e6ccbe41f2855cb0789c917f7faaf132d8d2a9ecd103f3c2aaf0f87fca1f8f96

Sharing

Copy URL

Twitter E-mail

General

Target

e6ccbe41f2855cb0789c917f7faaf132d8d2a9ecd103f3c2aaf0f87fca1f8f96
Size

1.0MB
MD5

d02530f3b97431f4ccb75d4fbedcf106
SHA1

5825dd6577ca148476f6e68987915206d44d82c4
SHA256

e6ccbe41f2855cb0789c917f7faaf132d8d2a9ecd103f3c2aaf0f87fca1f8f96
SHA512

023377cd5ad6afbfd5631ce29c676fef694daf088a0b44b6d3a165db18c843595cf8bf8c0798d5408c6b374f97b0ad96a97ae9ef738493456bd245f391c4bc8b
SSDEEP

24576:46T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1ihTGTTi0CnGkz4mvrgEJLW:eTUwTGTTglz4mvUt

Score

1^/10

Malware Config

Signatures

Files

e6ccbe41f2855cb0789c917f7faaf132d8d2a9ecd103f3c2aaf0f87fca1f8f96
.exe windows:4 windows x86 arch:x86

ad9d11227a86b863e31ddf6019cc7ab5

Code Sign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:d7:18:29:15:c1:95:a1:af:4e:96:e4:28:62:43:db
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

09/09/2019, 00:00

Not After

07/11/2022, 23:59

Subject

CN=深圳市宏电技术股份有限公司,O=深圳市宏电技术股份有限公司,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:2f:6c:83:26:d7:b4:01:d8:d0:c8:76:91:6e:1c:c9:cb:f3:20:18
Signer

Actual PE Digest

dd:2f:6c:83:26:d7:b4:01:d8:d0:c8:76:91:6e:1c:c9:cb:f3:20:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
system
memcpy
_wfopen
fseek
fclose
wcsncpy
wcslen
wcscpy
wcscat
wcscmp
memmove
memcmp
_stricmp
sscanf
atoi
strlen
strcpy
strcat
sprintf
malloc
free
_wstat
_wcsdup
strcmp
floor
ceil
_CIpow
_isnan
_finite
fread
longjmp
_setjmp3
ftell
wcsncmp
_snwprintf
_wcsicmp
tolower
localtime
mktime
_wcsnicmp
_itow
gmtime
fabs
pow
??3@YAXPAX@Z
wcsstr
calloc
_errno
strrchr
strchr
strncpy
memchr
_lseeki64
realloc
abort
_close
_wopen
_setmode
exit
_open_osfhandle
_strdup
_snprintf
setlocale
strncmp
wctomb
_get_osfhandle
_open
toupper
wcschr
mbstowcs
frexp
modf
fopen
strerror
atof
abs
fflush
fwrite
__p__iob
fprintf
getenv
_stati64
time
_ftime
_vsnwprintf
cos
fmod
sin

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
GetDiskFreeSpaceExW
GetCurrentProcess
GetLastError
GetUserDefaultLangID
GetSystemInfo
ExpandEnvironmentStringsW
FormatMessageW
LocalFree
OutputDebugStringW
LoadLibraryW
FindResourceW
FreeLibrary
LoadResource
SizeofResource
LockResource
CreateMutexW
CloseHandle
BeginUpdateResourceW
EndUpdateResourceW
GetBinaryTypeW
UpdateResourceW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
HeapAlloc
HeapFree
Sleep
CreateFileW
GetFileSize
ReadFile
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
SetEnvironmentVariableW
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessW
GetModuleFileNameW
GetProfileStringW
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
SetEndOfFile
WriteFile
DeleteFileW
HeapReAlloc
GetVersionExW
SetLastError
CopyFileW
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
RemoveDirectoryW
GetDriveTypeW
GetFileAttributesW
GetTempPathW
MulDiv
GetLocalTime
TlsAlloc
TlsSetValue
TlsGetValue
GlobalFree
GlobalAlloc
HeapSize
TlsFree
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
VirtualAlloc
VirtualFree
IsValidCodePage
GetACP
GetOEMCP
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetExitCodeProcess
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

