3e1b6faeb71025ae60e03162b6f90c265ad88dcb3930584df97bd737456c199a

Sharing

Copy URL

Twitter E-mail

General

Target

3e1b6faeb71025ae60e03162b6f90c265ad88dcb3930584df97bd737456c199a
Size

3.3MB
MD5

b76c49e124742a8bb5bc99afd81602e5
SHA1

8cc16b17b2b11ecc33c3bcc428fcf11b0b064808
SHA256

3e1b6faeb71025ae60e03162b6f90c265ad88dcb3930584df97bd737456c199a
SHA512

ac45c753680b60e5fafa3f2c8692606b32bf9a0841c38b12d2562dd95415195b4c5d1166fbf4e6f449e8e8bbfba6b76e1c6a23105fe9031c371a76e29aaf6d12
SSDEEP

98304:MnOmPopFxPQL3hoUiiW01sv08u3DVd1SZg+RZoj9ghi1RebMIg9Cbk/V88g:mRL3Kg1sv08nZg+RZojDIg9Cbk/V8r

Score

1^/10

Malware Config

Signatures

Files

3e1b6faeb71025ae60e03162b6f90c265ad88dcb3930584df97bd737456c199a
.exe windows x86

9426142b8c1264c17be3bc88aa6e0354

Code Sign

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

Issuer

L=Hong Kong,ST=Central and Western District,C=HK

Not Before

24/04/2023, 03:03

Not After

23/04/2024, 03:03

Subject

L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

Issuer

L=Hong Kong,ST=Central and Western District,C=HK

Not Before

24/04/2023, 03:03

Not After

23/04/2024, 03:03

Subject

L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

01:aa:f0:51:c9:9c:3a:93:30:ef:7c:ce:13:42:21:5d:da:49:7e:54:89:b3:48:50:42:bf:4e:34:7c:41:fd:15
Signer

Actual PE Digest

01:aa:f0:51:c9:9c:3a:93:30:ef:7c:ce:13:42:21:5d:da:49:7e:54:89:b3:48:50:42:bf:4e:34:7c:41:fd:15

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

L=Hong Kong,ST=Central and Western District,C=HK

26/04/2023, 11:42
Valid: false

22:d5:b4:56:f9:35:03:2c:2f:e6:5b:6d:73:78:66:b5:c0:79:9f:20
Signer

Actual PE Digest

22:d5:b4:56:f9:35:03:2c:2f:e6:5b:6d:73:78:66:b5:c0:79:9f:20

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

L=Hong Kong,ST=Central and Western District,C=HK

26/04/2023, 11:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
CreateFileA
GlobalAlloc
ReleaseActCtx
GetModuleFileNameW
SetThreadPriority
ResumeThread
WaitForSingleObject
GetCurrentDirectoryA
MulDiv
lstrlenW
LocalFree
FormatMessageA
CopyFileA
lstrcmpA
GetLocaleInfoA
GetSystemDefaultUILanguage
ConvertDefaultLocale
GetUserDefaultUILanguage
GetCurrentThread
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetTickCount
GetUserDefaultLCID
SystemTimeToFileTime
ReplaceFileA
SetFileTime
GetFileTime
GetTempFileNameA
GetFullPathNameA
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
GetStringTypeExA
GetThreadLocale
lstrcmpiA
DeleteFileA
MoveFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
GlobalFlags
TlsGetValue
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetCPInfo
GetOEMCP
GetACP
GetProfileIntA
Sleep
SearchPathA
GetTempPathA
GetFileAttributesExA
LocalFileTimeToFileTime
GetFileSizeEx
SetErrorMode
VirtualProtect
GetWindowsDirectoryA
CloseHandle
FindResourceExW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RtlUnwind
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetSystemTimeAsFileTime
HeapReAlloc
ExitProcess
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetLocaleInfoW
HeapCreate
SetHandleCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
IsProcessorFeaturePresent
IsValidCodePage
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetProcessHeap
CreateFileW
SetEnvironmentVariableA
GlobalReAlloc
GlobalFree
GlobalSize
FindResourceA
FreeResource
GetCurrentThreadId
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
FreeLibrary
CompareStringA
LoadLibraryW
lstrcmpW
GlobalLock
GlobalUnlock
GetCurrentProcessId
lstrlenA
GlobalGetAtomNameA
GlobalAddAtomA
MultiByteToWideChar
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
GetFileAttributesA
DeleteCriticalSection
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
lstrcpyA
SetFileAttributesA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
ActivateActCtx
GetProcAddress
GetModuleHandleA
LoadLibraryA
GetLastError
DeactivateActCtx
CreateActCtxW
SetLastError

