General

Malware Config

Signatures

Files

• 61b587387d7eb0bcd6096ba237b11a1c6932a11aa440123422fe9ea49773c8ac.exe

  .exe windows:4 windows x86 arch:x86

  82311fb65a817f05a97e6968677b9221

  
  

  Code Sign

  04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  22-10-2013 12:00

  Not After

  22-10-2028 12:00

  Subject

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:7b:8b:d9:11:0d:00:8c:d6:ed:14:5c:2b:d1:df:da

  Certificate

  Issuer

  CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  26-05-2021 00:00

  Not After

  30-05-2024 23:59

  Subject

  CN=Beijing Kingsoft Security software Co.\,Ltd,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8d:b8:b2:82:e7:c5:ff:f3:55:8c:a4:79:ae:fa:29:5a:1f:76:9a:ba:f8:93:9c:07:12:a7:fa:fd:e1:38:8e:ca

  Signer

  Actual PE Digest

  8d:b8:b2:82:e7:c5:ff:f3:55:8c:a4:79:ae:fa:29:5a:1f:76:9a:ba:f8:93:9c:07:12:a7:fa:fd:e1:38:8e:ca

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  e:\KINGSOFT_DUBA\Build\Build_Src\kisengine_git\kisengine_git\product\win32\dbginfo\kinstuiofficial.pdb

  Imports

  kernel32

  CopyFileW

  GetFileAttributesW

  GetTempPathW

  GetCurrentDirectoryW

  MoveFileW

  SetCurrentDirectoryW

  RemoveDirectoryW

  QueryDosDeviceW

  SetEndOfFile

  FlushFileBuffers

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  InitializeCriticalSectionAndSpinCount