user32

IsWindowEnabled
IsWindowVisible
ExitWindowsEx
GetActiveWindow
SendMessageW
GetWindowTextLengthW
GetSysColor
SetRect
GetWindowLongW
RedrawWindow
GetDlgCtrlID
GetWindowTextW
ShowWindow
SetForegroundWindow
SetWindowLongW
UpdateLayeredWindow
DestroyIcon
EnumWindows
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
EnableWindow
SetWindowPos
DestroyWindow
SystemParametersInfoW
SetFocus
GetFocus
GetParent
GetClassNameW
SetWindowTextW
CallWindowProcW
RemovePropW
GetWindowRect
GetPropW
CreateWindowExW
SetPropW
SetScrollPos
GetDC
InflateRect
ReleaseDC
GetWindowDC
MapWindowPoints
MoveWindow
InvalidateRect
GetIconInfo
UpdateWindow
ReleaseCapture
BeginPaint
DrawStateW
EndPaint
SetCapture
ScreenToClient
GetSystemMetrics
GetSysColorBrush
DrawTextW
GetWindow
ValidateRect
ClientToScreen
GetClientRect
FillRect
DefWindowProcW
LoadCursorW
RegisterClassExW
SetClassLongW
EnumPropsExW
SetActiveWindow
LoadIconW
IsZoomed
IsIconic
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
RegisterClassW
AdjustWindowRectEx
CreateAcceleratorTableW
UnregisterClassW
DestroyAcceleratorTable
GetMenu
SetTimer
KillTimer
DefFrameProcW
EnumChildWindows
GetKeyState
IsChild
RegisterWindowMessageW
CreateIconFromResourceEx
CreateIconFromResource
CharLowerW
DrawIconEx

gdi32

StartDocW
GetMapMode
SetMapMode
GetDeviceCaps
DPtoLP
StartPage
EndPage
EndDoc
SetBkColor
CreateDCW
DeleteObject
GetStockObject
CreateFontIndirectW
ExcludeClipRect
GetObjectType
GetObjectW
SetTextColor
SelectObject
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
SetStretchBltMode
StretchBlt
CreateSolidBrush
GdiGetBatchLimit
GdiSetBatchLimit
BitBlt
CreateDIBSection
SetBrushOrgEx
CreateBitmap
SetPixel
GetDIBits
CreateFontW
SetBkMode
SetTextAlign
TextOutW
GetTextMetricsW
GetPixel

comdlg32

PrintDlgW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetUserNameW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
StringFromGUID2
RevokeDragDrop

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHCreateDirectory
SHBrowseForFolderW
ExtractIconW
SHGetFileInfoW
ShellExecuteExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.code
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 576KB - Virtual size: 576KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad9d11227a86b863e31ddf6019cc7ab5

Code Sign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

04:d7:18:29:15:c1:95:a1:af:4e:96:e4:28:62:43:dbCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

dd:2f:6c:83:26:d7:b4:01:d8:d0:c8:76:91:6e:1c:c9:cb:f3:20:18Signer

Headers

File Characteristics

Imports

msvcrt

kernel32

gdiplus

user32

gdi32

comdlg32

advapi32

comctl32

ole32

shell32

version

Sections

.code Size: 66KB - Virtual size: 66KB

.text Size: 576KB - Virtual size: 576KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 56KB - Virtual size: 63KB

.rsrc Size: 13KB - Virtual size: 13KB

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

04:d7:18:29:15:c1:95:a1:af:4e:96:e4:28:62:43:db
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

dd:2f:6c:83:26:d7:b4:01:d8:d0:c8:76:91:6e:1c:c9:cb:f3:20:18
Signer

.code
Size: 66KB - Virtual size: 66KB

.text
Size: 576KB - Virtual size: 576KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 56KB - Virtual size: 63KB

.rsrc
Size: 13KB - Virtual size: 13KB