bce48557251b32b6357ec787551aeb093639d76eec7041392f081a6263557ab9

Sharing

Copy URL

Twitter E-mail

General

Target

bce48557251b32b6357ec787551aeb093639d76eec7041392f081a6263557ab9
Size

4.7MB
MD5

106fdf9240e53ab8541ee507da5fd695
SHA1

9a73f053d4b118176aee8072561f5aef19b14fe1
SHA256

bce48557251b32b6357ec787551aeb093639d76eec7041392f081a6263557ab9
SHA512

5643c10f3f190ab5d47a92f0676142bacd7b7cd3a651e570ca31fc3ea82087ce8c2df8c7f775627b71d26daf7a4285c6d8b79a2b8e0fcf9cef433cb4ca0f3e40
SSDEEP

98304:AmoPfJqXSceajGYpMCgQ/UxOETRl8XVtZyE:Ka4Kf8JTRVE

Score

1^/10

Malware Config

Signatures

Files

bce48557251b32b6357ec787551aeb093639d76eec7041392f081a6263557ab9
.exe windows:5 windows x86 arch:x86

bdab05406197f71f2002b2fed8d3994e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-11-2020 00:00

Not After

22-02-2024 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e4:31:3c:0b:a5:12:ff:9f:4f:d3:13:ed:73:95:07:ee:4e:e4:c5:a5:e3:c8:25:35:5a:aa:d5:3b:2e:c0:33:c4
Signer

Actual PE Digest

e4:31:3c:0b:a5:12:ff:9f:4f:d3:13:ed:73:95:07:ee:4e:e4:c5:a5:e3:c8:25:35:5a:aa:d5:3b:2e:c0:33:c4

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\workplace\AndroidEmulator\7KMarket_Git_Release64\Basic\Client\Output\Binfinal\Update2\TUpdate.pdb

Imports

comctl32

InitCommonControlsEx
_TrackMouseEvent

ws2_32

setsockopt
htons
inet_addr
inet_ntoa
WSAStartup
WSACreateEvent
WSAEventSelect
WSACleanup
sendto
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
recvfrom
ntohs
ntohl
send
WSAGetLastError
recv
select
freeaddrinfo
closesocket
connect
socket
getaddrinfo
getsockopt
getsockname
getpeername
WSASetLastError
bind
__WSAFDIsSet
listen
accept
gethostname
gethostbyname
shutdown
ioctlsocket

kernel32

GetDriveTypeW
GetModuleFileNameW
GetCommandLineW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetFileAttributesW
DeleteFileW
GetFileAttributesExA
DeleteFileA
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetExitCodeProcess
OpenProcess
TerminateProcess
ResetEvent
SwitchToThread
GetLocaleInfoW
GetEnvironmentVariableW
GetSystemDirectoryW
GetSystemTime
SystemTimeToFileTime
GetModuleFileNameA
WideCharToMultiByte
GetTickCount
WriteFile
SetFilePointer
ReadFile
GetFileAttributesExW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetLocalTime
InterlockedExchangeAdd
MoveFileW
GetCurrentThreadId
FormatMessageW
CreatePipe
CreateProcessA
PeekNamedPipe
IsProcessorFeaturePresent
GetSystemInfo
GlobalMemoryStatusEx
OutputDebugStringW
LoadLibraryExW
MoveFileExW
CopyFileW
VirtualAlloc
VirtualFree
ExpandEnvironmentStringsW
GetLongPathNameW
CreateDirectoryW
GetFileSize
lstrcmpW
LocalFileTimeToFileTime
SetFileTime
FileTimeToSystemTime
InitializeCriticalSection
SearchPathW
lstrcpynW
VirtualQuery
GetCurrentProcessId
WriteProcessMemory
SetUnhandledExceptionFilter
Thread32First
Thread32Next
OpenThread
SuspendThread
DuplicateHandle
Module32FirstW
Module32NextW
SetErrorMode
WaitForMultipleObjects
ReadProcessMemory
VirtualAllocEx
RaiseException
GetTempPathW
GetVersionExW
SetLastError
OutputDebugStringA
GetACP
DecodePointer
FreeResource
LocalFree
GlobalFree
GetLogicalDrives
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
OpenEventW
OpenFileMappingW
GetSystemDefaultLangID
SleepEx
FormatMessageA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
K32GetModuleFileNameExA
CreateDirectoryA
CreateFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
SetEndOfFile
CreateMutexA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
GetVersionExA
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTimeAsFileTime
QueryPerformanceCounter
FlushFileBuffers
GetModuleHandleA
GlobalMemoryStatus
FlushConsoleInputBuffer
GetConsoleMode
SetConsoleCtrlHandler
ExitProcess
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
ResumeThread
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
LCMapStringW
CompareStringW
GetCPInfo
QueryPerformanceFrequency
EncodePointer
QueueUserWorkItem
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
SetFilePointerEx
FindFirstFileExW
GetStringTypeW
CreateFileW
GetDiskFreeSpaceExW
GetCurrentProcess
DeviceIoControl
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryW
UnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
WaitForSingleObject
CreateFileMappingW
WaitForSingleObjectEx
ReleaseMutex
CreateMutexW
SetEvent
CreateEventW
DeleteCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
InterlockedExchange
InterlockedCompareExchange
CreateProcessW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
CloseHandle
GetLastError
OpenMutexW
ReadConsoleInputA
SetConsoleMode
SetEnvironmentVariableA
ReadConsoleW
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetThreadContext
SetThreadContext
FlushInstructionCache
LoadLibraryA

