12216fcb6dad6ef0fcf2ca96cbcb3d7f8748ce4d4a8fc17cb9eda534cefaf064

Sharing

Copy URL Twitter E-mail

General

Target

12216fcb6dad6ef0fcf2ca96cbcb3d7f8748ce4d4a8fc17cb9eda534cefaf064
Size

9.9MB
MD5

54841049486de6a2f0fe810ed7b630da
SHA1

3ad74fed09a5a76a44f61a951bbb6b283a642515
SHA256

12216fcb6dad6ef0fcf2ca96cbcb3d7f8748ce4d4a8fc17cb9eda534cefaf064
SHA512

99dcf8a1e37fc3ff01c6529a3c5171f9576383eab0514fc6e8b7336b695ec769f05efc634e675810a0385837c5bcb73cd6272db0fae7bf527eadbee7c7b3aa7e
SSDEEP

196608:EF077/fW2TwB81voYWEzOhXjDuVVYK0mciSKcYL+tGbVDv5Y:EF077X1wYdOFnuVROiSKz+tGbhv5Y

Score

1^/10

Malware Config

Signatures

Files

12216fcb6dad6ef0fcf2ca96cbcb3d7f8748ce4d4a8fc17cb9eda534cefaf064
.dll windows:6 windows x64 arch:x64

d7d282fc6a28036b82d298c2486bb155

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:38:19:8e:71:85:9e:53:6d:fb:41:fa:f2:33:45:4f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

05/06/2023, 00:00

Not After

24/09/2025, 23:59

Subject

SERIALNUMBER=91110107599635562F,CN=Douyin Vision Co.\, Ltd.,O=Douyin Vision Co.\, Ltd.,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13145368696a696e677368616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:1d:44:97:1f:ae:bb:f2:53:05:54:01:fb:bb:70:3d:8e:1b:67:cc:42:c1:e5:64:33:5b:e1:26:6f:30:86:81
Signer

Actual PE Digest

ae:1d:44:97:1f:ae:bb:f2:53:05:54:01:fb:bb:70:3d:8e:1b:67:cc:42:c1:e5:64:33:5b:e1:26:6f:30:86:81

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

pthreadvc2

pthread_cond_signal

sscronet

Cronet_UrlRequestParams_Destroy

shlwapi

StrToIntA

ws2_32

__WSAFDIsSet

kernel32

ReadConsoleW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

EnumDisplaySettingsW
CharUpperBuffW

gdi32

CreateDCW

advapi32

RegQueryValueExA

ole32

CoCreateGuid

oleaut32

VariantClear

parfait

?WriteCategory@ParfaitRecorderBase@parfait@@QEAAAEAV12@PEBD@Z

winmm

waveInGetDevCapsA

iphlpapi

GetAdaptersAddresses

wininet

InternetReadFile

version

GetFileVersionInfoSizeA

winhttp

WinHttpConnect

Exports

Exports

CreateMSConfigByAppID
CreateMSConfigBySDKID
CreateMSManagerUtils
DestoryMSConfig
DestoryMSManager
DestoryMSManagerUtils
MSBridgeML
MSBridgeOV
cJSONUtils_AddPatchToArray
cJSONUtils_ApplyPatches
cJSONUtils_ApplyPatchesCaseSensitive
cJSONUtils_FindPointerFromObjectTo
cJSONUtils_GenerateMergePatch
cJSONUtils_GenerateMergePatchCaseSensitive
cJSONUtils_GeneratePatches
cJSONUtils_GeneratePatchesCaseSensitive
cJSONUtils_GetPointer
cJSONUtils_GetPointerCaseSensitive
cJSONUtils_MergePatch
cJSONUtils_MergePatchCaseSensitive
cJSONUtils_SortObject
cJSONUtils_SortObjectCaseSensitive
cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bdvmp0
Size: - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bdvmp1
Size: 9.9MB - Virtual size: 9.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 873B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7d282fc6a28036b82d298c2486bb155

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:38:19:8e:71:85:9e:53:6d:fb:41:fa:f2:33:45:4fCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ae:1d:44:97:1f:ae:bb:f2:53:05:54:01:fb:bb:70:3d:8e:1b:67:cc:42:c1:e5:64:33:5b:e1:26:6f:30:86:81Signer

Headers

DLL Characteristics

File Characteristics

Imports

pthreadvc2

sscronet

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

parfait

winmm

iphlpapi

wininet

version

winhttp

Exports

Exports

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 344KB

.data Size: - Virtual size: 45KB

.pdata Size: - Virtual size: 45KB

_RDATA Size: - Virtual size: 348B

.bdvmp0 Size: - Virtual size: 7.1MB

.bdvmp1 Size: 9.9MB - Virtual size: 9.9MB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 1024B - Virtual size: 873B

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:38:19:8e:71:85:9e:53:6d:fb:41:fa:f2:33:45:4f
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ae:1d:44:97:1f:ae:bb:f2:53:05:54:01:fb:bb:70:3d:8e:1b:67:cc:42:c1:e5:64:33:5b:e1:26:6f:30:86:81
Signer

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 344KB

.data
Size: - Virtual size: 45KB

.pdata
Size: - Virtual size: 45KB

_RDATA
Size: - Virtual size: 348B

.bdvmp0
Size: - Virtual size: 7.1MB

.bdvmp1
Size: 9.9MB - Virtual size: 9.9MB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 1024B - Virtual size: 873B