57cab0758735d113e5905dcbda4287ee3c176699630293ce6e9dba7a944e0199

Sharing

Copy URL Twitter E-mail

General

Target

57cab0758735d113e5905dcbda4287ee3c176699630293ce6e9dba7a944e0199
Size

5.6MB
MD5

1e7bd6b6a521f7c40b8749c588548c3e
SHA1

4e728575dec59feb073ce723be16f0e6fdbf8ed2
SHA256

57cab0758735d113e5905dcbda4287ee3c176699630293ce6e9dba7a944e0199
SHA512

ae68587b4a52ca5e648aff6c2d43730228c1bf3339b38b277a41d0ce06e282bda62a97a05b5135521e8277358ff05f0385f78c5575565d48fb57db6ac00c8140
SSDEEP

98304:JSyTnxlbxdr0tH9z0dVlo7RODR249KTIbYUzsJvugrCG5f14M3I:Jbx6DzMo7A1z9AIbYnJvugrD5fm

Score

1^/10

Malware Config

Signatures

Files

57cab0758735d113e5905dcbda4287ee3c176699630293ce6e9dba7a944e0199
.exe windows x86

44439dfac2c7fc5810483bfb874bc018

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:ed:26:de:8d:bc:5c:0e:c9:9a:9c:58:3d:2a:4b:c7
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19/10/2022, 00:00

Not After

13/03/2024, 23:59

Subject

SERIALNUMBER=91440300MA5G63CT5C,CN=Shenzhen Kaixin Kangaroo Technology Co.\, Ltd.,OU=IT,O=Shenzhen Kaixin Kangaroo Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b7b1e59cb3e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:a2:09:0a:04:71:f6:b0:3c:7a:6c:fe:9b:92:bd:89:6e:56:3d:18:ff:b7:74:79:35:1a:fc:65:61:18:1f:2e
Signer

Actual PE Digest

7b:a2:09:0a:04:71:f6:b0:3c:7a:6c:fe:9b:92:bd:89:6e:56:3d:18:ff:b7:74:79:35:1a:fc:65:61:18:1f:2e

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetDriveTypeW
GetSystemDirectoryA
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
FormatMessageA
GetTempPathW
SetCurrentDirectoryW
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
InterlockedIncrement
CreateFileW
VerifyVersionInfoA
SystemTimeToTzSpecificLocalTime
WritePrivateProfileStringW
ReadFile
GetFileSize
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
QueryDosDeviceW
GetWindowsDirectoryW
LoadLibraryW
GetLogicalDriveStringsW
lstrcmpiW
DeleteFileW
GlobalAlloc
GlobalLock
GetModuleFileNameW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
FormatMessageW
MulDiv
MultiByteToWideChar
LocalFree
GetFileAttributesW
MoveFileExW
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
FileTimeToDosDateTime
DosDateTimeToFileTime
GetSystemInfo
FileTimeToLocalFileTime
ResetEvent
ReleaseSemaphore
CreateSemaphoreW
GetCurrentProcessId
GetVersionExW
WriteFile
SetEndOfFile
GetSystemDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetPrivateProfileStringW
GetLongPathNameW
GetEnvironmentVariableW
GlobalFree
LocalAlloc
GetExitCodeProcess
lstrcpyW
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetVolumeInformationW
FileTimeToSystemTime
DeviceIoControl
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
GetFileType
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
FlushFileBuffers
LoadLibraryA
GlobalUnlock
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
FreeLibrary
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
OpenFileMappingW
CreateFileMappingW
CreateEventW
OpenMutexW
CreateMutexW
lstrlenW
UnmapViewOfFile
MapViewOfFile
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
ReleaseMutex
SetEvent
GetLastError
OpenProcess