user32

LoadCursorW
LoadCursorA
MessageBeep
GetCursorPos
NotifyWinEvent
GetAsyncKeyState
CharUpperA
AppendMenuA
GetMenuDefaultItem
IsMenu
DrawIconEx
SetMenuDefaultItem
DrawStateA
FillRect
OpenClipboard
CopyImage
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
SetRect
UnionRect
GetUpdateRect
LockWindowUpdate
GetDC
ReleaseDC
GetKeyNameTextA
MapVirtualKeyA
GetMenuItemInfoA
GetMenuStringA
SystemParametersInfoA
RegisterClipboardFormatA
SetClassLongA
GetSysColorBrush
ValidateRect
TranslateMessage
GetMessageA
DestroyAcceleratorTable
EnableScrollBar
UpdateLayeredWindow
MonitorFromPoint
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
RemoveMenu
InsertMenuA
DrawEdge
DrawFrameControl
DrawFocusRect
EnumDisplayMonitors
SetLayeredWindowAttributes
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
LoadAcceleratorsW
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
PostThreadMessageA
WaitMessage
ShowOwnedPopups
GetIconInfo
CharUpperBuffA
FrameRect
InvertRect
HideCaret
SetCursorPos
RealChildWindowFromPoint
CopyIcon
CopyAcceleratorTableA
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableA
SubtractRect
UnregisterClassA
IsClipboardFormatAvailable
GetDoubleClickTime
EnumChildWindows
CharNextA
InvalidateRgn
GetNextDlgGroupItem
DestroyCursor
DrawIcon
CreateMenu
IsCharLowerA
MapVirtualKeyExA
GetWindowRgn
GetTabbedTextExtentW
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
SetWindowsHookExA
CallNextHookEx
SetPropA
WindowFromPoint
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
MessageBoxA
CreateWindowExA
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetClassNameA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
WinHelpA
SetWindowPos
DestroyIcon
SetFocus
GetWindowThreadProcessId
GetActiveWindow
IsWindowEnabled
EqualRect
GetDlgItem
SetWindowLongA
GetDlgCtrlID
GetKeyState
LoadIconW
SetCursor
PeekMessageA
ReleaseCapture
LoadAcceleratorsA
SetActiveWindow
InsertMenuItemA
GetMenuItemID
GetMenuItemCount
CreatePopupMenu
GetClassInfoA
IntersectRect
GetMenu
GetLastActivePopup
BringWindowToTop
SetMenu
GetDesktopWindow
ShowWindow
GetWindowLongA
TranslateAcceleratorA
IsWindow
DestroyWindow
GetClassLongA
SetForegroundWindow
SetParent
GetTopWindow
GetCapture
IsWindowVisible
SetWindowRgn
IsZoomed
IsIconic
PostMessageA
OffsetRect
IsRectEmpty
CopyRect
GetWindow
GetParent
SetRectEmpty
LoadMenuW
GetSubMenu
SendMessageA
ScreenToClient
GetClientRect
InvalidateRect
UpdateWindow
GetWindowRect
InflateRect
GetSysColor
LoadBitmapW
EnableWindow
IsChild
GetFocus
ClientToScreen
LoadImageA
GetSystemMetrics
RedrawWindow
SetCapture
KillTimer
SetTimer
GetSystemMenu
DeleteMenu
SetWindowTextA
MoveWindow
IsDialogMessageA
SetDlgItemTextA
CheckDlgButton
TranslateMDISysAccel
GetMenuCheckMarkDimensions
DefMDIChildProcA
DefFrameProcA
GetPropA
SetMenuItemBitmaps
DrawMenuBar

