xx[.]exe | Triage

Resubmissions

21/03/2023, 07:42

230321-jjqhashc39 1

21/03/2023, 07:35

230321-jeq82abc2y 1

Sharing

Copy URL Twitter E-mail

General

Target

xx.exe
Size

278KB
MD5

ea95e984f50c69f60f4e743359b8ecf7
SHA1

dc64a24c33cace9d2a36c3625ccb28cbd2d91798
SHA256

f92a5d95225d4ac1b875073c624725803d49999754f3b9276af2edf8e04ffa0e
SHA512

f1baa6f6fa520b94e56819961efe2d7fe3917696beb89d214b46fff640ffe309bf3d72293e78a237ad4ed92d1fd64a83c0ba42d074cde3120d7350bb53368b29
SSDEEP

6144:qzmrPF/XOt0PM1RnizZM8nO+QCiofD6xEPL:qzmzFqRizZfzQCidxEPL

Score

1^/10

Malware Config

Signatures

Files

xx.exe
.exe windows x86

50b9a4ca61fba31b3609abc913b46942

Code Sign

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26
Certificate

Issuer

CN=Quantum EV Secure Code Signing CN RSA R1,O=Quantum CA Limited,C=GB

Not Before

21/07/2022, 18:59

Not After

21/07/2023, 13:50

Subject

SERIALNUMBER=91310116MA1JAA69XR,CN=上海链度科技有限公司,OU=IT,O=上海链度科技有限公司,L=上海市,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:28

Not After

11/09/2023, 09:28

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:ac
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

09/02/2021, 19:44

Not After

07/02/2031, 19:44

Subject

CN=Quantum EV Secure Code Signing CN RSA R1,O=Quantum CA Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26
Certificate

Issuer

CN=Quantum EV Secure Code Signing CN RSA R1,O=Quantum CA Limited,C=GB

Not Before

21/07/2022, 18:59

Not After

21/07/2023, 13:50

Subject

SERIALNUMBER=91310116MA1JAA69XR,CN=上海链度科技有限公司,OU=IT,O=上海链度科技有限公司,L=上海市,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:28

Not After

11/09/2023, 09:28

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:ac
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

09/02/2021, 19:44

Not After

07/02/2031, 19:44

Subject

CN=Quantum EV Secure Code Signing CN RSA R1,O=Quantum CA Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:d6:4a:1d:fa:fa:57:e9:c8:f5:79:58:bd:f9:82:d5:8f:1b:d6:b7:68:fc:f5:c8:09:bd:08:7b:9c:e8:77:4e
Signer

Actual PE Digest

44:d6:4a:1d:fa:fa:57:e9:c8:f5:79:58:bd:f9:82:d5:8f:1b:d6:b7:68:fc:f5:c8:09:bd:08:7b:9c:e8:77:4e

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=91310116MA1JAA69XR,CN=上海链度科技有限公司,OU=IT,O=上海链度科技有限公司,L=上海市,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

01/01/0001, 00:00
Valid: false

cf:8a:be:15:ea:34:23:9b:60:27:2a:61:d4:8f:cb:92:50:b8:48:28
Signer

Actual PE Digest

cf:8a:be:15:ea:34:23:9b:60:27:2a:61:d4:8f:cb:92:50:b8:48:28

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=91310116MA1JAA69XR,CN=上海链度科技有限公司,OU=IT,O=上海链度科技有限公司,L=上海市,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

01/01/0001, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
HeapSize
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetACP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetStringTypeA
RtlUnwind
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStartupInfoA
lstrlenA
GetProcessHeap
GetCommandLineA
ExitProcess
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
HeapAlloc
VirtualAlloc
HeapFree
SetErrorMode
GetOEMCP
GetCPInfo
GetCurrentProcess
FlushFileBuffers
MoveFileA
GetThreadLocale
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GlobalAddAtomA
WritePrivateProfileStringA
FreeResource
GetCurrentProcessId
GetTickCount
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
FreeLibrary
GlobalDeleteAtom
lstrcmpA
GetModuleHandleA
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
SetFileTime
WriteFile
LocalFileTimeToFileTime
GetCurrentDirectoryA
SystemTimeToFileTime
ReadFile
CloseHandle
SetFilePointer
CreateFileA
LockResource
Sleep
GetFileAttributesA
CreateDirectoryA
FindClose
FindFirstFileA
LoadLibraryA
GetProcAddress
SizeofResource
LoadResource
FindResourceA
GetLastError
MultiByteToWideChar
GetVersion
InterlockedExchange
CompareStringA
WideCharToMultiByte
lstrlenW
GetStringTypeW

user32

UnregisterClassA
EndPaint
BeginPaint
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
GetSysColorBrush
LoadCursorA
GetDC
ReleaseDC
DestroyMenu
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetDesktopWindow
UpdateWindow
EnableWindow
wsprintfA
GetActiveWindow
SetActiveWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
GetWindowTextA
GetFocus
SetFocus
ShowWindow
SetWindowLongA
GetDlgCtrlID
IsWindow
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
PostMessageA
RegisterClipboardFormatA
MessageBoxA
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
SendMessageA
GetWindowThreadProcessId
SetWindowPos
GetWindow
GetDlgItem
SendDlgItemMessageA
IsDialogMessageA
SetWindowTextA

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps
RestoreDC
SaveDC
GetStockObject
DeleteDC
DeleteObject
SelectObject
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
SetMapMode

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
PathFindExtensionA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 164KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

50b9a4ca61fba31b3609abc913b46942

Code Sign

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26Certificate

Extended Key Usages

Key Usages

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83Certificate

Key Usages

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:acCertificate

Extended Key Usages

Key Usages

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26Certificate

Extended Key Usages

Key Usages

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83Certificate

Key Usages

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:acCertificate

Extended Key Usages

Key Usages

44:d6:4a:1d:fa:fa:57:e9:c8:f5:79:58:bd:f9:82:d5:8f:1b:d6:b7:68:fc:f5:c8:09:bd:08:7b:9c:e8:77:4eSigner

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

cf:8a:be:15:ea:34:23:9b:60:27:2a:61:d4:8f:cb:92:50:b8:48:28Signer

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Sections

.text Size: 164KB - Virtual size: 160KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 44KB - Virtual size: 43KB

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26
Certificate

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:ac
Certificate

3a:72:53:f4:1f:32:e5:6d:af:f1:d7:2b:86:67:b0:26
Certificate

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83
Certificate

29:fc:b8:a5:51:fa:44:f6:a9:ff:05:17:5a:68:4f:ac
Certificate

44:d6:4a:1d:fa:fa:57:e9:c8:f5:79:58:bd:f9:82:d5:8f:1b:d6:b7:68:fc:f5:c8:09:bd:08:7b:9c:e8:77:4e
Signer

01/01/0001, 00:00
Valid: false

cf:8a:be:15:ea:34:23:9b:60:27:2a:61:d4:8f:cb:92:50:b8:48:28
Signer

01/01/0001, 00:00
Valid: false

.text
Size: 164KB - Virtual size: 160KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 44KB - Virtual size: 43KB