SetForegroundWindow
IsIconic
GetIconInfo
LoadIconW
PostMessageW
CreateWindowExW
RegisterClassW
MessageBoxW
LoadImageW
EnumWindows
GetFocus
InflateRect
GetDC
GetSystemMetrics
IsWindowVisible
GetWindowRect
GetWindow
GetWindowThreadProcessId
GetMenuItemCount
FillRect
ScreenToClient
CallNextHookEx
ChildWindowFromPointEx
GetScrollInfo
WindowFromPoint
TrackPopupMenu
GetActiveWindow
IsWindow
BeginDeferWindowPos
ClientToScreen
GetAsyncKeyState
LoadBitmapW

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetOpenW
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetCrackUrlA
InternetOpenUrlA

advapi32

RegQueryValueExW
RegDeleteValueA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExA
RegCloseKey
SystemFunction036

shell32

ExtractIconW
DragQueryFileW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DragQueryPoint
DragAcceptFiles
SHGetMalloc
ExtractIconExW
ShellExecuteExW
SHFileOperationW
DragFinish

ole32

OleInitialize
OleSetContainedObject
OleLockRunning
CoCreateInstance
OleRun
OleUninitialize

oleaut32

SafeArrayDestroy
SysAllocString
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayCreate
SysStringLen
VarBstrFromCy
SafeArrayGetVartype
SysFreeString
VariantInit
SafeArrayLock
SafeArrayUnlock

comctl32

ord17
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageInfo
ImageList_Draw
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_Replace

gdi32

GetBkColor
CreateBitmap
GetOutlineTextMetricsW
MoveToEx
LineTo
GetObjectW
ExcludeClipRect
CreateRectRgn
GetTextMetricsW
GdiFlush
SelectObject
SetBrushOrgEx
ExtTextOutW
RoundRect
GetObjectType
CreateFontIndirectW
BitBlt
CreateCompatibleBitmap
Pie
Arc
CreateCompatibleDC
ExtCreatePen
GetTextExtentExPointW
GetTextExtentPoint32W
GetCharABCWidthsW
CreateDIBSection
GetDIBColorTable
SetPixel
StretchBlt
StretchDIBits
SetWindowOrgEx
GetStockObject
GetClipBox
SetWindowExtEx
CreateDIBitmap
GetDIBits
EqualRgn
RectInRegion
SetROP2
ExtSelectClipRgn
SetMapMode
CreateSolidBrush
SetStretchBltMode
Ellipse
ExtFloodFill
Polyline
MaskBlt
SetViewportExtEx
GetDeviceCaps
SetPolyFillMode
GetPixel
DeleteDC
SetTextColor
PolyPolygon
SetBkMode
Rectangle
SetViewportOrgEx
SelectClipRgn
DeleteObject
CreatePen
GetRegionData
OffsetRgn
SetBkColor
ExtCreateRegion
CreatePatternBrush
CreateHatchBrush
GetRgnBox
CombineRgn
PtInRegion
Polygon

Exports

Exports

win_sparkle_check_update_with_ui
win_sparkle_check_update_with_ui_and_install
win_sparkle_check_update_without_ui
win_sparkle_cleanup
win_sparkle_get_automatic_check_for_updates
win_sparkle_get_last_check_time
win_sparkle_get_update_check_interval
win_sparkle_init
win_sparkle_set_app_build_version
win_sparkle_set_app_details
win_sparkle_set_appcast_url
win_sparkle_set_automatic_check_for_updates
win_sparkle_set_can_shutdown_callback
win_sparkle_set_did_find_update_callback
win_sparkle_set_did_not_find_update_callback
win_sparkle_set_error_callback
win_sparkle_set_lang
win_sparkle_set_langid
win_sparkle_set_registry_path
win_sparkle_set_shutdown_request_callback
win_sparkle_set_update_cancelled_callback
win_sparkle_set_update_check_interval

Sections

.text
Size: 772KB - Virtual size: 771KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 314KB - Virtual size: 313KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0f7de90a9baba17c308f8182df83f8c

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

51:56:20:6a:a4:c8:85:11:df:7e:da:c8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

51:56:20:6a:a4:c8:85:11:df:7e:da:c8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d8:22:b6:de:1c:b7:f7:44:fb:7b:7d:06:56:19:d8:48:3a:1e:3f:3e:57:7e:72:44:2e:40:cd:e1:10:ff:62:94Signer

0c:62:9e:ed:55:6c:83:af:51:fc:7b:38:eb:52:7c:8f:a9:19:17:86Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

rpcrt4

version

wininet

advapi32

shell32

ole32

oleaut32

comctl32

gdi32

Exports

Exports

Sections

.text Size: 772KB - Virtual size: 771KB

.rdata Size: 314KB - Virtual size: 313KB

.data Size: 24KB - Virtual size: 60KB

.gfids Size: 1024B - Virtual size: 656B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 151KB - Virtual size: 151KB

.reloc Size: 80KB - Virtual size: 79KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

51:56:20:6a:a4:c8:85:11:df:7e:da:c8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

51:56:20:6a:a4:c8:85:11:df:7e:da:c8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d8:22:b6:de:1c:b7:f7:44:fb:7b:7d:06:56:19:d8:48:3a:1e:3f:3e:57:7e:72:44:2e:40:cd:e1:10:ff:62:94
Signer

0c:62:9e:ed:55:6c:83:af:51:fc:7b:38:eb:52:7c:8f:a9:19:17:86
Signer

.text
Size: 772KB - Virtual size: 771KB

.rdata
Size: 314KB - Virtual size: 313KB

.data
Size: 24KB - Virtual size: 60KB

.gfids
Size: 1024B - Virtual size: 656B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 151KB - Virtual size: 151KB

.reloc
Size: 80KB - Virtual size: 79KB