jaffacakes118_9612c4eca666a273d63ad7504a2547b6211835c70d979a1753a171f32c9427f6[.]bin

resource	yara_rule
static1/unpack001/SoftAngel/SoftAngel.exe.tmp	upx

resource
jaffacakes118_9612c4eca666a273d63ad7504a2547b6211835c70d979a1753a171f32c9427f6.bin
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/OnTop.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack002/out.upx
unpack001/SoftAngel/uninst.exe
unpack003/$PLUGINSDIR/FindProcDLL.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/System.dll

resource
unpack001/$COMMONFILES/Angels/AgLog.dll.tmp
unpack001/$COMMONFILES/Angels/Agwin7.dll.tmp
unpack001/$COMMONFILES/Angels/AngelAsst.exe.tmp
unpack001/$COMMONFILES/Angels/IEMenuExt.dll.tmp
unpack001/$COMMONFILES/Angels/IEScan.dll.tmp
unpack001/$COMMONFILES/Angels/IEsafe.dll.tmp
unpack001/$COMMONFILES/Angels/Scan.dll.tmp
unpack001/$COMMONFILES/Angels/WebSafe.dll.tmp
unpack001/$COMMONFILES/Angels/go114fa.exe.tmp
unpack001/$COMMONFILES/Angels/xFoCtrl.dll.tmp
unpack001/$PLUGINSDIR/nsWebEx.dll
unpack001/$TEMP/updatesafe.exe
unpack001/SoftAngel/SoftAngel.exe.tmp

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/SoftAngel/uninst.exe	nsis_installer_1
static1/unpack001/SoftAngel/uninst.exe	nsis_installer_2

jaffacakes118_9612c4eca666a273d63ad7504a2547b6211835c70d979a1753a171f32c9427f6.bin

SHA256 9612c4eca666a273d63ad7504a2547b6211835c70d979a1753a171f32c9427f6
MD5 e111e24dc18e55a169cd37257cdeda39
SHA1 529879c5ad4ace969dbf65f5c533f9b73380992d
SHA512 3bd05675e7447265c3ddb29ae9ef723e0b366fd0b8a577900d7cb2338691460989aeac934d26a7a8ca608dea90be95969e8d9c9151f408cd6748b2d8bd1ed7a0
SSDEEP 98304:dPPOb/H/qxF18bClQ2gvfYd1ChcpI6FTQ5vAeZhK3hLhX:hOb/H/qxF1sL3Yd5q5vAqK1
TLSH
T11E0633219592C988C842FD37C426E6B7EB1A3F48CD89154B1E3E3DB97E3CC05D4A6B58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$COMMONFILES/Angels/$0

SHA256 883967e66df47c4bd3810aa2df7e3af059140b206273a2be3689f88ffb427288
MD5 7606229a20eea288cdb776b7c76da447
SHA1 9823df7de56166411b75d7b6d3105888d0711189
SHA512 ffc9983504d6c2fad61eaeb2371c66ff09f85870325be53c823c9442916bf083406a628d0c7949b45f721b31c4a01f08e3a7a86237ffd3139b8ab730f7faf3af
TLSH
T12311AF556D40424A903E79E019DA0BBA30725EE5C245FAC186CE7557AF9351BF0F7020
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$COMMONFILES/Angels/AgLog.dll.tmp

IMPHASH 8b94593f8aa2176ca294ef29c489bf88
SHA256 5b432e3255dc73277356571855cb782d3a376c9d2a77eec940092853b68319fb
MD5 eac8960e017bd934b2009f6db2faf03c
SHA1 709263b55e8002c9acde39ff48eb9b43486d5ec6
SHA512 2c27493d946f3696c200b3c8db9bb698a6d8e2dcc8ad94304ca7c34b5d4fd40c735214691dcd294923515831da818a482d4821d0e0b92d162b8734ba07c9e6e5
SSDEEP 6144:BCv6QXUtiBav//wX4Yz0jfTc3B3QvZusUhm:IPi/wX4YzYfTchQhu0
TLSH
T158546C1176C1C476D6AA25394116C77626FABC305BA0C2C7FBD03A7D6F322C29E3935A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Sep 25, 2026

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

97064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Source\AgLog\Release\AgLog.pdb

kernel32

HeapFree GetCommandLineA HeapAlloc RtlUnwind Sleep ExitProcess RaiseException VirtualAlloc HeapReAlloc HeapSize SetStdHandle GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree SetHandleCount GetStdHandle GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW CreateFileA SetEnvironmentVariableA GetFileTime GetFileSizeEx GetFileAttributesW GetFullPathNameW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers InterlockedIncrement GetModuleHandleA GlobalFlags GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue InterlockedDecrement LocalAlloc FileTimeToLocalFileTime FileTimeToSystemTime GlobalFree GlobalUnlock FormatMessageW LocalFree lstrlenW WaitForSingleObject GlobalAddAtomW SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetSystemInfo GetProcAddress GetVersionExW GetModuleHandleW GetSystemDefaultLangID GetVolumeInformationW GetCurrentProcessId DeleteFileW DeleteCriticalSection EnterCriticalSection WritePrivateProfileStringW GetTimeZoneInformation LeaveCriticalSection GetPrivateProfileIntA InitializeCriticalSection GetPrivateProfileStringW ExpandEnvironmentStringsA GetTickCount lstrlenA MultiByteToWideChar CloseHandle LockResource GetLocalTime GetLastError CreateFileW ReadFile SizeofResource WideCharToMultiByte WriteFile LoadResource FindResourceW SetFilePointer FreeEnvironmentStringsW GetFileSize

