e5b768698fe101ce14f87c1018edc1f3a3e18a8f75edf1ff7787b408f8450870

Sharing

Copy URL Twitter E-mail

General

Target

e5b768698fe101ce14f87c1018edc1f3a3e18a8f75edf1ff7787b408f8450870
Size

231KB
MD5

b61c34634924b97582c2f96adbe8a120
SHA1

543a00e3ae29f5113da34ab996bc710a167738b6
SHA256

e5b768698fe101ce14f87c1018edc1f3a3e18a8f75edf1ff7787b408f8450870
SHA512

6334f71038b311b7b2bf466dd1496fe1973f4e6630f80f3e8e342b48b54c942a3a7fbf1525a2aa608b267946fef3c096dcce63352fc75015d7c80cd43fac820f
SSDEEP

3072:JAFtOnVucAz093/Om+au7GS2mZecm/Om+au7e9gLbLDdlIkMhc2GA4Mhc2GAtwTs:yOnV03lPZ97ln/naDcSh

Score

N/A

Malware Config

Signatures

Files

e5b768698fe101ce14f87c1018edc1f3a3e18a8f75edf1ff7787b408f8450870
.exe windows x86

4cd530e3ddac28fe5e10cd552e85fadb

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/07/2021, 00:00

Not After

11/07/2022, 23:59

Subject

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

08/07/2021, 00:00

Not After

11/07/2022, 23:59

Subject

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:9d:a5:b8:a7:b9:74:aa:48:e4:c1:bb:66:b6:6d:14:0e:87:35:f1:2a:4b:cc:fb:c9:40:99:dc:e3:f6:38:67
Signer

Actual PE Digest

cb:9d:a5:b8:a7:b9:74:aa:48:e4:c1:bb:66:b6:6d:14:0e:87:35:f1:2a:4b:cc:fb:c9:40:99:dc:e3:f6:38:67

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

19/07/2021, 07:17
Valid: true

Chain 1

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

d1:45:b5:2a:21:8c:eb:2b:26:60:ad:e0:07:96:02:0a:cc:c5:65:35
Signer

Actual PE Digest

d1:45:b5:2a:21:8c:eb:2b:26:60:ad:e0:07:96:02:0a:cc:c5:65:35

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

19/07/2021, 07:17
Valid: true

Chain 1

SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
CreateMutexW
GetModuleFileNameW
LoadLibraryExW
FindResourceW
SizeofResource
LockResource
CloseHandle
FindResourceExW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
Sleep
GetProcAddress
LoadResource
LoadLibraryW
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SetUnhandledExceptionFilter

user32

IsWindow
UnregisterClassA
FindWindowW
ShowWindow
SetForegroundWindow

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shlwapi

PathRemoveFileSpecW

msvcr80

__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
__p__commode
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_adjust_fdiv
__setusermatherr
_initterm
_configthreadlocale
_decode_pointer
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
memset
free
_purecall
memmove_s
memcpy_s
wcslen
??2@YAPAXI@Z
_beginthreadex
??3@YAXPAX@Z
_CxxThrowException
_initterm_e
__CxxFrameHandler3

msvcp80

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4cd530e3ddac28fe5e10cd552e85fadb

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

cb:9d:a5:b8:a7:b9:74:aa:48:e4:c1:bb:66:b6:6d:14:0e:87:35:f1:2a:4b:cc:fb:c9:40:99:dc:e3:f6:38:67Signer

Signature Validations

Verification

19/07/2021, 07:17 Valid: true

Chain 1

d1:45:b5:2a:21:8c:eb:2b:26:60:ad:e0:07:96:02:0a:cc:c5:65:35Signer

Signature Validations

Verification

19/07/2021, 07:17 Valid: true

Chain 1

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcr80

msvcp80

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 188KB - Virtual size: 188KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

cb:9d:a5:b8:a7:b9:74:aa:48:e4:c1:bb:66:b6:6d:14:0e:87:35:f1:2a:4b:cc:fb:c9:40:99:dc:e3:f6:38:67
Signer

19/07/2021, 07:17
Valid: true

d1:45:b5:2a:21:8c:eb:2b:26:60:ad:e0:07:96:02:0a:cc:c5:65:35
Signer

19/07/2021, 07:17
Valid: true

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 188KB - Virtual size: 188KB