  SetFilePointer

  FileTimeToLocalFileTime

  GetUserDefaultLangID

  GetComputerNameA

  GetSystemDirectoryW

  GetStdHandle

  WaitForMultipleObjects

  VirtualFree

  VirtualAlloc

  ReleaseSemaphore

  ResetEvent

  CreateSemaphoreW

  lstrcpyW

  lstrcatW

  SetFileAttributesW

  DeviceIoControl

  CreateFileA

  LoadLibraryA

  OpenMutexW

  OpenEventW

  OpenSemaphoreW

  GetCurrentProcessId

  ExpandEnvironmentStringsW

  CreateProcessW

  SetUnhandledExceptionFilter

  GlobalSize

  SetEnvironmentVariableA

  CompareStringW

  CompareStringA

  WriteConsoleW

  CreateDirectoryW

  WriteConsoleA

  GetLocaleInfoW

  GetCurrentDirectoryA

  GetFullPathNameA

  GetStringTypeW

  GetStringTypeA

  IsValidLocale

  EnumSystemLocalesA

  GetUserDefaultLCID

  QueryPerformanceCounter

  GetCommandLineW

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetConsoleMode

  GetConsoleCP

  GetStartupInfoA

  SetHandleCount

  GetTimeZoneInformation

  GetModuleFileNameA

  HeapCreate

  IsValidCodePage

  GetOEMCP

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  FindFirstFileA

  GetDriveTypeA

  GetCPInfo

  LCMapStringW

  LCMapStringA

  ExitProcess

  RtlUnwind

  GetStartupInfoW

  VirtualQuery

  GetModuleHandleA

  VirtualProtect

  GetFileType

  SetStdHandle

  ExitThread

  IsDebuggerPresent

  UnhandledExceptionFilter

  TerminateProcess

  FormatMessageA

  ExpandEnvironmentStringsA

  SleepEx

  IsProcessorFeaturePresent

  GetThreadLocale

  GetLocaleInfoA

  GetACP

  GetProcessHeap

  HeapSize

  HeapReAlloc

  HeapFree

  HeapAlloc

  HeapDestroy

  GetVersionExA

  GetLogicalDriveStringsW

  GetTempFileNameW

  FindClose

  GetSystemInfo

  InterlockedCompareExchange

  ProcessIdToSessionId

  LocalFree

  LocalAlloc

  OpenProcess

  WriteFile

  GetTickCount

  GetCurrentThread

  SetThreadPriority

  LoadLibraryExW

  lstrcmpiW

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  GlobalFree

  GetPrivateProfileStringW

  DeleteCriticalSection

  QueryPerformanceFrequency

  CreateEventW

  GetPrivateProfileIntW

  MapViewOfFileEx

  MapViewOfFile

  CreateFileMappingW

  CreateThread

  UnmapViewOfFile

  MoveFileExW

  Sleep

  GetDiskFreeSpaceExW

  GetDriveTypeW

  TerminateThread

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  DeleteFileW

  RaiseException

  SetLastError

  FlushInstructionCache

  InterlockedIncrement

  InterlockedDecrement

  GetWindowsDirectoryW

  FreeResource

  ReadFile

  GetCurrentThreadId

  GetFileSize

  CreateFileW

  InitializeCriticalSection

  GetFullPathNameW

  GetExitCodeThread

  GetVersionExW

  OutputDebugStringW

  GetLocalTime

  GetSystemTime

  SetEvent

  LeaveCriticalSection

  EnterCriticalSection

  GetModuleFileNameW

  InterlockedExchange

  WaitForSingleObject

  CloseHandle

  GetCurrentProcess

  GetModuleHandleW

  GetLastError

  WideCharToMultiByte

  lstrlenW

  FreeLibrary

  GetProcAddress

  LoadLibraryW

  FindResourceExW

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  lstrlenA

  MultiByteToWideChar

  GetConsoleOutputCP

  user32

  LoadBitmapW

  CharNextW

  UpdateWindow

  BringWindowToTop

  DefWindowProcW

  CharUpperW

  CharLowerW

  CreateWindowExW

  LoadCursorW

  SetCursor

  PtInRect

  RegisterWindowMessageW

  UnregisterClassA

  OpenClipboard

  GetClipboardData

  FindWindowExW

  CloseClipboard

  UpdateLayeredWindow

  ShowWindow

  ReleaseDC

  SendMessageW

  SetRectEmpty

  DrawIconEx

  GetWindowTextW

  DestroyIcon

  DrawFrameControl

  KillTimer

  IntersectRect

  IsRectEmpty

  InflateRect

  UnionRect

  SetRect

  SetWindowLongW

  DrawTextW

  SetWindowTextW

  IsWindow

  IsWindowVisible

  SetForegroundWindow

  LoadIconW

  DestroyWindow

  CallWindowProcW

  GetClassInfoExW

  PostThreadMessageW

  PeekMessageW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetDlgCtrlID

  GetActiveWindow

  GetDesktopWindow

  IsWindowEnabled

  EnableWindow

  GetWindowThreadProcessId

  GetForegroundWindow

  SystemParametersInfoW

  SetWindowPos

  AttachThreadInput

  SetActiveWindow

  GetFocus

  IsChild

  GetParent

  IsDialogMessageW

  ClientToScreen

  OffsetRect

  CopyRect

  RegisterClassExW

  GetWindow

  GetWindowRect

  GetWindowLongW

  GetClientRect

  MapWindowPoints

  GetDlgItem

  BeginPaint

  EndPaint

  MonitorFromWindow

  GetMonitorInfoW

  SetCapture

  ReleaseCapture

  GetCursorPos

  SetFocus

  GetNextDlgTabItem

  ScreenToClient

  MoveWindow

  GetKeyState

  WindowFromPoint

  GetScrollPos

  GetDC

  InvalidateRect

  EqualRect

  PostMessageW

  SetTimer

  GetSystemMetrics

  GetWindowTextLengthW

  SetWindowRgn

  LoadImageW

  gdi32

  CreatePen

  MoveToEx

  LineTo

  GetCurrentObject

  TextOutW

  GetTextColor

  GetDIBits

  CreateDCW

  GetTextExtentPoint32W

  DeleteDC

  GetWindowOrgEx

  SelectClipRgn

  SetBkMode

  RoundRect

  GetClipRgn

  RestoreDC

  OffsetRgn

  ExtSelectClipRgn

  CombineRgn

  CreateRectRgn

  GetViewportOrgEx

  SaveDC

  RectInRegion

  CreateCompatibleDC

  SelectObject

  SetViewportOrgEx

  SetWindowOrgEx

  DeleteObject

  GetRgnBox

  SetTextColor

  StretchBlt

  CreateBitmap

  CreateCompatibleBitmap

  BitBlt

  SetBkColor

  ExtTextOutW

  CreateRoundRectRgn

  GetStockObject

  CreateFontIndirectW

  SetGraphicsMode

  CreateDIBSection

  Rectangle

  SetWorldTransform

  GetWorldTransform

  SetStretchBltMode

  GetTextMetricsW

  CreateFontW

  GetObjectW

  CreateRectRgnIndirect

  advapi32

  RegDeleteKeyW

  RegSetValueExW

  RegCreateKeyExW

  RegOpenKeyW

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyExW

  RegEnumKeyExW

  RegDeleteValueW

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  CreateProcessAsUserW

  SetTokenInformation

  DuplicateTokenEx

  FreeSid

  EqualSid

  AllocateAndInitializeSid

  GetTokenInformation

  OpenProcessToken

  RegQueryInfoKeyW

  shell32

  SHGetFolderPathW

  Shell_NotifyIconW

  SHGetSpecialFolderPathW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetSpecialFolderLocation

  SHFileOperationW

  ShellExecuteW

  ole32

  CoUninitialize

  CoSetProxyBlanket

  CoCreateGuid

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoTaskMemFree

  CoCreateInstance

  CreateStreamOnHGlobal

  CoInitializeEx

  oleaut32

  VarUI4FromStr

  SysFreeString

  SysAllocStringLen

  SysStringLen

  VariantInit

  VariantCopy

  VariantClear

  SysAllocString

  shlwapi

  PathRemoveFileSpecW

  PathIsDirectoryW

  PathFindFileNameW

  PathAddBackslashW

  PathFileExistsW

  StrToIntA

  PathAppendW

  StrToIntW

  PathFindExtensionW

  comctl32

  InitCommonControlsEx

  _TrackMouseEvent

  msimg32

  AlphaBlend

  gdiplus

  GdipCreateHBITMAPFromBitmap

  GdipCreateBitmapFromStream

  GdipGetImagePixelFormat

  GdipCreateBitmapFromHBITMAP

  GdipLoadImageFromStream

  GdipCloneBitmapArea

  GdipImageRotateFlip

  GdipDrawImagePointsRectI

  GdipDeletePrivateFontCollection

  GdipPrivateAddFontFile

  GdipGetFontCollectionFamilyCount

  GdipAlloc

  GdipFree

  GdipDeleteFontFamily

  GdipNewPrivateFontCollection

  GdipGetFontCollectionFamilyList

  GdipCloneFontFamily

  GdipCreateFromHDC

  GdipDeleteGraphics

  GdipCreateSolidFill

  GdipFillRectangleI

  GdipCreatePen1

  GdipDrawLinesI

  GdiplusShutdown

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateLineBrushI

  GdiplusStartup

  GdipCreateLineBrushFromRectWithAngleI

  GdipDrawString

  GdipDeleteStringFormat

  GdipSetStringFormatAlign

  GdipMeasureString

  GdipFillRectangle

  GdipDeleteFont

  GdipCreateFont

  GdipCreateFontFromLogfontW

  GdipSetStringFormatLineAlign

  GdipSetStringFormatFlags

  GdipSetStringFormatTrimming

  GdipSetTextRenderingHint

  GdipCloneImage

  GdipLoadImageFromFile

  GdipDisposeImage

  GdipGetImageHeight

  GdipGetImageWidth

  GdipSetInterpolationMode

  GdipDrawImageRectI

  GdipSetCompositingQuality

  GdipGetImageGraphicsContext

  GdipSetPixelOffsetMode

  GdipGetFamily

  GdipAddPathStringI

  GdipGetFontSize

  GdipFillPath

  GdipGraphicsClear

  GdipDrawImageI

  GdipAddPathRectangleI

  GdipBitmapUnlockBits

  GdipBitmapLockBits

  GdipCreateBitmapFromScan0

  GdipDrawImageRectRect

  GdipSetImageAttributesColorMatrix

  GdipDisposeImageAttributes

  GdipCreateImageAttributes

  GdipSetPenDashStyle

  GdipAddPathPieI

  GdipSetClipPath

  GdipDrawImageRectRectI

  GdipTranslateWorldTransform

  GdipRotateWorldTransform

  GdipResetWorldTransform

  GdipDrawPath

  GdipClosePathFigure

  GdipAddPathArcI

  GdipDeletePath

  GdipCreatePath

  GdipDrawRectangleI

  GdipDrawLine

  GdipSetSmoothingMode

  GdipSetPenMode

  GdipSetPenStartCap

  GdipSetPenEndCap

  GdipDeletePen

  GdipCreateStringFormat

  wtsapi32

  WTSEnumerateSessionsW

  WTSFreeMemory

  psapi

  GetProcessImageFileNameW

  GetModuleFileNameExW

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  rasapi32

  RasEnumConnectionsW

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  GetAdaptersInfo

  Sections

  .text

  Size: 836KB - Virtual size: 832KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 200KB - Virtual size: 198KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 32KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