user32

DestroyMenu CharUpperW GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush ClientToScreen ShowWindow SetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetWindowTextW GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow UnregisterClassW UnhookWindowsHookEx GetMenuItemID GetMenuItemCount GetSubMenu SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow SetCursor PostMessageW PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetSystemMetrics MessageBoxA MessageBoxW

gdi32

GetStockObject TextOutW RectVisible PtVisible DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape CreateBitmap SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox GetDeviceCaps ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW CryptDestroyKey CryptEncrypt CryptImportKey CryptGenRandom CryptReleaseContext CryptSetKeyParam CryptAcquireContextW

shell32

ord165 SHGetFolderPathW

shlwapi

PathFindFileNameW UrlUnescapeW PathStripToRootW PathIsUNCW PathFindExtensionW

oleaut32

VariantClear VariantInit VariantChangeType

ws2_32

WSAStartup WSACleanup WSASetLastError

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

InternetConnectW HttpSendRequestW InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW HttpQueryInfoW HttpAddRequestHeadersW InternetQueryDataAvailable InternetSetOptionExW InternetCanonicalizeUrlW InternetCrackUrlW HttpOpenRequestW InternetCloseHandle

$COMMONFILES/Angels/Agwin7.dll.tmp

IMPHASH ca3f15eec83fb7e594f68f6dcb467db9
SHA256 07a15218c0862b9406e3a1002c0dfedac2fbad69578add537d5ef23961d36d9b
MD5 71c71a81864920b3c993500370bd24cd
SHA1 1afdb9e97970741728788c3aa4da83de0c1893ec
SHA512 f4737c417e9370144409bc762f2a9067ec23c08359835f3c1191af5449c2f9ba72656cef4003309ad5f3a2b1878f3cadc34ef801414122b7b50ba66a2ce3e960
SSDEEP 768:kpdcLGMKEfsu1nWmmR2LEY2t7bXrvSZYA8YKU1r15sD+ewMLEUbGq:knLMWTR24Y2tHXrv0hLrK+eF4QGq
TLSH
T116538D527A50C032D5561934546AC2E25E7E7D322BE4C487BFA603694FA13E2B37E34F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

71:43:c9:4b:de:ac:20:7c:9d:c8:dd:52:14:23:00:3e:e6:04:bb:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 13, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

6257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleHandleW GetProcAddress GetModuleFileNameW GetLastError GetVersionExW GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar HeapAlloc VirtualAlloc HeapReAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA CloseHandle FlushFileBuffers

ole32

PropVariantClear CoCreateInstance

$COMMONFILES/Angels/AngelAsst.exe.tmp

IMPHASH f7291fcd7324c762026b4751870129d0
SHA256 57d2ed4d5ffce987eba4321a055f6c2f74f94a09ec13053205462f205df33fe0
MD5 fcddb14984babda702a989a4182724d2
SHA1 8220a6486fa2d5b3fdb5e936d372c4f13438f015
SHA512 5f813e63e717df87c7f516e7b4e7b2daf3550d36f0d5347dd82e25f174eef5f0a3c615abdb3619f55f562d270c92af934acc06b50218dae892f7d531f7f390a5
SSDEEP 3072:GHrcfb6juHeNxHlbuL9hKNIVu2f+FZKPSxE:GHrcfb6juHmlSL9hLVu2cZJE
TLSH
T16BC39D117AC0C5B2E85215350D69CB954A7AFE710F6986C777683BAE4E703C24B3B38B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

2d:1b:6f:49:04:b6:0a:e2:c0:6f:8b:6d:17:b5:75:d8:3e:42:bc:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 23, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

42683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileW ExpandEnvironmentStringsW GetPrivateProfileStringW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSize CreateFileW GetPrivateProfileSectionNamesW CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetPrivateProfileIntW GetPrivateProfileSectionW LeaveCriticalSection EnterCriticalSection GetCurrentProcessId GetTickCount GetLocalTime GetProcessHeap OpenProcess HeapAlloc HeapFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess GetCommandLineW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement CreateEventW GetCurrentThreadId Sleep WaitForSingleObject GetModuleFileNameW CreateThread ResumeThread SetEvent CloseHandle lstrcmpiW lstrlenW GetModuleHandleW GetProcAddress GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer WideCharToMultiByte LoadLibraryA InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount RtlUnwind GetStartupInfoW VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW

user32

LoadStringW CharUpperW MessageBoxW CharNextW TranslateMessage DispatchMessageW GetMessageW PostThreadMessageW

advapi32

GetKernelObjectSecurity InitializeSecurityDescriptor CryptAcquireContextW CryptReleaseContext CryptGenRandom GetUserNameW BuildExplicitAccessWithNameW GetSecurityDescriptorDacl SetEntriesInAclW MakeAbsoluteSD SetSecurityDescriptorDacl SetKernelObjectSecurity DuplicateTokenEx ImpersonateLoggedOnUser CreateProcessAsUserW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW ChangeServiceConfigW ChangeServiceConfig2W RegEnumKeyExW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource ControlService DeleteService CreateServiceW OpenSCManagerW OpenServiceW CloseServiceHandle RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoInitialize CoUninitialize CoCreateInstance StringFromGUID2

oleaut32

SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi LoadRegTypeLi VarUI4FromStr RegisterTypeLi SysStringLen

shlwapi

PathFileExistsW StrCmpNIW

urlmon

URLDownloadToFileW

$COMMONFILES/Angels/IEHelp.htm.tmp

SHA256 609471ce7403a914ef23d91082242c876e1b2ffcfcc6a70ab1309f45b387d1d4
MD5 4e72a0d4ecf37f91b9fc9fd2e27a6661
SHA1 c3e9117731947e1a3e2f9aaea9356cedf5fe53da
SHA512 ffc517b819c9e995f0aadef0583b099b16bff262315a9f27ba1c6306d0e0fde30c32ecaac19fdaf9584f182b64677699b42d40606f4038637485b2b5601d79bb
TLSH
T15D112015341588F811D9125C6738C58CFD77807321E6B4F1B98CCC9D97B1E98A5E49E8
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$COMMONFILES/Angels/IEMenuExt.dll.tmp

IMPHASH e0f58ba6084a5b179c79424ceac9fd5e
SHA256 ae47cd1154ceafc74bb4b8b11f5425bd12f2ac5eb3f3ecd7153837cd1b0761f7
MD5 4c6f8c20b9a649e42b07f33bcce32290
SHA1 c5a59524d924aa66c321479cc1dd0486cb669f61
SHA512 59d0c341a4beff3dc2b53d3493e2a4642b6c91a426aca0a5510f8ddff732aebc22882535841cf96295acb630b6b73609031df1b697308f360d6798e865fdcd3f
SSDEEP 3072:tHWSddWrkqTQslbv7mfpAQx0F9OS8jouaTX5CEoHgr5Aa9+4UtEBi41kRw:ZW4r87y0POJvakEoHk5AaCfi
TLSH
T150148C023781C477D64F12394466DB751A7AFD340BA196C7BF98AF7E4E302C29E3528A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6c:45:16:b1:cc:e9:45:54:46:eb:74:67:ed:2c:f8:7b:69:25:4e:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

66761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenW GetLastError GetProcAddress GetModuleHandleW lstrcmpiW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW InterlockedDecrement SetThreadLocale GetThreadLocale GetACP CloseHandle WriteFile CreateFileW GetProcessHeap InterlockedIncrement GetModuleFileNameW GetFileAttributesW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection LoadLibraryExW RaiseException SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetLocaleInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidLocale EnumSystemLocalesA InterlockedExchange Sleep RtlUnwind HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetOEMCP IsValidCodePage HeapSize ExitProcess VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetModuleHandleA ReadFile SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID

user32

wsprintfA CharNextW

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegSetValueW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2

oleaut32

LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen SysFreeString

$COMMONFILES/Angels/IEScan.dll.tmp

IMPHASH d4d7acf2490f50cad61341abdc13b81b
SHA256 589c537d60dfb98c6fbb1d5a26c2ffed48ed3b6ce083e2fc0ff9f4d45f6cbed3
MD5 bc790cfb3e358b55b841410ae2fd7fa1
SHA1 2cc3e8d98279a5e730bce9b77b18d19d069c90ee
SHA512 97de33fe680f8289fd3b2d761db345198278194853aa40e4c7fa58cd549ff3c55cb2178e0001d0fef74fd385c366a7b2cbb17c0622d955681b564bc5cfe87ee7
SSDEEP 768:8Q0Uz/q4DHd5IytXGU1ZclADgN87Hra48fd+R0iyQpH/xL53+SeeKWr392LEUbG8:B0f4D9yYJlDgMgfdtyt/P+Cj924QG8
TLSH
T185536B01B3908077C9560F783568D3614E3EB9112EF550CA7FA94A6E5F637E0AB3835E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

14547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\src\IE360\bin\IEScan.pdb

kernel32

GetVersion DisableThreadLibraryCalls GetProcAddress GetModuleFileNameW Sleep LoadLibraryW CreateProcessW GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetLastError HeapFree HeapAlloc LCMapStringW ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection GetLocaleInfoA VirtualAlloc HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapSize

user32

SendMessageW wsprintfW

advapi32

RegOpenKeyExW RegEnumValueW RegQueryValueExW RegCreateKeyExW RegCloseKey

$COMMONFILES/Angels/IEsafe.dll.tmp

IMPHASH b39b2b15224277c12a2ea0c459fa58fb
SHA256 5d112bb59e28f4e2c2caf5d66b76cd625f04e79d87e69610e835653bf4f7574c
MD5 e17b2e98ece6437d1c4706bec74f4123
SHA1 12e35f617552c6f46f28a591d243921760d2553d
SHA512 1b666d0a02d5f0647362fcffa46af47a41583406129a7aaf903e395563f9a07be238d3277ad0c841473c5ca0cc56d0a1c5ae2c1033518125b0207f594c691a82
SSDEEP 12288:IfpD/QT3YycROwCH7JrNxfhcfVuOfkY0Kqpx/25tbyoVmmjyHe4TBu1pJLR3j3LT:6sPrm++ou1p/j3LTD9JBp
TLSH
T1E5359E12B284C4BAC9ED21348D17DA76227A7D210F39D7CB6B98FB4D5E313C8593D292
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

a5:c7:ac:e6:a5:e9:d8:3e:9b:ad:c2:e5:81:91:fd:48:d8:d3:ee:b9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

391683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

GetUrlCacheEntryInfoW DeleteUrlCacheEntryW

winmm

PlaySoundW

gdiplus

GdiplusShutdown GdipLoadImageFromFile GdipFree GdipAlloc GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipCloneImage GdiplusStartup

kernel32

GetSystemWindowsDirectoryW ExpandEnvironmentStringsW GetCurrentThreadId GetTickCount GetCurrentProcessId SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA LoadLibraryA MultiByteToWideChar lstrlenA HeapFree HeapAlloc GetProcessHeap GetCurrentProcess RaiseException FlushInstructionCache lstrcmpiW LoadLibraryExW TerminateThread WaitForSingleObject DisableThreadLibraryCalls SizeofResource LoadResource FindResourceW GlobalAlloc WideCharToMultiByte CreateThread GlobalFree WriteFile DebugBreak OutputDebugStringW GlobalUnlock GlobalLock MulDiv GlobalHandle LockResource CreateProcessW MoveFileExW ResumeThread GetPrivateProfileStringW VirtualProtectEx IsBadReadPtr GetTempPathW InterlockedCompareExchange CreateFileMappingA CreateEventA GetSystemInfo lstrcmpiA GetVersionExA CompareStringW CompareFileTime SystemTimeToFileTime FileTimeToSystemTime GetWindowsDirectoryW GetLongPathNameW FileTimeToDosDateTime FileTimeToLocalFileTime FindClose FindFirstFileW VirtualQuery VirtualProtect VirtualAlloc GetThreadContext SetThreadContext SuspendThread SetFilePointer TlsAlloc TlsGetValue HeapReAlloc HeapDestroy HeapCreate GetCommandLineA GetSystemTimeAsFileTime GetConsoleMode GetConsoleCP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind LocalFree VirtualFree IsProcessorFeaturePresent InterlockedExchange GetLocalTime GetCPInfo GetACP GetOEMCP IsValidCodePage lstrcmpW lstrcpyW OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary OutputDebugStringA GetModuleFileNameW SetLastError LoadLibraryW GetCurrentThread GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA Sleep DeleteFileW InterlockedIncrement CopyFileW CreateFileW ExitProcess GetStdHandle GetModuleFileNameA LCMapStringW HeapSize GetFileType SetHandleCount GetStartupInfoA SetStdHandle GetFileSize WriteConsoleA GetConsoleOutputCP WriteConsoleW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter LCMapStringA GetStringTypeA GetLastError ReadFile CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection CreateDirectoryW lstrlenW InterlockedDecrement GetStringTypeW InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetEndOfFile GetLocaleInfoW FlushFileBuffers TlsSetValue TlsFree

user32

OffsetRect GetCursorPos RegisterWindowMessageW LoadBitmapW MessageBeep SetDlgItemInt GetDlgItemInt CreateAcceleratorTableW DestroyAcceleratorTable BeginPaint EndPaint FillRect IsChild RedrawWindow InvalidateRgn InvalidateRect MoveWindow SetWindowTextA SetFocus GetDlgItemTextW EnableWindow GetDlgItem MapDialogRect EndDialog SetWindowContextHelpId DestroyIcon LoadImageW GetCursor DrawEdge DialogBoxIndirectParamW GetActiveWindow SetForegroundWindow BringWindowToTop UpdateWindow ReleaseCapture PtInRect SetCursor IsWindowVisible wsprintfW SetMenuItemInfoW DrawFocusRect InflateRect CopyRect DrawTextW DeleteMenu ScreenToClient wvsprintfW AdjustWindowRectEx SetCapture ReleaseDC GetDC GetWindowTextLengthW GetWindowTextW CharNextW GetClassInfoExW RegisterClassExW CharUpperBuffW GetSystemMetrics DestroyWindow GetSysColor LoadCursorW GetDesktopWindow SetWindowLongW CreateWindowExW DestroyMenu ClientToScreen LoadMenuW GetSubMenu TrackPopupMenu DefWindowProcW MessageBoxW ShowWindow wsprintfA UnhookWindowsHookEx GetFocus SetTimer TranslateMessage PostMessageW DispatchMessageW FindWindowExW GetClassNameW GetAsyncKeyState GetKeyState CallWindowProcW KillTimer CharLowerBuffW IsWindow LoadStringW LoadIconW GetParent GetWindow GetWindowRect MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos SendMessageW SetDlgItemTextW SetWindowTextW GetWindowLongW UnregisterClassA GetMenu

gdi32

CreateSolidBrush MoveToEx GetTextMetricsW SetMapMode SetTextAlign CreateFontIndirectW GetDeviceCaps SetBkMode GetStockObject GetDIBits GetObjectW CreateCompatibleDC CreateBitmap CreateCompatibleBitmap SetBkColor BitBlt DeleteDC CreatePen GetTextExtentPoint32W DeleteObject LineTo SelectObject

advapi32

RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegEnumValueW RegQueryInfoKeyW RegEnumKeyExW CopySid GetLengthSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority RegGetKeySecurity FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl AllocateAndInitializeSid RegEnumKeyW RegSetKeySecurity GetUserNameW RegDeleteKeyW RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CoGetMalloc CoTaskMemAlloc CLSIDFromProgID StringFromIID CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal ReleaseStgMedium OleLockRunning CoGetClassObject CLSIDFromString RegisterDragDrop OleInitialize CoTaskMemRealloc OleUninitialize CoTaskMemFree

oleaut32

VarBstrCmp VariantInit VariantClear SysAllocString SysAllocStringLen DispCallFunc LoadRegTypeLi LoadTypeLi VariantChangeType SysStringLen RegisterTypeLi VarUI4FromStr SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector SysFreeString UnRegisterTypeLi

shlwapi

PathFileExistsW StrToIntW StrCpyW

urlmon

IsValidURL URLDownloadToCacheFileA URLDownloadToFileW

oleacc

AccessibleObjectFromWindow

Name

.text

Size

504KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

149KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$COMMONFILES/Angels/Scan.dll.tmp

IMPHASH cebe3e34ceb35941b3c83de27fd8e026
SHA256 54e849e119904f52cfca5362290daa094544a569c13c9f5edf4806a5e0f611a2
MD5 6891d3d4e9fefe584e758db70c0380ae
SHA1 f79f700870f2ea2e37be7bb5569c5a035ffefe81
SHA512 b0e908d2067fdc579904c73d13b14d96e22dab546961a65dff867bd0e41acb3483e974acce887fb7586ddc42f33ee28f22369327b90c9a3c9e9c120b40d22e12
SSDEEP 24576:TgcIwdCFEXGwz6Ff78H8KZ7SI7ErlB6azPTkkkkkkkkkkkkkkUkkkkkkkkkkkkk6:TgcIwi5nQ24EreytZ2ce
TLSH
T121458DE2F9438036E69B3177C2BB1F3DBA395D114B065CC363C82E9D59721E2B63518A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

21:6e:c6:b7:86:cb:f6:79:f5:da:b0:4d:45:1d:84:e4:85:63:cd:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

634033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\haokanbar4\browser\ie\Scan\Release\Scan.pdb

winmm

timeGetTime timeBeginPeriod timeEndPeriod

kernel32

GetFileAttributesExW DeleteFileW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CreateMutexW SetFilePointer WaitForSingleObject GetTickCount GetModuleFileNameW GetCurrentThreadId OutputDebugStringA ReleaseMutex GetCurrentProcessId Sleep RaiseException InterlockedExchangeAdd WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentProcess GetFullPathNameA CreateFileA GetFileSize FreeLibrary UnlockFile LockFile FormatMessageA LoadLibraryW FlushFileBuffers GetProcAddress LockFileEx LoadLibraryA GetVersionExA GetTempPathA GetSystemTime AreFileApisANSI DeleteFileA InterlockedIncrement InitializeCriticalSection InterlockedDecrement GetThreadLocale GetACP GetLocaleInfoA GetLocaleInfoW GetTimeZoneInformation MapViewOfFile CreateFileMappingW UnmapViewOfFile GetConsoleOutputCP WriteConsoleW WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetModuleHandleA GetLastError GetTempPathW CreateFileW ReadFile GetFileAttributesW WriteFile GetFullPathNameW CloseHandle IsDebuggerPresent InterlockedExchange InterlockedCompareExchange MultiByteToWideChar GetFileAttributesA CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetStdHandle GetConsoleMode GetConsoleCP TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree HeapAlloc GetCommandLineA HeapReAlloc RtlUnwind GetCPInfo LCMapStringA LCMapStringW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree VirtualAlloc ExitProcess HeapSize GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHFileOperationW

$COMMONFILES/Angels/WebSafe.dll.tmp

IMPHASH c1ff6eb1812d22911676818ed8cde4d6
SHA256 d2080eebe7cda869349c0ac21e8503b24993bf764accdca10fadf4b1251bf65a
MD5 7ed89085881366038fa967cab289337a
SHA1 a12864a8bf292f9a24b392c1612ab108104bcae3
SHA512 4440056d682ea2ce7d25bc1517a4e8f83381f7d6db5ec4da841b98eb45cb0eac21b0905db62215f80a75dd14b14b6dc46fd18f5c447c68f9166af4aa60e982fc
SSDEEP 3072:Go/IOSN2Qv32fQNA6rPEvDKke+Eq+g4+AwCWC:9/IOSNPfNjrPeb0pg4eC
TLSH
T1A5949335D505CA18CB062E79BC6AABB20637CF4A176C51DF8F5E3B236573BA21D6C009
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

fb:01:98:88:f2:d8:e2:be:78:00:3f:ad:f9:5b:f4:2a:30:fc:69:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

39107

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetWindowsDirectoryW LoadLibraryW FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleFileNameA GetCurrentThreadId DeleteFileA DeleteFileW WriteFile WriteFileEx CreateProcessW CreateProcessA WinExec VirtualProtect VirtualProtectEx OutputDebugStringW SetFilePointer SetLastError LoadLibraryA ExitThread GetVersion VirtualQuery TerminateProcess GetCurrentProcess DisableThreadLibraryCalls GetLastError ResumeThread GetThreadContext SetThreadContext InterlockedCompareExchange GetSystemWindowsDirectoryW VirtualAlloc SuspendThread GetModuleHandleW InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA HeapReAlloc GetModuleHandleA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW ExpandEnvironmentStringsW GetModuleFileNameW InterlockedDecrement Sleep GetCurrentThread LockResource LoadResource FindResourceW InterlockedIncrement WideCharToMultiByte lstrlenW FlushInstructionCache GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess HeapSize LCMapStringW MultiByteToWideChar LCMapStringA HeapAlloc TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo

user32

DrawTextW TrackMouseEvent SetWindowTextW GetDlgItem MoveWindow ClientToScreen GetWindowRect GetSysColor PostMessageW DialogBoxIndirectParamW EndDialog LoadBitmapW DefWindowProcW CallWindowProcW ShowWindow EndPaint GetSystemMetrics GetWindowTextW GetParent BeginPaint GetWindowLongW SetWindowLongW InvalidateRect SendMessageW GetClientRect IsWindowVisible IsWindow

gdi32

SelectObject GetStockObject DeleteDC StretchBlt CreateCompatibleDC DeleteObject SetTextColor SetBkMode GetTextMetricsW CreateFontIndirectW GetObjectW

shell32

ShellExecuteExW ShellExecuteA

ole32

CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocString

urlmon

CoGetClassObjectFromURL URLDownloadToFileW URLDownloadToFileA

shlwapi

PathFileExistsW PathIsURLW

$COMMONFILES/Angels/blockimg.xml.tmp

SHA256 b162f56577a34bd1ebb234828fcc74e2d5b65095c7997b790222d418b5202587
MD5 458c0781fef9f07c2b94e2d164fb4a76
SHA1 9e8e26cd4d03ccfc7abaa63d05dc8983bd2d0ab6
SHA512 463d117cf5cb42d225dba57262f9df8d34ca5d9c7397991a50d233b89a6e7ab480af44c5595bccb8b2f58c83e0a61641946b5d0f96c7a49ddd92e8e4f1a670c7
TLSH
T19BD02268ECC4CE2704F0AD221792405BDC08934703222488331D67931B71C8208D30A0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$COMMONFILES/Angels/go114fa.exe.tmp

SHA256 5b1a692e365eaa612e11e4f7161b2e2223b3f8171a18516368d646c16bd53e2c
MD5 be4cb0b0f6b6b2392e4df25ac7a1ab60
SHA1 445d5b3ad9d14231caa5db1b2d899f37430a63c1
SHA512 fce748853a7f2e524f60c03b6587349c09211648978a9470c9980976b8830d0689a2876f60a6358f5dd8c5d886325b75ace982679ecaf6f9863a96d5d1a00646
SSDEEP 768:JicxqkQ0OJQSf5Q4bDb87SSFAuJJ2m81LLEUbGNl:wcxqkQOYDb87ZFAuJJ2z4QGNl
TLSH
T192C27C83A7516872E444DE7C85AAD27DDB7BBB772D4800A187B8ACCD6C4A3613A1814F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

3f:95:ac:de:d2:86:8e:52:b9:95:f7:c2:55:3f:f4:b3:f6:4d:d0:17

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jul 13, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

4

Entry point

15628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

844B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$COMMONFILES/Angels/xFoCtrl.dll.tmp

IMPHASH 7de146e96b1265070990368b75f4ff4c
SHA256 31ab42cfb448c45b4cafc5c9dd783705ee1f057bdf9b0478ccc94f87fd644427
MD5 c1d9762180741f397b5d71147e4e4141
SHA1 503007d02c1e77697012f0046bd5164b488752d0
SHA512 cdd427390bea5e5e9cdc7febcb026477b2445db25e3c038e1a5c7f5f74338fdec62acc387382cd7582a4407d375f4029cc8b15930167313f45c1524f129fa5b4
SSDEEP 3072:h8nvO1B0Rn+rXBllu2jMLaj6ocVkTpS+lsOJx1N:Gnv9Rn+/faPbeIjsN
TLSH
T10DF34C01B7F2C073C1DA013D4915BBA9E3ABBEA98DE049431F743B6E7E34A44DA1991D
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

3d:26:66:af:70:25:18:11:9f:35:52:53:40:8e:a0:6b:05:f6:47:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 25, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

4

Entry point

63765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FlushFileBuffers GetStringTypeW GetStringTypeA SetStdHandle GetOEMCP GetACP LCMapStringW LCMapStringA GetCPInfo SetFilePointer IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate GetVersionExA GetEnvironmentVariableA TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue HeapSize TerminateProcess ExitProcess GetVersion GetCommandLineA HeapAlloc HeapReAlloc HeapFree CloseHandle LocalFree lstrcatA DeleteCriticalSection HeapDestroy InitializeCriticalSection IsDBCSLeadByte lstrcpynA lstrcmpiA LoadLibraryExA GetLastError FindResourceA LoadResource SizeofResource GetModuleFileNameA GetModuleHandleA GetShortPathNameA GetCurrentProcess FlushInstructionCache GetCurrentThreadId WideCharToMultiByte lstrlenA lstrcmpA lstrlenW InterlockedIncrement LoadLibraryA GetProcAddress FreeLibrary lstrcpyA InterlockedDecrement Sleep GlobalAlloc GlobalLock GlobalUnlock MultiByteToWideChar EnterCriticalSection LeaveCriticalSection GetStartupInfoA RtlUnwind RaiseException

user32

GetWindowTextLengthA SendMessageA GetClientRect SetWindowPos GetWindowTextA SetWindowTextA SetWindowLongA GetWindow DefWindowProcA RegisterWindowMessageA GetClassInfoExA RegisterClassExA GetDC ReleaseDC FillRect DestroyCursor LoadCursorA LoadImageA GetWindowLongA SetCursor PtInRect ClientToScreen GetCursorPos TrackMouseEvent CharNextA CreateWindowExA IntersectRect EqualRect OffsetRect SetWindowRgn UnionRect GetKeyState ShowWindow wsprintfA GetClassNameA GetDlgItem InvalidateRgn SetCapture ReleaseCapture CreateAcceleratorTableA GetParent GetDesktopWindow RedrawWindow IsWindow BeginPaint EndPaint CallWindowProcA GetFocus IsChild SetFocus GetSysColor InvalidateRect DestroyWindow LoadStringA

gdi32

CreateMetaFileA SetWindowExtEx CloseMetaFile DeleteMetaFile CreateRectRgnIndirect LPtoDP SaveDC SetMapMode SetWindowOrgEx SetViewportOrgEx RestoreDC GetObjectA GetDeviceCaps CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectA SetBkMode SetTextAlign SetTextColor TextOutA BitBlt DeleteDC GetStockObject CreateSolidBrush SelectObject PatBlt DeleteObject CreateDCA

advapi32

RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegDeleteValueA RegCreateKeyExA RegDeleteKeyA

ole32

OleInitialize CreateStreamOnHGlobal CoInitialize StringFromIID CoGetMalloc CoTaskMemRealloc CreateDataAdviseHolder OleRegGetMiscStatus CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs OleLockRunning CoTaskMemAlloc StringFromCLSID CLSIDFromString ProgIDFromCLSID CoTaskMemFree CLSIDFromProgID CoCreateInstance OleUninitialize CoUninitialize

oleaut32

GetErrorInfo LoadTypeLi RegisterTypeLi VarUI4FromStr OleCreatePropertyFrame LoadRegTypeLi OleCreateFontIndirect CreateErrorInfo SetErrorInfo VariantInit VariantClear SysStringLen SysAllocStringLen SysAllocString SysFreeString

wininet

InternetCombineUrlA

urlmon

CoInternetParseUrl

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
TLSH
T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
TLSH
T126E26B21789406F3E69D553275D56F27562F6A5116F18883CF3399EA2C322F8B83B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/OnTop.dll

