a8c9b871b900bc65b7ddb096e7bbf9055d6f50d7407832486ad9c2822673e53f

Sharing

Copy URL Twitter E-mail

General

Target

a8c9b871b900bc65b7ddb096e7bbf9055d6f50d7407832486ad9c2822673e53f
Size

5.5MB
MD5

5895457755dc4284cf93906766276c91
SHA1

299a778eac7a1e76e6e72e9fd32dd89a79450a68
SHA256

a8c9b871b900bc65b7ddb096e7bbf9055d6f50d7407832486ad9c2822673e53f
SHA512

0db2ac2757a44b54342acb2308ea5fd6ee93460b756f532e6b2a75d8adc1cf7a75e410de87ef6593cf5b2d3bfb81b3b60b96f33c51d9b9e684103e26871713ec
SSDEEP

49152:dPcXUCmk+Yr4y4VgUwpw1Dmxoc2TX0m5wr:Itmk/4y4VApSi1awr

Score

1^/10

Malware Config

Signatures

Files

a8c9b871b900bc65b7ddb096e7bbf9055d6f50d7407832486ad9c2822673e53f
.dll windows x64

dc4ce78a8cfd4d2704c189ac5cbb8e29

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:47:81:4f:c9:60:e6:0e:6a:3a:22:3f:a4:6e:96:43:fa:db:d8:c4:0c:1e:ef:ec:b4:47:6e:d1:78:17:f1:0d
Signer

Actual PE Digest

9d:47:81:4f:c9:60:e6:0e:6a:3a:22:3f:a4:6e:96:43:fa:db:d8:c4:0c:1e:ef:ec:b4:47:6e:d1:78:17:f1:0d

Digest Algorithm

sha256

PE Digest Matches

false

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

17/04/2023, 02:58
Valid: true

Chain 1

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

bc:a0:a7:ca:7a:52:e2:e2:6e:e9:7e:8a:2b:92:55:81:91:88:dd:51
Signer

Actual PE Digest

bc:a0:a7:ca:7a:52:e2:e2:6e:e9:7e:8a:2b:92:55:81:91:88:dd:51

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

03/05/2023, 12:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetLogicalProcessorInformation
GetDiskFreeSpaceExW
GlobalMemoryStatus
GlobalMemoryStatusEx
CreateThread
SetEvent
CreateEventW
FreeLibrary
FileTimeToSystemTime
FindNextFileA
LoadLibraryA
OpenProcess
GetEnvironmentVariableA
CreateFileA
GetFileSizeEx
CreateFileMappingA
MapViewOfFileEx
DeleteFileA
SetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetModuleHandleA
GetSystemInfo
GetModuleFileNameA
QueryPerformanceFrequency
QueryPerformanceCounter
ResumeThread
LoadLibraryW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQueryEx
RtlLookupFunctionEntry
RtlVirtualUnwind
VirtualAlloc
VirtualFree
VirtualProtectEx
GetFileInformationByHandle
CreateMutexA
OpenFileMappingA
GetTickCount
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
GetSystemDirectoryW
RtlPcToFileHeader
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
GetSystemTimeAsFileTime
LCMapStringEx
GetCPInfo
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetStdHandle
FreeEnvironmentStringsW
SetFilePointerEx
QueryDosDeviceW
DeviceIoControl
FindFirstFileA
GetWindowsDirectoryA
GetLogicalDriveStringsA
UnmapViewOfFile
MapViewOfFile
ReleaseMutex
CreateFileMappingW
CreateMutexW
GetWindowsDirectoryW
SetEndOfFile
SetFilePointer
SetFileTime
Sleep
RemoveDirectoryW
FindClose
FindNextFileW
GetFileAttributesW
ReadFile
GetFileSize
FindFirstFileW
SetFileAttributesW
EncodePointer
GetModuleHandleW
LocalFree
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
PeekNamedPipe
CreateProcessA
CreatePipe
GetCurrentProcess
IsWow64Process
WaitForSingleObject
WideCharToMultiByte
GetCurrentProcessId
GetConsoleMode
GetStdHandle
CreateDirectoryW
WriteConsoleW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
ExitProcess
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwindEx
OutputDebugStringW
WriteFile
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetComputerNameA
GetCurrentThreadId
GetModuleFileNameW
CreateFileW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
RaiseException
MultiByteToWideChar
IsProcessorFeaturePresent
RtlUnwind