user32

ScreenToClient
DestroyIcon
LoadBitmapW
CreateIconFromResource
LoadImageW
CharNextW
GetMessageW
ClientToScreen
EnableMenuItem
GetSysColor
GetSystemMetrics
MessageBoxW
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
DestroyWindow
DestroyCursor
LoadCursorW
IntersectRect
GetKeyState
wsprintfW
SetWindowLongW
GetWindowLongW
GetForegroundWindow
HideCaret
UnregisterClassW
GetClassNameW
PeekMessageW
DispatchMessageW
TranslateMessage
LoadStringW
CharPrevExA
CharUpperW
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
KillTimer
SetCursor
SetRect
CopyRect
UnionRect
IsRectEmpty
EqualRect
PtInRect
SendMessageW
ShowWindow
SetWindowPos
SetWindowTextW
IsWindow
SetForegroundWindow
FindWindowW
GetCaretBlinkTime
CreateCaret
GetCursorPos
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ReleaseCapture
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
GetFocus
SetFocus
SetTimer
AnimateWindow
SystemParametersInfoW
GetUserObjectInformationW
GetProcessWindowStation
PostQuitMessage
PostMessageW
TrackMouseEvent
SetCaretPos
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
MapWindowPoints
GetWindowRect
GetClientRect

advapi32

RegQueryValueExW
RegGetValueW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
LookupAccountSidW
RegEnumKeyW
RegOpenKeyW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

OleInitialize
CoUninitialize
CoInitialize
CLSIDFromProgID
OleUninitialize
CoCreateGuid
CreateBindCtx
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning

psapi

EnumProcesses
EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

shlwapi

StrToIntExW
SHCreateStreamOnFileEx
PathFileExistsW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

gdiplus

GdipCloneImage
GdipGetImageWidth
GdiplusStartup
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageGraphicsContext
GdiplusShutdown
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGraphicsClear
GdipGetPropertyItemSize
GdipSaveImageToFile
GdipDrawImageI
GdipDeleteGraphics

ntdll

VerSetConditionMask

imm32

ImmReleaseContext
ImmGetContext
ImmAssociateContext

gdi32

DeleteDC
EnumFontFamiliesExW
GetCharABCWidthsW
GetFontData
GetGlyphOutlineW
StretchBlt
SetBkMode
Rectangle
GetStockObject
GdiFlush
GetTextFaceW
ExtTextOutW
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
CreateBitmap
CreateRoundRectRgn
EnumFontsW
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
CreateCompatibleDC
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW

oleaut32

SysFreeString
VariantClear
SysAllocStringLen
VariantCopy
SysAllocString

crypt32

CryptQueryObject
CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore

wldap32

ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord211
ord143
ord60
ord50

ws2_32

send
recv
WSASetLastError
bind
closesocket
WSACleanup
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname
WSAStartup
WSAGetLastError
connect
select
__WSAFDIsSet

usp10

ScriptItemize
ScriptShape
ScriptFreeCache

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 953KB - Virtual size: 953KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024KB - Virtual size: 46.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44439dfac2c7fc5810483bfb874bc018

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

09:ed:26:de:8d:bc:5c:0e:c9:9a:9c:58:3d:2a:4b:c7Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7b:a2:09:0a:04:71:f6:b0:3c:7a:6c:fe:9b:92:bd:89:6e:56:3d:18:ff:b7:74:79:35:1a:fc:65:61:18:1f:2eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

psapi

shlwapi

userenv

wtsapi32

gdiplus

ntdll

imm32

gdi32

oleaut32

crypt32

wldap32

ws2_32

usp10

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 953KB - Virtual size: 953KB

.data Size: 84KB - Virtual size: 211KB

.rsrc Size: 1024KB - Virtual size: 46.7MB

.reloc Size: 195KB - Virtual size: 195KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

09:ed:26:de:8d:bc:5c:0e:c9:9a:9c:58:3d:2a:4b:c7
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7b:a2:09:0a:04:71:f6:b0:3c:7a:6c:fe:9b:92:bd:89:6e:56:3d:18:ff:b7:74:79:35:1a:fc:65:61:18:1f:2e
Signer

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 953KB - Virtual size: 953KB

.data
Size: 84KB - Virtual size: 211KB

.rsrc
Size: 1024KB - Virtual size: 46.7MB

.reloc
Size: 195KB - Virtual size: 195KB