7c2669f58dcbb378a0b57e1b0cb7b1c610c433f6fcf53a4737b349ab34fa17c4

Sharing

Copy URL Twitter E-mail

General

Target

7c2669f58dcbb378a0b57e1b0cb7b1c610c433f6fcf53a4737b349ab34fa17c4
Size

620KB
MD5

ba1e5acb42ce428dfd56e97b537bf246
SHA1

5f53b7a3fa8c26dd2007fc1e88c145c4dd05ae91
SHA256

7c2669f58dcbb378a0b57e1b0cb7b1c610c433f6fcf53a4737b349ab34fa17c4
SHA512

8d60a3c0c094baf09640d826489fffefe8c63c6ac4499d9ed977d4b052324f8a36a8e67ec8d5cb67c4ed39279ee961cd5b0c029873e6deef5671392326ea1a75
SSDEEP

12288:UKNmd8RJkZf/c2j+nWWL0/Ghfc2j+VFefX:UKgPJVCnJ0/MfVC6

Score

1^/10

Malware Config

Signatures

Files

7c2669f58dcbb378a0b57e1b0cb7b1c610c433f6fcf53a4737b349ab34fa17c4
.exe windows x86

1fbf977df748f12ed1af231fae8852f1

Code Sign

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/11/2020, 00:00

Not After

21/02/2024, 23:59

Subject

SERIALNUMBER=91610104MA6U0QWU5L,CN=Xi'an Expand Network Technology Co\, Ltd.,O=Xi'an Expand Network Technology Co\, Ltd.,L=西安市,ST=陕西省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e88eb2e6b996e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e99995e8a5bfe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8e
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/11/2020, 00:00

Not After

21/02/2024, 23:59

Subject

SERIALNUMBER=91610104MA6U0QWU5L,CN=Xi'an Expand Network Technology Co\, Ltd.,O=Xi'an Expand Network Technology Co\, Ltd.,L=西安市,ST=陕西省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e88eb2e6b996e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e99995e8a5bfe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:9f:90:24:87:08:92:62:f4:b8:5e:6f:46:73:fa:d9:aa:05:94:7d:29:ca:1d:5b:17:b7:40:67:6f:b8:4a:73
Signer

Actual PE Digest

d2:9f:90:24:87:08:92:62:f4:b8:5e:6f:46:73:fa:d9:aa:05:94:7d:29:ca:1d:5b:17:b7:40:67:6f:b8:4a:73

Digest Algorithm

sha256

PE Digest Matches

false

f1:e9:23:1d:78:46:8f:2c:e1:92:d6:4a:57:56:3f:1d:90:e4:dd:0b
Signer

Actual PE Digest

f1:e9:23:1d:78:46:8f:2c:e1:92:d6:4a:57:56:3f:1d:90:e4:dd:0b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
ord588
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaStrCat
__vbaLsetFixstr
__vbaWriteFile
ord660
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
ord666
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaLateMemSt
__vbaVarForInit
__vbaExitProc
__vbaForEachCollObj
ord301
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord520
ord307
__vbaFPFix
ord309
__vbaBoolVarNull
_CIsin
ord709
ord632
__vbaNextEachCollObj
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaAryConstruct2
ord561
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaFixstrConstruct
Zombie_GetTypeInfoCount
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
ord711
__vbaPrintFile
__vbaStrToUnicode
__vbaInputFile
ord712
ord606
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
__vbaI2Str
ord608
ord531
__vbaFPException
ord717
ord532
__vbaInStrVar
ord319
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord534
__vbaI2Var
ord537
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
__vbaNew2
__vbaInStr
__vbaVarLateMemCallLdRf
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
ord579
__vbaVarTstNe
__vbaI4Var
__vbaLateMemCall
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaFpI2
__vbaFpI4
ord616
__vbaVarCopy
ord617
__vbaLateMemCallLd
__vbaRecDestructAnsi
_CIatan
ord618
__vbaAryCopy
__vbaStrMove
__vbaStrVarCopy
ord619
ord650
_allmul
_CItan
ord546
__vbaVarForNext
_CIexp
__vbaRecAssign
ord580
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 480KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1fbf977df748f12ed1af231fae8852f1

Code Sign

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8eCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8eCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

d2:9f:90:24:87:08:92:62:f4:b8:5e:6f:46:73:fa:d9:aa:05:94:7d:29:ca:1d:5b:17:b7:40:67:6f:b8:4a:73Signer

f1:e9:23:1d:78:46:8f:2c:e1:92:d6:4a:57:56:3f:1d:90:e4:dd:0bSigner

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 480KB - Virtual size: 476KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 116KB - Virtual size: 116KB

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8e
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

02:7c:66:f7:15:31:cd:1c:27:fe:b3:ae:13:ad:07:8e
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

d2:9f:90:24:87:08:92:62:f4:b8:5e:6f:46:73:fa:d9:aa:05:94:7d:29:ca:1d:5b:17:b7:40:67:6f:b8:4a:73
Signer

f1:e9:23:1d:78:46:8f:2c:e1:92:d6:4a:57:56:3f:1d:90:e4:dd:0b
Signer

.text
Size: 480KB - Virtual size: 476KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 116KB - Virtual size: 116KB