advapi32

RegisterEventSourceW
SetSecurityDescriptorDacl
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGetUserKey
CryptGenKey
CryptExportKey
CryptDestroyKey
OpenEventLogW
ReadEventLogW
CloseEventLog
ReportEventW
DeregisterEventSource
CryptGetProvParam
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegSaveKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyW
RegOpenKeyExW
GetUserNameA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyA
RegOpenKeyExA
CryptSetProvParam
InitializeSecurityDescriptor

ole32

CoCreateGuid
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
StringFromCLSID
CoUninitialize

shell32

SHGetFolderPathAndSubDirW
SHGetSpecialFolderPathA
SHGetFolderPathA

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysStringLen
SysFreeString

shlwapi

PathRemoveFileSpecW
PathRemoveFileSpecA
PathAddBackslashA
PathAppendW
StrStrIA
PathAddExtensionA
SHGetValueW
SHEnumKeyExW
StrRStrIW
StrStrIW
PathIsSameRootA
StrCmpIW
PathCombineW
PathCombineA
PathAppendA
PathFileExistsA
PathFindFileNameA
PathAddBackslashW

rpcrt4

UuidFromStringA

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo

iphlpapi

IcmpCloseHandle
IcmpCreateFile
GetInterfaceInfo
SendARP
GetIpAddrTable
GetIfTable
GetAdaptersInfo
GetIfEntry
GetIpForwardTable
GetAdaptersAddresses
IcmpSendEcho
GetNetworkParams

ws2_32

WSAGetLastError
setsockopt
WSAStartup
socket
htons
bind
sendto
ntohs
getsockopt
select
connect
ioctlsocket
closesocket
recvfrom
WSACleanup
inet_addr
getaddrinfo
freeaddrinfo

rasapi32

RasEnumConnectionsA

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringA
CertGetSubjectCertificateFromStore
CryptMsgGetParam
CryptQueryObject

winhttp

WinHttpCloseHandle
WinHttpReadData
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
WinHttpCheckPlatform
WinHttpConnect
WinHttpQueryHeaders

Exports

Exports

CreateObject
GetBugReport

Sections

.text
Size: 771KB - Virtual size: 770KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 466KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.tvm0
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc4ce78a8cfd4d2704c189ac5cbb8e29

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

9d:47:81:4f:c9:60:e6:0e:6a:3a:22:3f:a4:6e:96:43:fa:db:d8:c4:0c:1e:ef:ec:b4:47:6e:d1:78:17:f1:0dSigner

Signature Validations

Verification

17/04/2023, 02:58 Valid: true

Chain 1

bc:a0:a7:ca:7a:52:e2:e2:6e:e9:7e:8a:2b:92:55:81:91:88:dd:51Signer

Signature Validations

Verification

03/05/2023, 12:04 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

ole32

shell32

oleaut32

shlwapi

rpcrt4

version

setupapi

iphlpapi

ws2_32

rasapi32

crypt32

winhttp

Exports

Exports

Sections

.text Size: 771KB - Virtual size: 770KB

.rdata Size: 466KB - Virtual size: 465KB

.data Size: 18KB - Virtual size: 451KB

.pdata Size: 30KB - Virtual size: 29KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.tvm0 Size: 4.2MB - Virtual size: 4.2MB

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

9d:47:81:4f:c9:60:e6:0e:6a:3a:22:3f:a4:6e:96:43:fa:db:d8:c4:0c:1e:ef:ec:b4:47:6e:d1:78:17:f1:0d
Signer

17/04/2023, 02:58
Valid: true

bc:a0:a7:ca:7a:52:e2:e2:6e:e9:7e:8a:2b:92:55:81:91:88:dd:51
Signer

03/05/2023, 12:04
Valid: false

.text
Size: 771KB - Virtual size: 770KB

.rdata
Size: 466KB - Virtual size: 465KB

.data
Size: 18KB - Virtual size: 451KB

.pdata
Size: 30KB - Virtual size: 29KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.tvm0
Size: 4.2MB - Virtual size: 4.2MB