user32

UpdateLayeredWindow
FindWindowExW
IsWindowVisible
GetWindowRect
EndPaint
wsprintfW
GetSystemMetrics
GetDC
ReleaseDC
DestroyWindow
DefWindowProcW
CreateWindowExA
GetWindow
MapWindowPoints
FillRect
DrawTextW
FindWindowA
IsZoomed
SetPropW
GetUserObjectInformationW
EnumDisplayDevicesW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageTimeoutW
CallWindowProcW
SetCursor
SetFocus
ClientToScreen
WindowFromPoint
ScreenToClient
GetCursorPos
GetClassNameW
GetClassInfoExW
DrawIconEx
GetMenuState
GetSystemMenu
GetWindowTextW
GetActiveWindow
RegisterClassExA
SetWindowRgn
ShowWindow
UpdateWindow
SetRect
SystemParametersInfoW
PostMessageW
SetWindowPos
GetParent
SetForegroundWindow
PostQuitMessage
SendMessageW
LoadImageW
GetWindowLongW
IsWindow
CallNextHookEx
GetClassInfoW
SetWindowsHookExW
CreateWindowExW
UnhookWindowsHookEx
SetWindowLongW
LoadCursorW
RegisterClassExW
PtInRect
OffsetRect
IntersectRect
SetCapture
ReleaseCapture
GetCapture
GetKeyState
SetTimer
KillTimer
GetClientRect
CopyRect
EqualRect
RegisterWindowMessageW
GetPropW
RemovePropW
IsWindowUnicode
GetProcessWindowStation
BeginPaint
IsRectEmpty
InvalidateRect
UnionRect
FindWindowW
MessageBoxA

gdi32

SetTextColor
CreateSolidBrush
GetObjectA
CombineRgn
ExtCreateRegion
GetObjectW
Rectangle
CreateRectRgn
ExcludeClipRect
BitBlt
GetDeviceCaps
ChoosePixelFormat
SetPixelFormat
CreateFontIndirectW
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteDC
GetStockObject
SetBkMode
GetTextExtentPoint32W
CreatePen
CreateCompatibleBitmap

advapi32

RegOpenKeyExW
RegQueryValueExW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptGenRandom
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CloseServiceHandle
DeleteService
ControlService
OpenServiceW
OpenSCManagerW
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

SHCreateDirectoryExW
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetFolderPathA
CommandLineToArgvW

ole32

CoUninitialize
CoCreateGuid
CoCreateInstance
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoInitialize

oleaut32

VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString

shlwapi

SHGetValueW
PathIsDirectoryW
PathRemoveFileSpecA
SHDeleteKeyW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW
StrStrIA
PathFindFileNameW
wnsprintfW
PathAppendW
SHSetValueW
SHDeleteValueW
PathAddBackslashW

d3d9

Direct3DCreate9

opengl32

wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
wglGetProcAddress

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpQueryInfoW
InternetCloseHandle
InternetReadFile
InternetSetOptionW
InternetQueryOptionW
HttpSendRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetOpenW
InternetConnectW

psapi

GetModuleFileNameExW

winhttp

WinHttpGetProxyForUrl
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl

iphlpapi

IcmpCreateFile
IcmpCloseHandle
IcmpSendEcho

gdiplus

GdipDrawImageRectI
GdipGraphicsClear
GdipSetWorldTransform
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipAlloc
GdipBitmapUnlockBits
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipImageSelectActiveFrame
GdiplusStartup
GdipFree
GdipDisposeImage
GdiplusShutdown

msimg32

AlphaBlend

netapi32

Netbios

wldap32

ord142
ord41
ord216
ord147
ord79
ord27
ord26
ord127
ord46
ord301
ord133
ord208
ord167
ord118
ord145
ord14

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.QMGuid
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 920KB - Virtual size: 920KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvm0
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 126KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdab05406197f71f2002b2fed8d3994e

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e4:31:3c:0b:a5:12:ff:9f:4f:d3:13:ed:73:95:07:ee:4e:e4:c5:a5:e3:c8:25:35:5a:aa:d5:3b:2e:c0:33:c4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

d3d9

opengl32

version

wininet

psapi

winhttp

iphlpapi

gdiplus

msimg32

netapi32

wldap32

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 656KB - Virtual size: 656KB

.data Size: 64KB - Virtual size: 92KB

Shared Size: 512B - Virtual size: 16B

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 21B

.QMGuid Size: 512B - Virtual size: 32B

.rsrc Size: 920KB - Virtual size: 920KB

.tvm0 Size: 46KB - Virtual size: 48KB

.reloc Size: 126KB - Virtual size: 128KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e4:31:3c:0b:a5:12:ff:9f:4f:d3:13:ed:73:95:07:ee:4e:e4:c5:a5:e3:c8:25:35:5a:aa:d5:3b:2e:c0:33:c4
Signer

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 656KB - Virtual size: 656KB

.data
Size: 64KB - Virtual size: 92KB

Shared
Size: 512B - Virtual size: 16B

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 21B

.QMGuid
Size: 512B - Virtual size: 32B

.rsrc
Size: 920KB - Virtual size: 920KB

.tvm0
Size: 46KB - Virtual size: 48KB

.reloc
Size: 126KB - Virtual size: 128KB