94b64e6bd65cae99671201d3cf9170029d68b336e8a24f330665d303e3238106

Sharing

Copy URL

Twitter E-mail

General

Target

94b64e6bd65cae99671201d3cf9170029d68b336e8a24f330665d303e3238106
Size

901KB
MD5

17a678a4dc3e4197bdce4da798254635
SHA1

3bc5aa45ff846df981449adf9de7b595fa263559
SHA256

94b64e6bd65cae99671201d3cf9170029d68b336e8a24f330665d303e3238106
SHA512

30b0baa5251778682c97afe8d26e14594c81eac9325f860b2fd1c087d2b44dd8d364331b344e6b3118205cc7f1aefd17f448eee4f50425f7f582afa9b99540f6
SSDEEP

12288:JZcohgVGBmUyV8XOgh6LaISFP5FF6snXcscXh5KmR+M6Pt2H6qXco9TGU+BjvrEW:DYJUW8sFXimU7t2aq59TIrEH7a

Score

1^/10

Malware Config

Signatures

Files

94b64e6bd65cae99671201d3cf9170029d68b336e8a24f330665d303e3238106
.dll windows:5 windows x86 arch:x86

d595f4792d83acb4f9a5e93406abe434

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5d:8b:3c:db:a4:ab:c4:78:e5:1c:42:33:7f:2f:f6:55
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26-03-2013 00:00

Not After

25-03-2016 23:59

Subject

CN=QIHU 360 SOFTWARE CO. LIMITED,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Client Security Group,O=QIHU 360 SOFTWARE CO. LIMITED,L=Hong Kong,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:9d:bd:94:09:32:d8:dc:e3:0e:aa:8d:54:74:a3:d8:27:8e:51:89
Signer

Actual PE Digest

65:9d:bd:94:09:32:d8:dc:e3:0e:aa:8d:54:74:a3:d8:27:8e:51:89

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\39604\out\Release_i18n\360P2SP_EN.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

gethostbyname
accept
WSAAsyncSelect
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
shutdown
getpeername
bind
WSASetLastError
sendto
recvfrom
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
gethostname
WSAStartup
WSACleanup
htonl
WSCEnumProtocols
ntohs
ntohl
inet_ntoa
socket
htons
connect
closesocket
setsockopt
send
recv
inet_addr

kernel32

GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
SetStdHandle
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetTickCount
WriteFile
GetLastError
SetFilePointer
ReadFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObject
SetEndOfFile
GetFileSizeEx
CreateFileW
CreateEventW
CreateSemaphoreW
CreateMutexW
SetWaitableTimer
CreateWaitableTimerW
DeleteFileW
MoveFileW
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
SuspendThread
GetFileSize
GlobalAlloc
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
RaiseException
GetFileAttributesW
lstrlenW
lstrlenA
GetModuleHandleW
GetUserDefaultLangID
SetEvent
InterlockedDecrement
ResetEvent
GetCurrentProcessId
GetModuleFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetTempPathW
QueryPerformanceFrequency
GetModuleHandleA
GetSystemDirectoryA
GetLocalTime
InterlockedExchangeAdd
CreateThread
SetHandleCount
LCMapStringW
GetProcessHeap
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
GetCurrentDirectoryA
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
InterlockedIncrement
HeapReAlloc
GetCommandLineA
ExitThread
FindFirstFileW
GetDriveTypeW
GetLocaleInfoA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
lstrcmpA
lstrcmpiA
SetLastError
FormatMessageW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
RtlUnwind
IsDebuggerPresent
OutputDebugStringW
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
TlsSetValue
GetAtomNameW
OpenThread
AddAtomW
TlsAlloc
FindAtomW
DeleteAtom
TlsFree
LocalFree
GetSystemTime
TlsGetValue
HeapAlloc
HeapFree
DeviceIoControl
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringA

user32

SetWindowsHookExW
SetWindowTextW
SetDlgItemTextW
PostMessageW
UnregisterClassW
IsDlgButtonChecked
CallNextHookEx
IsDialogMessageW
PostQuitMessage
UnhookWindowsHookEx
SetForegroundWindow
ShowWindow
SetWindowLongW
GetWindowLongW
RegisterClassExW
CreateWindowExW
DefWindowProcW
SendMessageW
SetTimer
CreateDialogParamW
SetWindowPos
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetDlgItemTextW
wsprintfW
CheckDlgButton

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegEnumKeyExA
RegNotifyChangeKeyValue
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
AdjustTokenPrivileges
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleRun

oleaut32

GetErrorInfo
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
VariantInit
VariantChangeType
VariantClear

shlwapi

SHSetValueA
PathCombineW
PathCombineA
wvnsprintfW
SHGetValueA
StrStrIW

netapi32

Netbios

iphlpapi

GetNetworkParams
GetAdaptersInfo

secur32

InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle

wininet

InternetCanonicalizeUrlW
InternetCanonicalizeUrlA

rasapi32

RasEnumConnectionsW
RasGetConnectStatusW

Exports

Exports

CancelCheckProxy
CheckProxy
CheckProxyEx
CreateP2SPTask
GetFinishMessage
GetServerInfo
GetUploadInfo
Init
Login
QueryTask
QueryTask2
QueryTaskPeer
RemoveTask
SetConfigInfo
SetP2spOption
StartTask
StopSeed
StopTask
Uninit
UpdateRegInfo

Sections

.text
Size: 637KB - Virtual size: 636KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d595f4792d83acb4f9a5e93406abe434

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

5d:8b:3c:db:a4:ab:c4:78:e5:1c:42:33:7f:2f:f6:55Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

65:9d:bd:94:09:32:d8:dc:e3:0e:aa:8d:54:74:a3:d8:27:8e:51:89Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

iphlpapi

secur32

wininet

rasapi32

Exports

Exports

Sections

.text Size: 637KB - Virtual size: 636KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 19KB - Virtual size: 322KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 31KB - Virtual size: 31KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

5d:8b:3c:db:a4:ab:c4:78:e5:1c:42:33:7f:2f:f6:55
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

65:9d:bd:94:09:32:d8:dc:e3:0e:aa:8d:54:74:a3:d8:27:8e:51:89
Signer

.text
Size: 637KB - Virtual size: 636KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 19KB - Virtual size: 322KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 31KB - Virtual size: 31KB