4da54f400ae8187254e4ce6b19a0ff209670a4597e917de66784938741633534N

Sharing

Copy URL

Twitter E-mail

General

Target

4da54f400ae8187254e4ce6b19a0ff209670a4597e917de66784938741633534N
Size

172KB
MD5

49503e68f5fb5f01392d58cca8fa7270
SHA1

06803206faacc6b530198812e0c6f0db450e8991
SHA256

4da54f400ae8187254e4ce6b19a0ff209670a4597e917de66784938741633534
SHA512

66223b9f28a7455d82b89f6fa2ebc177ee11fc0f376a709dd6ce63a273e6e340a7da606851f4589cc7ae4455bc8c24d313332b3022147634f9770f6b8c8d879e
SSDEEP

3072:oJ/UHPzmEArqgUww3Pr8EuPmJ3+rpLnboGYauK/KBrhudhYzNCPILNCTNagK4s5j:FVArqgUww3PdBJ3+NTbotoWoNOpxsU

Score

1^/10

Malware Config

Signatures

Files

4da54f400ae8187254e4ce6b19a0ff209670a4597e917de66784938741633534N
.dll windows:5 windows x64 arch:x64

7f1a34222d37c232b344b78f29a725a1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c9:09:a3:98:55:dd:9a:b9:f2:55:ca:04:ce:4e:6f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/11/2021, 00:00

Not After

12/11/2024, 23:59

Subject

SERIALNUMBER=91110108MA01U3798D,CN=北京数安行科技有限公司,OU=IT,O=北京数安行科技有限公司,ST=北京市,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b5b7e6b780e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:52:22:ed:1d:c2:5b:39:f4:e7:62:74:36:94:57:5b:e4:74:32:1c:04:12:19:1a:61:5a:e5:0d:d3:be:c7:d4
Signer

Actual PE Digest

94:52:22:ed:1d:c2:5b:39:f4:e7:62:74:36:94:57:5b:e4:74:32:1c:04:12:19:1a:61:5a:e5:0d:d3:be:c7:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\Project\SAFE\Secdoc\PLD-Build\Src\Client\pdb\x64\LckDocCtlExp.pdb

Imports

lckdocexp

EFS_SEPGetFileAttributesCheckW
EFS_Sep_SelfAuthCopyFilePlainW
EFS_GetFileTypeW
EFS_SetDePasswordA
EFS_EncryptFileW
EFS_TBFPSFileDecryptW
EFS_TBFPSSetFileAttributesW
EFS_TBFPSGetFileAttributesW
EFS_SelfAuthSetFileAttributesW
EFS_GetFileUserGuidW
EFS_CopyFilePlainW
EFS_SEPGetFileAttributesW
EFS_ConvertForceSepToOrdEncryptW
EFS_ConvertSelfAuthToOrdEncryptW
EFS_ConvertToSelfAuthFileW
EFS_ConvertToTBFileW
EFS_TBFPSGetFileTypeW
EFS_SelfAuthGetFileAttributesW

mfc90u

ord2480
ord2457
ord2473
ord2478
ord2461
ord2463
ord2465
ord2459
ord2475
ord2455
ord949
ord945
ord947
ord943
ord938
ord5365
ord5367
ord6101
ord1635
ord4393
ord4843
ord3494
ord5335
ord4294
ord6421
ord5201
ord2378
ord5284
ord4355
ord1429
ord4048
ord1658
ord1661
ord6053
ord3135
ord1582
ord1713
ord1714
ord4699
ord5013
ord5314
ord617
ord3740
ord2222
ord664
ord671
ord424
ord583
ord3317
ord3039
ord5346
ord4349
ord1430
ord6056
ord3137
ord2139
ord2015
ord1840
ord3975
ord1308
ord1422
ord6207
ord6429
ord6234
ord2435
ord6008
ord3979
ord5093
ord1559
ord1563
ord777
ord6027
ord3014
ord1389
ord5307
ord2010
ord1699
ord1698
ord1634
ord5332
ord2932
ord4601
ord4373
ord362
ord3535
ord6259
ord3008
ord285
ord1519
ord2468
ord791
ord5614
ord5692
ord1516
ord266
ord4191
ord1512
ord2325
ord2975
ord265
ord5658
ord4103
ord1209
ord568
ord760
ord378
ord6144
ord280
ord630
ord1061
ord320
ord1271
ord1270
ord2532
ord286
ord1211
ord1215
ord2336
ord2344
ord2965
ord643
ord1469
ord5845
ord2184
ord567
ord887
ord5225
ord759
ord296
ord5475
ord6309
ord4035
ord877
ord4213
ord789
ord588
ord6147
ord2067
ord3930
ord772
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord2303
ord4050
ord4687
ord5362
ord5345
ord5696
ord2602
ord2797
ord2904
ord4419
ord2780
ord2907
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4596
ord4372
ord2450
ord2452
ord2470
ord2226
ord2233
ord1553
ord6423
ord3902
ord6425
ord2531
ord3436
ord4322
ord394
ord3424
ord577
ord3783
ord779
ord1954
ord592
ord1235
ord1963
ord1203
ord1201
ord1225
ord1146
ord1195
ord379
ord1118
ord1234
ord1232
ord1111
ord1053
ord1103
ord321
ord780

