75c2d5945560f07e2333b68fbdac6927b3ca89436b8260199349ae9d2182dceeN

Sharing

Copy URL Twitter E-mail

General

Target

75c2d5945560f07e2333b68fbdac6927b3ca89436b8260199349ae9d2182dceeN
Size

46KB
MD5

efb7620f8b72a198a682ceab8dc42b90
SHA1

85bff14ae28a417cfae1318d701b88d85e20fcb2
SHA256

75c2d5945560f07e2333b68fbdac6927b3ca89436b8260199349ae9d2182dcee
SHA512

23f86f59d9182a236a02b7a87af38e3a0c3ce3827291a169b2c6419cbcb6b3d1b2ee34f6f4f486d5024bc2a8e3c217e12c260df4d42e7d6999fd0f4b876cdedd
SSDEEP

768:a9wQHes2XtlOxptdUX8R4+7uK1ZO/RIl1Jd8PEs2+uHnHDHf/ck5G:Yis2bOvUX8R4+7LZaIl18PEsfOjHM

Score

1^/10

Malware Config

Signatures

Files

75c2d5945560f07e2333b68fbdac6927b3ca89436b8260199349ae9d2182dceeN
.exe windows:5 windows x64 arch:x64

b76d9fc1869e7505af7cd9335568a219

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:81:7b:a3:1e:ed:dd:4e:87:6e:5f:51
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

10/09/2024, 07:07

Not After

11/09/2025, 07:07

Subject

SERIALNUMBER=91440515MA4WNJBR1C,CN=Shantou Chenghai Carol For Toys Industrial Co.\,limited,O=Shantou Chenghai Carol For Toys Industrial Co.\,limited,L=Shantou,ST=Guangdong,C=CN,1.2.840.113549.1.9.1=#0c177a6f752e797540636f726f6c666f72746f79732e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13075368616e746f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07/11/2023, 17:13

Not After

09/12/2034, 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ce:6c:45:09:70:b3:8a:fd:b7:48:d3:1d:50:44:7f:fa:ef:5f:6c:84:49:4f:8c:1d:71:1b:77:1e:8e:6b:4a:26
Signer

Actual PE Digest

ce:6c:45:09:70:b3:8a:fd:b7:48:d3:1d:50:44:7f:fa:ef:5f:6c:84:49:4f:8c:1d:71:1b:77:1e:8e:6b:4a:26

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_state.pdb

Imports

msvcr80

?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
strchr
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_amsg_exit
memcpy
_itoa_s
__C_specific_handler
_vsnwprintf_s
strtol
strstr
__crt_debugger_hook
_purecall
strncmp

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus

kernel32

MultiByteToWideChar
SwitchToThread
GetProcessAffinityMask
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
GetVersionExW
GetSystemDirectoryW
LoadLibraryW
HeapReAlloc
RtlVirtualUnwind
HeapDestroy
FreeLibrary
HeapCreate
GetProcAddress
HeapAlloc
HeapFree
SetEvent
WaitForSingleObject
GetSystemInfo
Sleep
SetWaitableTimer
CloseHandle
CreateThread
CreateWaitableTimerW
CreateEventW
SetConsoleCtrlHandler
FormatMessageW
GetSystemTimeAsFileTime
RtlZeroMemory
lstrlenW
WideCharToMultiByte
RtlLookupFunctionEntry

ntdll

RtlCopyMemory

mswsock

AcceptEx
GetAcceptExSockaddrs

ole32

CoInitializeEx
CoUninitialize

ws2_32

select
WSASend
recv
listen
WSAGetLastError
WSARecv
WSAGetOverlappedResult
WSAAddressToStringA
inet_ntoa
gethostbyname
ntohs
WSACleanup
WSAStartup
closesocket
WSASocketW
setsockopt
htons
htonl
bind

mscoree

ClrCreateManagedInstance

webengine

AspnetLoadResourceDLL
AttachHandleToThreadPool
LoadLibraryUsingFullPath
PerfCounterInitialize
XspLogEvent
InitializeLibrary
PrintResourceString
GetXSPHeap

Exports

Exports

STWNDCloseConnection
STWNDDeleteStateItem
STWNDEndOfRequest
STWNDGetLocalAddress
STWNDGetLocalPort
STWNDGetRemoteAddress
STWNDGetRemotePort
STWNDIsClientConnected
STWNDSendResponse

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b76d9fc1869e7505af7cd9335568a219

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

5f:81:7b:a3:1e:ed:dd:4e:87:6e:5f:51Certificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

ce:6c:45:09:70:b3:8a:fd:b7:48:d3:1d:50:44:7f:fa:ef:5f:6c:84:49:4f:8c:1d:71:1b:77:1e:8e:6b:4a:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

ntdll

mswsock

ole32

ws2_32

mscoree

webengine

Exports

Exports

Sections

.text Size: 30KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

5f:81:7b:a3:1e:ed:dd:4e:87:6e:5f:51
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

ce:6c:45:09:70:b3:8a:fd:b7:48:d3:1d:50:44:7f:fa:ef:5f:6c:84:49:4f:8c:1d:71:1b:77:1e:8e:6b:4a:26
Signer

.text
Size: 30KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB