General

Malware Config

Signatures

Files

• 4x(24-06-27).rar

  .rar
• 2024po.exe.vir

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\GoldMiner-C--main\obj\Release\GoldMiner.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 24.8MB - Virtual size: 24.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 127KB - Virtual size: 126KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Timo.exe.vir

  .exe windows:6 windows x64 arch:x64

  cbd03d548e96d66a238682ac4c7fe152

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetModuleFileNameA

  VirtualProtect

  VirtualFree

  VirtualAlloc

  CreateFileW

  GetModuleHandleA

  OpenProcess

  Sleep

  GetCurrentThread

  GetSystemInfo

  GetProcAddress

  GetCurrentProcessId

  GlobalMemoryStatusEx

  GetTickCount

  VirtualQueryEx

  WriteConsoleW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  GetLastError

  SuspendThread

  ResumeThread

  GetThreadContext

  SetThreadContext

  FlushInstructionCache

  VirtualQuery

  VirtualProtectEx

  SetLastError

  FreeLibrary

  LoadLibraryExW

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  ExitProcess

  GetModuleHandleExW

  GetCommandLineA

  GetCommandLineW

  HeapAlloc

  HeapFree

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  CompareStringW

  LCMapStringW

  GetFileType

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  GetStringTypeW

  GetProcessHeap

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  GetFileSizeEx

  SetFilePointerEx

  HeapSize

  HeapReAlloc

  CloseHandle

  Sections

  .text

  Size: 121KB - Virtual size: 120KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .detourc

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .detourd

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 500B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• [D]2024年移动合作方人员出入管理门禁安装程序.exe.vir

  .exe windows:6 windows x64 arch:x64

  c110cb8d12060febe265ec48153846e2

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  E:\miansha\diaoyu\x64\Debug\diaoyu.pdb

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  LoadLibraryA

  CreateFileW

  GetCurrentThreadId

  IsDebuggerPresent

  RaiseException

  MultiByteToWideChar

  WideCharToMultiByte

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  InitializeSListHead

  GetStartupInfoW

  GetModuleHandleW

  GetLastError

  HeapAlloc

  HeapFree

  GetProcessHeap

  VirtualQuery

  FreeLibrary

  RtlUnwindEx

  InterlockedPushEntrySList

  InterlockedFlushSList

  GetModuleFileNameW

  LoadLibraryExW

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RtlPcToFileHeader

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  ExitProcess

  GetCommandLineA

  GetCommandLineW

  HeapSize

  HeapValidate

  GetSystemInfo

  GetFileType

  OutputDebugStringW

  WriteConsoleW

  SetConsoleCtrlHandler

  GetCurrentThread

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  GetStringTypeW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  HeapReAlloc

  HeapQueryInformation

  GetFileSizeEx

  SetFilePointerEx

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  ReadFile

  ReadConsoleW

  CloseHandle

  RtlUnwind

  Sections

  .textbss

  Size: - Virtual size: 380KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .text

  Size: 811KB - Virtual size: 811KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 188KB - Virtual size: 187KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .msvcjmc

  Size: 512B - Virtual size: 278B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .00cfg

  Size: 512B - Virtual size: 283B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 147KB - Virtual size: 147KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 点击此处安装语言包.exe.vir

  .exe windows:6 windows x86 arch:x86

  7ecca5b83f5c154d3e2fae824099d2c4

  
  

  Code Sign

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-07-2021 00:00

  Not After

  11-07-2022 23:59

  Subject

  SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-07-2021 00:00

  Not After

  11-07-2022 23:59

  Subject

  SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-01-2021 00:00

  Not After

  06-01-2031 00:00

  Subject

  CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  07-01-2016 12:00

  Not After

  07-01-2031 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3f:e5:8c:20:42:04:71:e0:de:ce:b2:df:ad:9d:e8:83:6b:32:cb:bb:6a:6f:e2:85:8e:a9:31:c8:49:cd:ee:d8

  Signer

  Actual PE Digest

  3f:e5:8c:20:42:04:71:e0:de:ce:b2:df:ad:9d:e8:83:6b:32:cb:bb:6a:6f:e2:85:8e:a9:31:c8:49:cd:ee:d8

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  69:8d:27:74:10:60:58:3a:0c:c2:65:23:3e:6e:70:90:9f:f8:0f:b9

  Signer

  Actual PE Digest

  69:8d:27:74:10:60:58:3a:0c:c2:65:23:3e:6e:70:90:9f:f8:0f:b9

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FindResourceW

  GetTickCount

  LoadLibraryW

  GetProcAddress

  FreeLibrary

  CreateDirectoryW

  SetLastError

  GetCommandLineW

  FindNextFileW

  GetCurrentProcess

  FindClose

  MultiByteToWideChar

  GlobalFlags

  GetSystemInfo

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  CreateProcessW

  WideCharToMultiByte

  VirtualQuery

  SetEvent

  CreateThread

  ResetEvent

  GetSystemTimeAsFileTime

  lstrcmpiW

  LockResource

  WriteConsoleW

  FlushFileBuffers

  GetStringTypeW

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  LCMapStringW

  CompareStringW

  GetConsoleMode

  GetConsoleOutputCP

  GetFileType

  SetFilePointerEx

  GetStdHandle

  GetCommandLineA

  GetModuleHandleExW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  EncodePointer

  RtlUnwind

  InitializeSListHead

  QueryPerformanceCounter

  GetStartupInfoW

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  OutputDebugStringW

  FreeResource

  InitializeCriticalSection

  SizeofResource

  MulDiv

  GlobalUnlock

  GlobalLock

  GlobalFree

  GlobalAlloc

  TryEnterCriticalSection

  GetProcessHandleCount

  HeapFree

  TerminateProcess

  OpenProcess

  GetCurrentProcessId

  GetLocalTime

  WriteFile

  ExitProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetCurrentThreadId

  GetModuleHandleW

  IsDebuggerPresent

  CreateEventW

  GetModuleFileNameW

  CloseHandle

  LoadResource

  CreateFileW

  Sleep

  GetProcessHeap

  DeleteCriticalSection

  DecodePointer

  HeapAlloc

  RaiseException

  HeapReAlloc

  GetLastError

  HeapSize

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExW

  user32

  PeekMessageW

  GetMessageW

  TranslateMessage

  DefWindowProcW

  DestroyWindow

  MessageBoxW

  ReleaseDC

  DispatchMessageW

  CharNextW

  MonitorFromWindow

  GetDC

  LoadImageW

  GetParent

  GetDesktopWindow

  LoadCursorW

  LoadIconW

  LoadStringW

  SendMessageW

  GetWindowLongW

  WaitForInputIdle

  gdi32

  CreateDIBSection

  CreateCompatibleDC

  GetDeviceCaps

  DeleteDC

  GetObjectW

  DeleteObject

  SelectObject

  SetDIBColorTable

  advapi32

  RegQueryInfoKeyW

  RegDeleteKeyW

  RegEnumKeyExW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  RegOpenKeyExW

  shell32

  ShellExecuteW

  ole32

  CoTaskMemRealloc

  CoTaskMemFree

  CoTaskMemAlloc

  CoCreateInstance

  CoInitializeEx

  CoUninitialize

  CreateStreamOnHGlobal

  oleaut32

  SystemTimeToVariantTime

  VarUI4FromStr

  comctl32

  ImageList_AddMasked

  InitCommonControlsEx

  ImageList_Create

  ImageList_Destroy

  ws2_32

  WSACleanup

  gdiplus

  GdipGetImageHeight

  GdipGetImagePaletteSize

  GdipCloneImage

  GdipBitmapUnlockBits

  GdipCreateBitmapFromStream

  GdipAlloc

  GdipDrawImageRectI

  GdipDisposeImage

  GdiplusStartup

  GdipBitmapLockBits

  GdipGetImageGraphicsContext

  GdipDeleteGraphics

  GdipGetImagePalette

  GdipSetCompositingMode

  GdipGetImagePixelFormat

  GdipCreateBitmapFromFile

  GdipCreateBitmapFromScan0

  GdiplusShutdown

  GdipFree

  GdipGetImageWidth

  Exports

  Exports

  ?get_active_implementation@simdutf@@YAAAV?$atomic_ptr@$$CBVimplementation@simdutf@@@internal@1@XZ

  ?get_available_implementations@simdutf@@YAABVavailable_implementation_list@internal@1@XZ

  Sections

  .text

  Size: 213KB - Virtual size: 212KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 58KB - Virtual size: 57KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 10.5MB - Virtual size: 10.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 票925452362131助手.exe.vir

  .exe windows:6 windows x64 arch:x64

  e0f22ad3c983aa9c9ce4afda13b27307

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  19:9d:f8:9e

  Certificate

  Issuer

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Not Before

  08-08-2009 01:00

  Not After

  08-08-2024 01:00

  Subject

  CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  09:69:0a:76:fb:97:7e

  Certificate

  Issuer

  CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

  Not Before

  28-06-2013 06:37

  Not After

  29-06-2014 18:56

  Subject

  CN=沈阳芝麻开门科技有限公司,O=沈阳芝麻开门科技有限公司,L=沈阳市,ST=辽宁省,C=CN,1.2.840.113549.1.9.1=#0c12627573696e65737340356b626f782e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d

  Certificate

  Issuer

  CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

  Not Before

  01-03-2011 01:00

  Not After

  01-03-2016 01:00

  Subject

  CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  03:42:61:f3:3a:45:2a:0d:36:5d:6e:ad:fa:c8:b1:d2:f9:ac:1f:6a

  Signer

  Actual PE Digest

  03:42:61:f3:3a:45:2a:0d:36:5d:6e:ad:fa:c8:b1:d2:f9:ac:1f:6a

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  LocalAlloc

  HeapAlloc

  GetProcessHeap

  LocalReAlloc

  GetModuleFileNameA

  GetCurrentProcess

  WriteFile

  VirtualAlloc

  CreateMutexW

  GetCurrentThreadId

  EnumSystemLocalesA

  GetTempPathA

  HeapFree

  DeleteFileA

  ExitProcess

  WinExec

  Sleep

  LoadLibraryW

  GetProcAddress

  SetEndOfFile

  WriteConsoleW

  CreateFileW

  SetStdHandle

  SetEnvironmentVariableW

  DeleteCriticalSection

  DecodePointer

  RaiseException

  CloseHandle

  GetLastError

  FindClose

  GetEnvironmentVariableA

  InitializeCriticalSectionEx

  FindNextFileA

  CreateFileA

  FindFirstFileA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  HeapSize

  HeapReAlloc

  ReadConsoleW

  ReadFile

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  EnumSystemLocalesW

  GetUserDefaultLCID

  RtlUnwind

  IsValidLocale

  GetFileType

  SetFilePointerEx

  GetFileSizeEx

  GetCommandLineW

  GetCommandLineA

  GetStdHandle

  GetModuleFileNameW

  GetModuleHandleExW

  WideCharToMultiByte

  EnterCriticalSection

  LeaveCriticalSection

  SetLastError

  InitializeCriticalSectionAndSpinCount

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetModuleHandleW

  EncodePointer

  MultiByteToWideChar

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  LocalFree

  IsDebuggerPresent

  OutputDebugStringW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  TerminateProcess

  RtlUnwindEx

  RtlPcToFileHeader

  FreeLibrary

  LoadLibraryExW

  user32

  MessageBoxA

  advapi32

  RegSetValueExA

  RegDeleteValueA

  RegCloseKey

  RegOpenKeyExW

  shell32

  FindExecutableA

  ord680

  oleaut32

  VariantClear

  ntdll

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  Sections

  .text

  Size: 149KB - Virtual size: 148KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 86KB - Virtual size: 86KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 545KB - Virtual size: 550KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 考勤异常信息统计结果查询工具.exe.vir

  .exe windows:6 windows x64 arch:x64

  f0ea7b7844bbc5bfa9bb32efdcea957c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  PostQueuedCompletionStatus

  LoadLibraryA

  LoadLibraryW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetEnvironmentStringsW

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 236KB - Virtual size: 607KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  /4

  Size: 512B - Virtual size: 295B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 376KB - Virtual size: 375KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /32

  Size: 75KB - Virtual size: 74KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /46

  Size: 512B - Virtual size: 34B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /65

  Size: 647KB - Virtual size: 647KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /78

  Size: 497KB - Virtual size: 497KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /90

  Size: 126KB - Virtual size: 126KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 307KB - Virtual size: 306KB

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