de9e7219792f0a55714a10847b2d70498cf11b6f2a8221cef9f00ef308b40fec

Sharing

Copy URL Twitter E-mail

General

Target

de9e7219792f0a55714a10847b2d70498cf11b6f2a8221cef9f00ef308b40fec
Size

5.5MB
MD5

811a15c518bf2b0f856ebad437531d2a
SHA1

881f9d1d0d262e37aa345ad105f33ab9b4f43475
SHA256

de9e7219792f0a55714a10847b2d70498cf11b6f2a8221cef9f00ef308b40fec
SHA512

795be0a6f340b9b8106daa59af83f621465573fee32fb4ab2eb76f02ec0d1a1256a20904ce983e4ba9c542a01825a807d0ef2878666f4ff5ed02ffe62e48e034
SSDEEP

49152:APcXUCmk+Yg4y4dgUwpw1Dmxo2bKya2CTEbPGYHkTHAJi2No2TXwm5wc:htmkk4y4dApSipiaeawc

Score

1^/10

Malware Config

Signatures

Files

de9e7219792f0a55714a10847b2d70498cf11b6f2a8221cef9f00ef308b40fec
.dll windows x64

dc4ce78a8cfd4d2704c189ac5cbb8e29

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:80:ec:5c:2e:63:a7:22:af:31:a4:41:a0:6d:77:6b:54:55:8d:4b:61:6c:e5:5a:2e:19:ab:ae:fe:02:fd:bc
Signer

Actual PE Digest

63:80:ec:5c:2e:63:a7:22:af:31:a4:41:a0:6d:77:6b:54:55:8d:4b:61:6c:e5:5a:2e:19:ab:ae:fe:02:fd:bc

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

03/11/2022, 03:50
Valid: true

Chain 1

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

ba:d0:28:74:9d:94:7c:a4:54:3b:0e:64:38:a8:8b:a4:fe:62:0c:e4
Signer

Actual PE Digest

ba:d0:28:74:9d:94:7c:a4:54:3b:0e:64:38:a8:8b:a4:fe:62:0c:e4

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

23/04/2023, 10:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetLogicalProcessorInformation
GetDiskFreeSpaceExW
GlobalMemoryStatus
GlobalMemoryStatusEx
CreateThread
SetEvent
CreateEventW
FreeLibrary
FileTimeToSystemTime
FindNextFileA
LoadLibraryA
OpenProcess
GetEnvironmentVariableA
CreateFileA
GetFileSizeEx
CreateFileMappingA
MapViewOfFileEx
DeleteFileA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetModuleHandleA
GetSystemInfo
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
ResumeThread
LoadLibraryW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQueryEx
RtlLookupFunctionEntry
RtlVirtualUnwind
VirtualAlloc
VirtualFree
VirtualProtectEx
GetFileInformationByHandle
CreateMutexA
OpenFileMappingA
GetTickCount
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
GetSystemDirectoryW
RtlPcToFileHeader
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
GetSystemTimeAsFileTime
LCMapStringEx
GetCPInfo
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetStdHandle
FreeEnvironmentStringsW
SetFilePointerEx
QueryDosDeviceW
DeviceIoControl
FindFirstFileA
GetWindowsDirectoryA
GetLogicalDriveStringsA
UnmapViewOfFile
MapViewOfFile
ReleaseMutex
CreateFileMappingW
CreateMutexW
GetWindowsDirectoryW
SetEndOfFile
SetFilePointer
SetFileTime
Sleep
RemoveDirectoryW
FindClose
FindNextFileW
GetFileAttributesW
ReadFile
GetFileSize
FindFirstFileW
SetFileAttributesW
EncodePointer
GetModuleHandleW
LocalFree
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
PeekNamedPipe
CreateProcessA
CreatePipe
GetCurrentProcess
IsWow64Process
WaitForSingleObject
WideCharToMultiByte
GetCurrentProcessId
GetConsoleMode
GetStdHandle
CreateDirectoryW
WriteConsoleW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ExitProcess
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwindEx
OutputDebugStringW
WriteFile
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetComputerNameA
GetCurrentThreadId
GetModuleFileNameW
CreateFileW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
RaiseException
MultiByteToWideChar
IsProcessorFeaturePresent
RtlUnwind