IMPHASH 5868b2e27b7dc96acf77699398b4c95b
SHA256 28cf47c05c86b2264ea1da120d3644cb46c86d6f27072a9a853e63e05ec97a25
MD5 7c0c240e911a521e8e554a10d04e558f
SHA1 d12ca9c464f2764e211039c09e56cb347626f7c7
SHA512 579b6787061efdc7f618f3c5a513cb539ccbe12ca41ba5e9ba8f00d03600edcdd82262b0fbfd58b96231c461f18b1233d657cbd0d1b827ea9df5374508578707
TLSH
T1F4511427EB7126F2D025877309D72092B46B565067B6801AC9924708251F31BED75E13
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 d115bc071d921b8b2cf623b93b4b83fb2d47d77b34c255815b4a1c15e7a3fc10
MD5 1ef97f6f6e22fdc14c8683677e47fbbc
SHA1 1979d6f5f141ca432ccb38f7057a3aadb9f9907e
SHA512 488a9080ec173fc4d4cc7477113a15361f93d41e9d37995a6e024d4a40af8d91ec7988a7a13d06cc669b4c6df250ed96967a03964e5bbb51db5a25bd6599f4f3
SSDEEP 768:qT6TSc9z8Vla6T9Tu8hYQ9vwZbv4IIPURp47MwIO9rd9r064I4lUE1S4nkM9x39y:q2r9z8u6T9y8hYQ9vQ0IYURp47BIO9rL
TLSH
T189C2E7A4A2859D424A986A2510FA39B481DCBF6E7C70F45FBD397D0AF3F9191304BB0D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 528a462011f94b836966243ccf2947a5dbecbcde3cfc412831087aa7fe850851
MD5 bb7b00ab02c91a068afe2d0c490a6651
SHA1 c530ff2abce144b8900ca1365a0c3f4c95c16814
SHA512 afbd2fa35d290241b691ec1ea2783f2fc6a4988986cf0742c7e3d08bb51a1ba9dea1240f0bbe7862d159bb81895ccd58f54c266b5bef4bc9cc305702789c7490
SSDEEP 3072:2Ze1Wk6suMp2yaHu0fSuwdUoo3YgfcEQi7G:2Ze1Wk6suM4ykugjQd
TLSH
T110D330A94649F7864C14392D1C38EBA964D57F982C68F37DCD13383BBBF27B9A015205
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
TLSH
T19012F9675A4041B3E9A3223D306A2E3F877C9325D0927C03C677AE562BF031A7D3A394
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWebEx.dll

IMPHASH ae32207b6031c02aed9dfbea809c29f1
SHA256 0974e41b380a2e6fa080b04b7558d12e92d5d0885edf6025b7d0000201de59da
MD5 cc329d5153c6b5949ee9dcedb12926ab
SHA1 75744729739a8db546c08102dde407574d592a3b
SHA512 42b511bcbc639b6d6b3f657830a56c287d30a9ea0fbb5e63ec1db21bfcbd403a3fb3400f59ed94970fc4a71ca0830749a3f2a3190399c6e596413bba876a0b2e
SSDEEP 3072:pdVMcUtREsBESl+4+dTqQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5dnD:xMcUjpBrAnTqdKcS0Hwjl2JwbD
TLSH
T173546CAAA62D8D70DD872D78316C63734AFA2F701F59D48EBA05B2631A303F254175CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

f4:28:41:bc:3e:9c:9f:f0:e4:6e:6f:48:8e:a3:ea:59:b8:a9:ea:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 16, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

19382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError CreateFileA GetCurrentProcessId GetTickCount GetPrivateProfileStringA GetPrivateProfileIntA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount HeapSize GetConsoleMode GetConsoleCP WriteFile SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW CloseHandle GetProcessHeap HeapAlloc ExpandEnvironmentStringsA WritePrivateProfileStringA HeapFree GetPrivateProfileSectionA lstrcpyA LoadLibraryA GlobalFree MultiByteToWideChar LCMapStringA HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter VirtualFree GetSystemTimeAsFileTime RtlUnwind GetCurrentThreadId GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA RaiseException Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy

user32

ReleaseDC ShowWindow GetWindowTextA MoveWindow GetDlgItem GetClientRect GetDC PostMessageA LoadCursorA SetCursor SetDlgItemTextA InvalidateRect CreateDialogParamA SetWindowLongA SendMessageA GetWindowRect MapWindowPoints UpdateWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA IsDlgButtonChecked DestroyWindow CheckDlgButton LoadBitmapA CallWindowProcA

gdi32

CreateCompatibleDC SelectObject BitBlt DeleteObject DeleteDC GetObjectA GetTextExtentPointA GetTextExtentPoint32A

advapi32

CryptReleaseContext CryptGenRandom CryptAcquireContextW

ole32

OleUninitialize OleInitialize

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry InternetAttemptConnect GetUrlCacheEntryInfoA

$TEMP/updatesafe.exe

IMPHASH 3f4b03009aac87f62edb9c2603c1f3bf
SHA256 57daec3419ce1e392341d343004a31f5fe474e728126ae78b0281098d523199b
MD5 a53ceb8b5a3d9ee90de6370432327d83
SHA1 a50dbc458d2f29c6b83ea927211c49b87bb66358
SHA512 c7eda4f87c6d1f91e27e7a38390972d056a2253c40439d65a39a8c995d2b8a56dc95c75a18825626d29fc65bebcc85e07bf2a0b2b191b259647b4865d015a8e4
SSDEEP 1536:NgeIePh5nmOJ9R46UUhL8tc9/28hkl4O6VI/sQkMm+V4gg4QGa:NiQbvcqhL8i8sQkMm+V4gQ
TLSH
T136837D227980D072C89615304959C6A25F7FBD311BB5C5C7B7A817BA4FA03E0EB3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c0:04:e1:72:c3:59:d1:5d:75:bb:1b:74:5e:10:12:b5:13:52:b9:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 20, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

