2016-01-05_20IQIYIsetup_spl004kb029[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2016-01-05_20IQIYIsetup_spl004kb029.exe
Size

2.3MB
MD5

e56024da9026eff2c6200edb2b626503
SHA1

9ff1d36d6a1c4ab25ec355022ea99e91f2366d77
SHA256

f92b1005959ffee133267b9a4e4732a4c000568a32e0e1b2654dc0c542a9d17e
SHA512

fccb00c38b1cb7c31c630dca20fd5fde2e70515af05702182f78f017f24f6f7a031631cb27b71cb97aac8ba3b84b9b6b3a94dbbb9322447ddb4bcdd7d66b56df
SSDEEP

49152:hTEFVxVbtrlYI9xq0oL4nnWKEtStHbPC6SAExuYJ8NGBKCUTjxLdTp4WCFF:mVbtrKI9xFo0nPEWC3VxuYWGMFhA

Score

1^/10

Malware Config

Signatures

Files

2016-01-05_20IQIYIsetup_spl004kb029.exe
.exe windows:5 windows x86 arch:x86

6f64bae6b9a63a634034ab6e00dd5fdf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

15/12/2015, 00:00

Not After

06/02/2018, 23:59

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:3d:ce:cc:60:a0:3d:4e:56:05:7c:1c:bb:d5:72:e6:b5:55:b0:31
Signer

Actual PE Digest

4e:3d:ce:cc:60:a0:3d:4e:56:05:7c:1c:bb:d5:72:e6:b5:55:b0:31

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

J:\TFSProjects\PCMaster\Hao123\bin\Hao123Downloader.pdb

Imports

kernel32

lstrcatW
lstrcmpiW
GetVersionExW
MoveFileExW
CreateProcessW
FileTimeToLocalFileTime
Module32NextW
Module32FirstW
GetFileTime
WriteProcessMemory
VirtualProtect
FindNextFileW
FindClose
GetStartupInfoW
InterlockedDecrement
GetFileSizeEx
lstrcmpW
DeviceIoControl
MoveFileW
SetFileAttributesW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
IsBadCodePtr
FileTimeToDosDateTime
SetLastError
FindFirstFileW
GetComputerNameW
GetVolumeInformationW
GetSystemDirectoryW
GetTempFileNameW
GetNumberFormatW
GetLocaleInfoW
GlobalMemoryStatusEx
FreeResource
MoveFileA
WritePrivateProfileStringW
CopyFileW
GetCommandLineW
GetCurrentThreadId
GetLocalTime
SetUnhandledExceptionFilter
GetPrivateProfileStringW
lstrcmpiA
SetEvent
UnlockFileEx
WaitForMultipleObjects
InterlockedIncrement
TerminateThread
GetExitCodeThread
ResumeThread
CreateDirectoryW
CreateSemaphoreW
ReleaseSemaphore
LocalFileTimeToFileTime
GetCurrentDirectoryW
SetFileTime
GetFileInformationByHandle
lstrcpynW
lstrcmpA
lstrlenA
LoadLibraryExW
UnmapViewOfFile
WriteFile
WaitForSingleObject
LoadLibraryExA
BeginUpdateResourceW
BeginUpdateResourceA
EndUpdateResourceW
UnlockFile
UpdateResourceW
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
AreFileApisANSI
CreateFileA
CreateFileW
CreateFileMappingA
CreateFileMappingW
OutputDebugStringA
OutputDebugStringW
QueryPerformanceFrequency
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
WideCharToMultiByte
GetWindowsDirectoryW
GetModuleFileNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetProcessHeap
HeapAlloc
LocalAlloc
HeapFree
IsBadReadPtr
FreeLibrary
GetLastError
LocalFree
lstrcpyW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
ExpandEnvironmentStringsW
lstrlenW
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetCurrentProcess
MultiByteToWideChar
CreateMutexW
DeleteFileA
DeleteFileW
FlushFileBuffers
FormatMessageA
FormatMessageW
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetSystemInfo
GetSystemTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
HeapValidate
LoadLibraryA
LockFile
LockFileEx
MapViewOfFile
ReadFile
SetEndOfFile
SetFilePointer
GetUserDefaultUILanguage
Sleep
CreateEventW
MulDiv
IsBadStringPtrW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
SetConsoleCtrlHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetHandleCount
GetConsoleMode
GetConsoleCP
SetCurrentDirectoryW
GetFileType
PeekNamedPipe
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
ExitProcess
GetStdHandle
IsProcessorFeaturePresent
GetStringTypeW
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapQueryInformation
TlsAlloc
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
OpenEventW
RaiseException
IsValidCodePage
GetOEMCP
GetACP
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
HeapSetInformation
GetCommandLineA
CreateThread
ExitThread
FindFirstFileExW
RtlUnwind
InitializeCriticalSectionAndSpinCount
InterlockedExchange
EncodePointer
DecodePointer