gdi32

GetTextColor
SetDIBColorTable
BitBlt
PatBlt
GetDIBits
RealizePalette
SelectPalette
CreateRectRgn
CombineRgn
StretchBlt
GetObjectA
GetTextExtentPoint32A
GetStockObject
DeleteObject
CreateFontIndirectA
GetPixel
SetPixel
ExtTextOutA
GetTextMetricsA
SaveDC
CreateRectRgnIndirect
CreateRoundRectRgn
CreatePen
CreateBitmap
SetBkColor
SetTextColor
CreateCompatibleBitmap
CreateDIBSection
SelectObject
DeleteDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
GetLayout
SetLayout
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
SelectClipRgn
ExtSelectClipRgn
PtVisible
StartDocA
GetWindowExtEx
CreateCompatibleDC
SetPixelV
EnumFontFamiliesExA
GetTextExtentPoint32W
GetTextExtentPointA
GetTextFaceA
GetTextAlign
GetStretchBltMode
GetROP2
GetPolyFillMode
GetBkMode
GetNearestColor
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetSystemPaletteEntries
GetNearestPaletteIndex
GetWindowOrgEx
SetPaletteEntries
GetPaletteEntries
CreatePalette
ExtFloodFill
LPtoDP
GetViewportOrgEx
GetRgnBox
OffsetRgn
GetCharWidthA
RoundRect
Rectangle
EndDoc
AbortDoc
SetAbortProc
EndPage
CreatePatternBrush
GetObjectType
GetDeviceCaps
CreateSolidBrush
CreateHatchBrush
SetRectRgn
GetMapMode
DPtoLP
CopyMetaFileA
CreateDCA
CreateEllipticRgn
CreatePolygonRgn
GetBkColor
Polyline
Ellipse
Polygon
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
StartPage
GetViewportExtEx

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringLen
VariantCopy
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
OleCreateFontIndirect
VariantChangeType

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_GetIconSize
ImageList_Create
ImageList_DrawEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_GetIcon
InitCommonControlsEx

shlwapi

PathIsUNCA
PathStripToRootA
UrlUnescapeA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

oledlg

ord8

gdiplus

GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipGetImagePalette
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipDrawImageI

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

wininet

InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoA
InternetSetOptionExA

winmm

PlaySoundA

winspool.drv

ClosePrinter
OpenPrinterA
GetJobA
DocumentPropertiesA

comdlg32

GetFileTitleA

advapi32

RegOpenKeyExW
RegEnumValueA
RegCloseKey
RegSetValueA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegEnumKeyExA

shell32

DragFinish
SHGetFileInfoA
SHAppBarMessage
ShellExecuteA
SHAddToRecentDocs
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ExtractIconA
DragQueryFileA

ole32

CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
CoInitializeEx
StringFromCLSID
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
CoRevokeClassObject
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoGetClassObject
OleLockRunning
OleGetClipboard
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
CoTaskMemFree
CreateStreamOnHGlobal
StgOpenStorageOnILockBytes
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleDestroyMenuDescriptor

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 345KB - Virtual size: 344KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9426142b8c1264c17be3bc88aa6e0354

Code Sign

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2Certificate

Extended Key Usages

Key Usages

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2Certificate

Extended Key Usages

Key Usages

01:aa:f0:51:c9:9c:3a:93:30:ef:7c:ce:13:42:21:5d:da:49:7e:54:89:b3:48:50:42:bf:4e:34:7c:41:fd:15Signer

Signature Validations

Verification

26/04/2023, 11:42 Valid: false

22:d5:b4:56:f9:35:03:2c:2f:e6:5b:6d:73:78:66:b5:c0:79:9f:20Signer

Signature Validations

Verification

26/04/2023, 11:42 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msimg32

comctl32

shlwapi

oledlg

gdiplus

oleacc

imm32

wininet

winmm

winspool.drv

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 345KB - Virtual size: 344KB

.data Size: 28KB - Virtual size: 58KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 182KB - Virtual size: 181KB

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

01:aa:f0:51:c9:9c:3a:93:30:ef:7c:ce:13:42:21:5d:da:49:7e:54:89:b3:48:50:42:bf:4e:34:7c:41:fd:15
Signer

26/04/2023, 11:42
Valid: false

22:d5:b4:56:f9:35:03:2c:2f:e6:5b:6d:73:78:66:b5:c0:79:9f:20
Signer

26/04/2023, 11:42
Valid: false

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 345KB - Virtual size: 344KB

.data
Size: 28KB - Virtual size: 58KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 182KB - Virtual size: 181KB