10928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenFileMappingW CloseHandle DeleteFileW SetFilePointer lstrlenA CreateProcessW WaitForSingleObject CreateFileMappingW CreateFileW MultiByteToWideChar GetLastError MoveFileW InterlockedIncrement InterlockedDecrement GetModuleFileNameW ReadFile MoveFileExW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleHandleW Sleep GetProcAddress ExitProcess HeapFree GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate VirtualFree HeapAlloc VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetLocaleInfoA WideCharToMultiByte RaiseException GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

ord165 SHGetSpecialFolderPathW

urlmon

URLDownloadToFileW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

SoftAngel/SoftAngel.exe.tmp

SHA256 d4efda963df54459042c172cbe3005cd9aeb8d39777f796a9477957b3beab9d4
MD5 0ea2f1628503ece5d1df3a8b51376303
SHA1 30e217228a1b518dd591828a66bc05980fdafc99
SHA512 11b6b203316f4b55c58ac12d51f8d98ea794f082b8d11138a48b2543cadd71db0cbc36a6a7d356f11295691ee8f38c674793e6c3039571b434312a670cd86463
SSDEEP 49152:v/VMthbVvWVzL7eEkKvAVl1vVYZ3bzVPD1cW++++uBE7KcvY:X8bVvHEkKsLvVi3bzVL1Fh+ZBMY
TLSH
T147C5331563DC04ECE04137F10A667B50726BF69D28531E2AA455AB8E4FF10A27E83FE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

40:1b:ab:b0:94:78:bb:8d:5a:c9:40:0b:43:ed:bb:3e:78:c8:13:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Aug 24, 2010

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 24, 2008 - Dec 24, 2011

Minor OS version

0

Major OS version

5

Entry point

10508336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 ae611403789583ef42934b13d44b289138295a4f6edd6dc6473ee7a62012b380
MD5 16f553067912d2e7b23c96d0472417f7
SHA1 28b96b9a55c2fb70b7368ce4de63544e57f2b0de
SHA512 749dabbfacab11b206e0434a9b781b8b226a9f113215acb0de47294bc3ec1758918cd9b318c1b40cf4334d8d6f7b32b875703a46889d4e94b62a4de3a2c6a0fb
SSDEEP 98304:/ALwJOQ5sqWDlbwcaR6y1jPcA/QF26tCC00Rab:/ALww1kcaR6sPcoQdn0rb
TLSH
T102B68F87A755413EDCED5A719C2F918D943E2F916AEA26D236F03A2E8F324106C3DF44
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

3706372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

934B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

64B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

SoftAngel/uninst.exe

SHA256 b8fad9bd1ef0a4b2f46cc4a5ffb35f2d8debdcb7df70629240248097825120fb
MD5 e1089242adf3e9f3cc96e728dc8a13f5
SHA1 ceeef658affa468067be6c67980b441b3077ac30
SHA512 99ae5cf8552afc31dbf399733a5701a3d5b4788369c7b3584a58eae65d455b63c039490ef5680232600e32a5cdb28928f4280ae1a24e1d9791449a7c933a08d3
SSDEEP 3072:+3c1fJ4DKx/1mTABcfmYLWYFKrYK/y1BwK9KahXtc:MOJgGmA2fmYX+c9Kahdc
TLSH
T127E3CF1533E5CDE2C4020E77C86B9BF6D27BBE11DA12225F2B543E79383D5A68509783
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
TLSH
T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
TLSH
T126E26B21789406F3E69D553275D56F27562F6A5116F18883CF3399EA2C322F8B83B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 d115bc071d921b8b2cf623b93b4b83fb2d47d77b34c255815b4a1c15e7a3fc10
MD5 1ef97f6f6e22fdc14c8683677e47fbbc
SHA1 1979d6f5f141ca432ccb38f7057a3aadb9f9907e
SHA512 488a9080ec173fc4d4cc7477113a15361f93d41e9d37995a6e024d4a40af8d91ec7988a7a13d06cc669b4c6df250ed96967a03964e5bbb51db5a25bd6599f4f3
SSDEEP 768:qT6TSc9z8Vla6T9Tu8hYQ9vwZbv4IIPURp47MwIO9rd9r064I4lUE1S4nkM9x39y:q2r9z8u6T9y8hYQ9vQ0IYURp47BIO9rL
TLSH
T189C2E7A4A2859D424A986A2510FA39B481DCBF6E7C70F45FBD397D0AF3F9191304BB0D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_9612c4eca666a273d63ad7504a2547b6211835c70d979a1753a171f32c9427f6.bin

generic

$COMMONFILES/Angels/$0

$COMMONFILES/Angels/AgLog.dll.tmp

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

ws2_32

iphlpapi

version

wininet

generic

$COMMONFILES/Angels/Agwin7.dll.tmp

PE Signature issue

kernel32

ole32

generic

$COMMONFILES/Angels/AngelAsst.exe.tmp

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

generic

$COMMONFILES/Angels/IEHelp.htm.tmp

$COMMONFILES/Angels/IEMenuExt.dll.tmp

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

generic

$COMMONFILES/Angels/IEScan.dll.tmp

PE Signature issue

kernel32

user32

advapi32

generic

$COMMONFILES/Angels/IEsafe.dll.tmp

PE Signature issue

wininet

winmm

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

oleacc

generic

$COMMONFILES/Angels/Scan.dll.tmp

PE Signature issue

winmm

kernel32

advapi32

shell32

generic

$COMMONFILES/Angels/WebSafe.dll.tmp

PE Signature issue

kernel32