d2d6682f4755b30a07f311c1eb4cd63cf57de870005f171d362e54cfd661801e

Sharing

Copy URL Twitter E-mail

General

Target

d2d6682f4755b30a07f311c1eb4cd63cf57de870005f171d362e54cfd661801e
Size

4.9MB
MD5

a999ffdbcc8f913e3c497f8d139fb806
SHA1

740a9affe2c1788899a0fa0ae7319c3ca9474f28
SHA256

d2d6682f4755b30a07f311c1eb4cd63cf57de870005f171d362e54cfd661801e
SHA512

9a2de5a954016f69dd464d8aa14aca47ac2c2d0d94c7816ba0784ce7bf02f7dc49c341a81e47d0cb3f431e4b3d71cf80398585e7ece14445c6b051683f96ed24
SSDEEP

98304:rXhXBIeRkH+XV5IvDFMmL5Tr891izWiZWAOt:rdB/RZI7lTrQ1iz8

Score

1^/10

Malware Config

Signatures

Files

d2d6682f4755b30a07f311c1eb4cd63cf57de870005f171d362e54cfd661801e
.exe windows:5 windows x86 arch:x86

81ed1c12ecbc8e2501397aea67696bd9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:03:d3:41:0e:57:67:8d:f3:fc:a1:3a:38:44:3e:84
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

27/10/2023, 00:00

Not After

24/03/2026, 23:59

Subject

SERIALNUMBER=913100006317722856,CN=Shanghai Oriental Webcasting Co. Ltd.,O=Shanghai Oriental Webcasting Co. Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:3b:be:c0:a1:d5:ae:e3:20:22:b8:a5:9f:5b:4b:8c:36:23:95:0b:9b:20:db:3a:37:fc:93:1f:5a:06:d2:09
Signer

Actual PE Digest

6b:3b:be:c0:a1:d5:ae:e3:20:22:b8:a5:9f:5b:4b:8c:36:23:95:0b:9b:20:db:3a:37:fc:93:1f:5a:06:d2:09

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnmapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
SetCurrentDirectoryW
GetSystemInfo
GetTickCount
QueryDosDeviceW
GetModuleHandleW
GetCurrentThreadId
VirtualFree
VirtualAlloc
Process32NextW
Process32FirstW
CreateFileMappingW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
OpenProcess
LocalFree
LocalAlloc
GlobalFree
GlobalAlloc
WTSGetActiveConsoleSessionId
RemoveDirectoryW
GetDriveTypeW
GetEnvironmentVariableW
GetLogicalDriveStringsW
GetCurrentProcessId
MoveFileExW
CopyFileW
DeleteFileW
SetFileAttributesW
GetTempPathW
FileTimeToSystemTime
ReadFile
WriteFile
CreateToolhelp32Snapshot
lstrlenA
GetFileSize
FindNextFileW
lstrcpyW
FindClose
GetLongPathNameW
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
Sleep
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
CreateDirectoryW
CreateThread
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
lstrlenW
GetVolumeInformationW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
SetPriorityClass
CreateFileW
OutputDebugStringA
CloseHandle
DeviceIoControl
GetLastError
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
GetCurrentProcess
InterlockedDecrement
MapViewOfFile
InterlockedIncrement
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FindFirstFileExW
GetConsoleCP
GetACP
SetConsoleCtrlHandler
ExitProcess
SetFilePointerEx
ExitThread
RtlUnwind
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
GetVersionExA
GetLocalTime
GetFullPathNameW
WaitForSingleObjectEx
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
FormatMessageA
InitializeCriticalSection
SleepEx
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
MulDiv
GlobalLock
GlobalUnlock
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
WinExec
SystemTimeToTzSpecificLocalTime
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW

user32

SendMessageW
SetWindowTextW
ShowWindow
SetWindowLongW
GetWindowLongW
SetForegroundWindow
GetForegroundWindow
SystemParametersInfoW
SetWindowPos
GetClassNameW
PeekMessageW
DispatchMessageW
TranslateMessage
LoadStringW
GetKeyState
UnregisterClassW
wsprintfW
PostMessageW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetDC
ReleaseDC
InflateRect
OffsetRect
DrawIconEx
GetIconInfo
IsWindow
IsWindowVisible
GetFocus
GetSystemMetrics
GetWindowRect
GetParent
LoadCursorW
DestroyCursor
DestroyWindow
SetTimer
KillTimer
SetCursor
SetRect
CopyRect
IntersectRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
CharNextW
DestroyIcon
SetFocus
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
GetActiveWindow
GetClientRect
MapWindowPoints
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
PostQuitMessage
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
ClientToScreen
EnableMenuItem
GetSysColor
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects

advapi32

GetSecurityDescriptorControl
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RevertToSelf
ImpersonateLoggedOnUser
RegEnumKeyW
RegOpenKeyW
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
RegCreateKeyExA
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyW
CloseServiceHandle
ControlService
DeleteService
OpenSCManagerW
OpenServiceW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
QueryServiceStatus
GetFileSecurityW
SetFileSecurityW
GetSecurityDescriptorDacl
AddAccessAllowedAce
GetAce
RegSetValueW
EqualSid
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
LookupAccountNameW

shell32

SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ShellExecuteW
ShellExecuteExW

ole32

CoCreateGuid
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateBindCtx

crypt32

CryptMsgGetParam
CryptMsgClose
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject

psapi

EnumProcessModules
GetModuleFileNameExW
GetProcessImageFileNameW

shlwapi

PathFileExistsW
PathAddBackslashW
SHDeleteKeyW
StrToIntExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipGetImageEncoders
GdipImageGetFrameCount
GdipDrawImageRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipImageSelectActiveFrame
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetImageEncodersSize
GdipAlloc

imm32

ImmGetContext
ImmReleaseContext
ImmAssociateContext

wldap32

ord22
ord41
ord200
ord30
ord79
ord35
ord27
ord32
ord301
ord26
ord50
ord60
ord211
ord46
ord143
ord33

ws2_32

getsockname
getsockopt
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
getpeername

gdi32

GetViewportOrgEx
GetCurrentObject
StretchBlt
SetBkMode
Rectangle
GetStockObject
CreateSolidBrush
EnumFontFamiliesExW
SetGraphicsMode
GetDeviceCaps
CreateBitmap
CreateRoundRectRgn
EnumFontsW
BitBlt
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
CreateCompatibleDC
GetFontData
GetCharABCWidthsW
CreateFontIndirectW
GetGlyphOutlineW
GdiFlush
GetTextFaceW
ExtTextOutW
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW

oleaut32

SysFreeString
SysAllocString

usp10

ScriptShape
ScriptItemize
ScriptFreeCache

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 893KB - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 475KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

81ed1c12ecbc8e2501397aea67696bd9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:03:d3:41:0e:57:67:8d:f3:fc:a1:3a:38:44:3e:84Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6b:3b:be:c0:a1:d5:ae:e3:20:22:b8:a5:9f:5b:4b:8c:36:23:95:0b:9b:20:db:3a:37:fc:93:1f:5a:06:d2:09Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

crypt32

psapi

shlwapi

userenv

wtsapi32

gdiplus

imm32

wldap32

ws2_32

gdi32

oleaut32

usp10

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 893KB - Virtual size: 893KB

.data Size: 73KB - Virtual size: 185KB

.gfids Size: 512B - Virtual size: 496B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 475KB - Virtual size: 474KB

Size: 358KB - Virtual size: 358KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:03:d3:41:0e:57:67:8d:f3:fc:a1:3a:38:44:3e:84
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6b:3b:be:c0:a1:d5:ae:e3:20:22:b8:a5:9f:5b:4b:8c:36:23:95:0b:9b:20:db:3a:37:fc:93:1f:5a:06:d2:09
Signer

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 893KB - Virtual size: 893KB

.data
Size: 73KB - Virtual size: 185KB

.gfids
Size: 512B - Virtual size: 496B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 475KB - Virtual size: 474KB