93abab7a2780b6425e5334c5e48724271e2d71edb4df15a61519409d4e32f7c2N

Sharing

Copy URL Twitter E-mail

General

Target

93abab7a2780b6425e5334c5e48724271e2d71edb4df15a61519409d4e32f7c2N
Size

129KB
MD5

1a599e539996c2ecd74d73bee43cae80
SHA1

3fa28cd17d261d2c00dac05a2a69bbff9d8bdb28
SHA256

93abab7a2780b6425e5334c5e48724271e2d71edb4df15a61519409d4e32f7c2
SHA512

bee90dae7658c414858505f87a9c1c8dd4a27a7b9825e2c3751428be01017a4e5afcf8e37b4ab471be87d4777e7e437034a71365a78f1e07fdb3afa02ce305f2
SSDEEP

3072:NUR4zg9+2HJawDjR2tpu33VJORnpv09I65ZO9Xm:+RjI+3DFyOOpcI65ZO9W

Score

1^/10

Malware Config

Signatures

Files

93abab7a2780b6425e5334c5e48724271e2d71edb4df15a61519409d4e32f7c2N
.exe windows:4 windows x86 arch:x86

6f68d505ea3b0777a8b74a45778e17cb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:79:09:71:b3:a1:96:60:61:e0:78:76:02:0c:ea:2c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/07/2007, 00:00

Not After

12/07/2008, 23:59

Subject

CN=KINGSOFT CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=KINGSOFT RESEARCH,O=KINGSOFT CORPORATION,L=ZhuHai,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4d:50:c7:f4:f6:23:a7:d4:1f:fd:95:c1:27:cc:f5:a2:4b:ee:57:59
Signer

Actual PE Digest

4d:50:c7:f4:f6:23:a7:d4:1f:fd:95:c1:27:cc:f5:a2:4b:ee:57:59

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\KIS\KIS\product\win32\dbginfo\kwatchx.pdb

Imports

kernel32

WideCharToMultiByte
DeviceIoControl
CreateFileW
MultiByteToWideChar
CopyFileW
SetFileAttributesW
GetSystemDirectoryW
lstrlenA
OpenProcess
GetDriveTypeW
GetCurrentThreadId
SystemTimeToFileTime
GetSystemTimeAsFileTime
IsBadReadPtr
CreateProcessW
SetLastError
OpenEventW
LocalFree
FormatMessageW
GetTimeFormatW
GetDateFormatW
GetLocalTime
WriteFile
GetFileSize
SetFilePointer
CreateDirectoryW
GetFileAttributesW
UnmapViewOfFile
MapViewOfFile
SizeofResource
Sleep
LoadResource
FindResourceW
ProcessIdToSessionId
GetCurrentProcessId
CreateFileMappingW
OpenMutexW
lstrcpyA
LoadLibraryA
lstrcmpiA
lstrcpynW
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
lstrcatW
lstrcmpiW
lstrlenW
GetTempPathW
FindFirstFileW
DeleteFileW
FindNextFileW
FreeLibrary
GetCommandLineW
SetConsoleCtrlHandler
GlobalFree
OutputDebugStringW
GetModuleHandleW
FindResourceExW
InterlockedExchange
FindClose
CreateThread
GetLastError
GetModuleFileNameW
GetSystemInfo
GetVersionExW
InitializeCriticalSection
CreateMutexW
CreateEventW
ResumeThread
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
SetProcessWorkingSetSize
ReleaseMutex
SetEvent
WaitForSingleObject
TerminateThread
ResetEvent
DeleteCriticalSection
CloseHandle
MoveFileExW
InterlockedIncrement
GetVersion
LoadLibraryW
GetProcAddress
LockResource

user32

GetClientRect
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
PeekMessageW
wsprintfW
GetSystemMetrics
DefWindowProcW
SetWindowPos
DestroyWindow
SetWindowLongW
UnregisterClassA
CharNextW
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
OpenInputDesktop
CharLowerW
GetWindowLongW
MoveWindow
PostQuitMessage
CloseDesktop
IsWindow
UpdateWindow
CreateDialogParamW

gdi32

GetObjectW
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
DeleteObject

advapi32

RegCreateKeyExW
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
LockServiceDatabase
ChangeServiceConfigW
CreateServiceW
ChangeServiceConfig2W
UnlockServiceDatabase
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetServiceStatus
StartServiceW
OpenSCManagerW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
CloseServiceHandle
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
RegCreateKeyW
RegOpenKeyW
RegDeleteKeyW
RevertToSelf

shell32

CommandLineToArgvW

ole32

StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString

shlwapi

PathRemoveFileSpecW
PathFindFileNameW

kis

kisCreateKSLangInstance
kisTerminate
kisQueryOEMContent
kisQueryOEMInfo

msvcr80

_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
??3@YAXPAX@Z
_vswprintf
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_purecall
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memset
_invalid_parameter_noinfo
wcsrchr
??_V@YAXPAX@Z
_beginthreadex
??_U@YAPAXI@Z
??2@YAPAXI@Z
wcsncmp
wcscat_s
wprintf
wcschr
fclose
_vscwprintf
vswprintf_s
_vsnwprintf_s
free
malloc
memcpy_s
fwprintf
_wfopen_s
_wcsicmp
_endthreadex
swscanf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
wcsncpy
_waccess
_snwprintf
wcsncat
_wsplitpath
memmove_s
strncmp
_mbsstr
_vscprintf
vsprintf_s
wcsstr
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv

msvcp80

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

sfc

SfcIsFileProtected

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6f68d505ea3b0777a8b74a45778e17cb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

28:79:09:71:b3:a1:96:60:61:e0:78:76:02:0c:ea:2cCertificate

Extended Key Usages

Key Usages

4d:50:c7:f4:f6:23:a7:d4:1f:fd:95:c1:27:cc:f5:a2:4b:ee:57:59Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

kis

msvcr80

msvcp80

sfc

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 9KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

28:79:09:71:b3:a1:96:60:61:e0:78:76:02:0c:ea:2c
Certificate

4d:50:c7:f4:f6:23:a7:d4:1f:fd:95:c1:27:cc:f5:a2:4b:ee:57:59
Signer

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 9KB - Virtual size: 8KB