msvcr90

??0exception@std@@QEAA@AEBV01@@Z
__clean_type_info_names_internal
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_encoded_null
free
_initterm_e
_initterm
_malloc_crt
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
__CxxFrameHandler3
_invalid_parameter_noinfo
_wcslwr_s
wcslen
wcschr
wcsrchr
_wcsicmp
wcscmp
strlen
memset
memcmp
_CxxThrowException
memcpy
_vsnwprintf
_wfopen_s
fputs
fclose
_localtime64_s
wcsftime
_mktime64
_time64
_wtoi
__C_specific_handler

kernel32

WaitForSingleObject
SetFileTime
GetFileTime
CreateFileW
DeleteFileW
WideCharToMultiByte
FreeLibrary
lstrcmpW
lstrcmpiW
GetLastError
GetProcAddress
OutputDebugStringW
FindClose
GetFileAttributesW
GetTempFileNameW
SetFileAttributesW
MoveFileExW
GetSystemTime
FindNextFileW
FindFirstFileW
MoveFileW
GetTempPathW
ReadFile
GetSystemTimeAsFileTime
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
LocalAlloc
LocalFree
WriteFile
SetFilePointer
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
ReleaseMutex
CloseHandle
CreateMutexW
OpenMutexW
GetFileAttributesExW
LoadLibraryExW
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
GetModuleFileNameW
GetPrivateProfileStringW
CopyFileW
OutputDebugStringA
lstrlenA
GetSystemWow64DirectoryW
lstrlenW
MultiByteToWideChar
SetLastError
GetSystemInfo
GetWindowsDirectoryW
CreateProcessW
GetShortPathNameW

user32

EnableWindow
SendMessageW
MessageBoxW
GetWindowRect

shell32

SHGetFileInfoW

shlwapi

PathFileExistsW
StrStrW
StrFormatByteSizeW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ

Exports

Exports

EXP_ConvertForceSepToOrdEncryptW
EXP_ConvertSelfAuthToOrdEncryptW
EXP_ConvertToSelfAuthFileW
EXP_ConvertToTBFileA
EXP_ConvertToTBFileW
EXP_CtpRecover
EXP_DecryptAllFilesEx
EXP_DecryptFiles
EXP_DecryptFilesEx
EXP_DecryptFilesTrack
EXP_EXAMINE_APPROVE
EXP_EXAMINE_APPROVE_EX
EXP_GetFileUserGuidW
EXP_GetRmRestoreA
EXP_GetRmRestoreTrack
EXP_GetRmRestoreTrackW
EXP_GetRmRestoreW
EXP_IsEncryptFile
EXP_SEPGetFileAttributesCheckW
EXP_SEPGetFileAttributesW
EXP_SecDocEncA
EXP_SecDocEncW
EXP_SelfAuthGetFileAttributesW
EXP_SelfAuthSetFileAttributesW
EXP_Sep_SelfAuthCopyFilePlainW
EXP_SetPassword
EXP_TBFPSFileDecryptA
EXP_TBFPSFileDecryptW
EXP_TBFPSGetFileAttributesA
EXP_TBFPSGetFileAttributesW
EXP_TBFPSGetFileTypeA
EXP_TBFPSGetFileTypeW
EXP_TBFPSSetFileAttributesA
EXP_TBFPSSetFileAttributesW
EXP_bOnlineSelfFileUsed

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f1a34222d37c232b344b78f29a725a1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:c9:09:a3:98:55:dd:9a:b9:f2:55:ca:04:ce:4e:6fCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

94:52:22:ed:1d:c2:5b:39:f4:e7:62:74:36:94:57:5b:e4:74:32:1c:04:12:19:1a:61:5a:e5:0d:d3:be:c7:d4Signer

Headers

File Characteristics

PDB Paths

Imports

lckdocexp

mfc90u

msvcr90

kernel32

user32

shell32

shlwapi

msvcp90

Exports

Exports

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 1024B - Virtual size: 5KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 1KB - Virtual size: 1KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:c9:09:a3:98:55:dd:9a:b9:f2:55:ca:04:ce:4e:6f
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

94:52:22:ed:1d:c2:5b:39:f4:e7:62:74:36:94:57:5b:e4:74:32:1c:04:12:19:1a:61:5a:e5:0d:d3:be:c7:d4
Signer

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 1024B - Virtual size: 5KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 1KB - Virtual size: 1KB