user32

GetFocus
PostMessageW
GetDesktopWindow
MessageBoxW
PtInRect
IntersectRect
OffsetRect
SetCursor
LoadCursorW
GetSystemMetrics
CharNextW
SetTimer
wsprintfW
SetWindowLongW
GetWindowLongW
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
DestroyWindow
IsZoomed
ScreenToClient
GetWindowRect
InflateRect
UnionRect
DefWindowProcW
IsWindow
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
SendMessageW
LoadImageW
CallWindowProcW
GetPropW
SetPropW
AdjustWindowRectEx
GetMenu
EnumChildWindows
IsWindowVisible
FindWindowExW
ShowWindow
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
UpdateLayeredWindow
InvalidateRect
SetCapture
ReleaseCapture
SystemParametersInfoW
GetDC
SetWindowRgn
SetFocus
GetKeyState
GetClassNameW
GetCursorPos
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
ReleaseDC
GetMessageW
EnableWindow
DrawFocusRect
DrawTextW
DrawIconEx
CharPrevW
SetRect
IsIconic
UpdateWindow
DestroyIcon
GetIconInfo
KillTimer
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
DestroyMenu
TrackPopupMenu
EnableMenuItem
AppendMenuW
CreatePopupMenu
GetCaretPos
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
FillRect
InvalidateRgn
MoveWindow
CreateAcceleratorTableW

advapi32

CryptGetHashParam
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountNameW
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
RegDeleteValueW
AllocateAndInitializeSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateProcessAsUserW
SaferCreateLevel
SaferComputeTokenFromLevel
SaferCloseLevel
RegEnumValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
RegEnumKeyExW
CryptDestroyHash
CryptReleaseContext
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
DeleteAce
SetEntriesInAclW
SetNamedSecurityInfoW
RegFlushKey

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
SHGetMalloc

ole32

CoCreateInstance
CoInitializeEx
CoInitialize
OleLockRunning
CLSIDFromString
CLSIDFromProgID
StgCreateDocfile
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSetContainedObject
OleCreateStaticFromData
OleDuplicateData
ReleaseStgMedium
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoSetProxyBlanket
CoUninitialize

oleaut32

VariantClear
VariantInit
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString

shlwapi

PathFindFileNameW
StrStrIA
PathFindExtensionW
PathFileExistsA
PathAppendW
PathFileExistsW
PathAppendA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle
InternetCheckConnectionW
InternetGetCookieW
InternetGetCookieExW
HttpSendRequestW
InternetSetCookieW
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpOpenRequestW
InternetConnectW
GetUrlCacheEntryInfoW
HttpQueryInfoW
InternetSetOptionW

psapi

GetModuleInformation

winhttp

WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpReadData
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptDecodeObject
CryptMsgGetParam
CryptProtectData
CryptQueryObject

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

urlmon

URLDownloadToFileW
ObtainUserAgentString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wintrust

WinVerifyTrust

dbghelp

MiniDumpWriteDump

gdi32

CreateSolidBrush
GetTextMetricsW
SelectObject
DeleteObject
CreateFontIndirectW
CreateRoundRectRgn
SetWindowOrgEx
RestoreDC
BitBlt
SaveDC
CreateCompatibleDC
DeleteDC
OffsetRgn
PtInRegion
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
GetDIBits
GetObjectW
CreateRectRgn
GetBitmapBits
CreateDIBSection
LineTo
MoveToEx
CreatePen
Rectangle
GetStockObject
RoundRect
GetTextExtentPoint32W
SetBkMode
SetTextColor
GdiFlush
TextOutW
GetCharABCWidthsW
SetBkColor
GetDeviceCaps
SetBitmapBits
CreateCompatibleBitmap
CreatePatternBrush
CreateDCW
SetDIBColorTable

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipCreateFromHDC
GdipSaveGraphics
GdipDrawImageI
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipSaveImageToStream
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipDeleteGraphics
GdipDeleteFont
GdipGetImageWidth
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesColorKeys
GdipSetImageAttributesWrapMode
GdipCreateSolidFill
GdipSetPenDashStyle
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatTrimming
GdipAddPathLineI
GdipAddPathArcI
GdipGetImageHeight
GdipReleaseDC
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipDrawString
GdipMeasureString
GdipDrawImageRectRectI
GdipCreateFontFromDC
GdipCloneBrush
GdipGraphicsClear
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 397KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f64bae6b9a63a634034ab6e00dd5fdf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6fCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

4e:3d:ce:cc:60:a0:3d:4e:56:05:7c:1c:bb:d5:72:e6:b5:55:b0:31Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

iphlpapi

wininet

psapi

winhttp

crypt32

winmm

urlmon

userenv

wintrust

dbghelp

gdi32

comctl32

gdiplus

imm32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 397KB - Virtual size: 396KB

.data Size: 36KB - Virtual size: 49KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 142KB - Virtual size: 141KB

.reloc Size: 92KB - Virtual size: 92KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6f
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

4e:3d:ce:cc:60:a0:3d:4e:56:05:7c:1c:bb:d5:72:e6:b5:55:b0:31
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 397KB - Virtual size: 396KB

.data
Size: 36KB - Virtual size: 49KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 142KB - Virtual size: 141KB

.reloc
Size: 92KB - Virtual size: 92KB