advapi32

RegisterEventSourceW
SetSecurityDescriptorDacl
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGetUserKey
CryptGenKey
CryptExportKey
CryptDestroyKey
OpenEventLogW
ReadEventLogW
CloseEventLog
ReportEventW
DeregisterEventSource
CryptGetProvParam
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegSaveKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyW
RegOpenKeyExW
GetUserNameA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyExA
CryptSetProvParam
InitializeSecurityDescriptor

ole32

CoCreateGuid
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
StringFromCLSID
CoUninitialize

shell32

SHGetFolderPathAndSubDirW
SHGetSpecialFolderPathA
SHGetFolderPathA

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysStringLen
SysFreeString

shlwapi

PathRemoveFileSpecW
PathRemoveFileSpecA
PathAddBackslashA
PathAppendW
StrStrIA
PathAddExtensionA
SHGetValueW
SHEnumKeyExW
StrRStrIW
StrStrIW
PathIsSameRootA
StrCmpIW
PathCombineW
PathCombineA
PathAppendA
PathFileExistsA
PathFindFileNameA
PathAddBackslashW

rpcrt4

UuidFromStringA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

iphlpapi

IcmpCloseHandle
IcmpCreateFile
GetInterfaceInfo
SendARP
GetIpAddrTable
GetIfTable
GetAdaptersInfo
GetIfEntry
GetIpForwardTable
GetAdaptersAddresses
IcmpSendEcho
GetNetworkParams

ws2_32

WSAGetLastError
setsockopt
WSAStartup
socket
htons
bind
sendto
ntohs
getsockopt
select
connect
ioctlsocket
closesocket
recvfrom
WSACleanup
inet_addr
getaddrinfo
freeaddrinfo

rasapi32

RasEnumConnectionsA

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CertGetSubjectCertificateFromStore
CryptMsgGetParam
CryptQueryObject

winhttp

WinHttpCloseHandle
WinHttpReadData
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpCheckPlatform
WinHttpConnect
WinHttpQueryHeaders

Exports

Exports

CreateObject
GetBugReport

Sections

.text
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.tvm0
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc4ce78a8cfd4d2704c189ac5cbb8e29

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

63:80:ec:5c:2e:63:a7:22:af:31:a4:41:a0:6d:77:6b:54:55:8d:4b:61:6c:e5:5a:2e:19:ab:ae:fe:02:fd:bcSigner

Signature Validations

Verification

03/11/2022, 03:50 Valid: true

Chain 1

ba:d0:28:74:9d:94:7c:a4:54:3b:0e:64:38:a8:8b:a4:fe:62:0c:e4Signer

Signature Validations

Verification

23/04/2023, 10:07 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

shell32

oleaut32

shlwapi

rpcrt4

version

setupapi

iphlpapi

ws2_32

rasapi32

crypt32

winhttp

Exports

Exports

Sections

.text Size: 771KB - Virtual size: 770KB

.rdata Size: 466KB - Virtual size: 465KB

.data Size: 18KB - Virtual size: 451KB

.pdata Size: 30KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.tvm0 Size: 4.2MB - Virtual size: 4.2MB

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

63:80:ec:5c:2e:63:a7:22:af:31:a4:41:a0:6d:77:6b:54:55:8d:4b:61:6c:e5:5a:2e:19:ab:ae:fe:02:fd:bc
Signer

03/11/2022, 03:50
Valid: true

ba:d0:28:74:9d:94:7c:a4:54:3b:0e:64:38:a8:8b:a4:fe:62:0c:e4
Signer

23/04/2023, 10:07
Valid: false

.text
Size: 771KB - Virtual size: 770KB

.rdata
Size: 466KB - Virtual size: 465KB

.data
Size: 18KB - Virtual size: 451KB

.pdata
Size: 30KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.tvm0
Size: 4.2MB - Virtual size: 4.2MB