7069c405075e7479c1c88bd05486761ce7ba9c3cf964c90bcf345f06317689fa

Sharing

Copy URL Twitter E-mail

General

Target

7069c405075e7479c1c88bd05486761ce7ba9c3cf964c90bcf345f06317689fa
Size

10.3MB
MD5

5d50520d02e026c28a0bf08592959a73
SHA1

b22bfebdd2ad758744e99cc176406b035657775a
SHA256

7069c405075e7479c1c88bd05486761ce7ba9c3cf964c90bcf345f06317689fa
SHA512

52da42eda7e6acd0ddfba4bd3c620dac3b65fb422079fd67c6d5870f2bb77829083e13899e1d77919500fdf94d956cb17be175c1ca6b6045284db957582342d5
SSDEEP

196608:YyNfiC6PgRcvftQL8Wu6CUDO6mcC1Ltw7GB5R+hO7TraHT:YyNKURcvftO2ZLtEZs7T

Score

1^/10

Malware Config

Signatures

Files

7069c405075e7479c1c88bd05486761ce7ba9c3cf964c90bcf345f06317689fa
.exe windows:6 windows x64

17c39fcdaf105cdebd8cb0da88e1f2bd

Code Sign

44:11:9a:7d:bc:20:d5:4b:b5:78:9b:bb:69:e8:ba:a2
Certificate

Issuer

CN=TONGZ_test

Not Before

24/02/2023, 05:09

Not After

31/12/2039, 23:59

Subject

CN=TONGZ_test

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:25:cb:60:d5:f0:c7:1a:d8:a8:81:c0:fc:14:98:df:d8:a8:66:e2:2d:f6:16:32:a6:54:05:28:be:3d:ea:84
Signer

Actual PE Digest

89:25:cb:60:d5:f0:c7:1a:d8:a8:81:c0:fc:14:98:df:d8:a8:66:e2:2d:f6:16:32:a6:54:05:28:be:3d:ea:84

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathRemoveFileSpecW

ntdll

RtlUnwindEx

kernel32

GetVersionExW
GetVersionExA
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

MessageBoxW

gdi32

CreateDIBSection

advapi32

CryptCreateHash

shell32

CommandLineToArgvW

ws2_32

__WSAFDIsSet

crypt32

CertOpenStore

version

VerQueryValueW

wldap32

ord208

iphlpapi

SendARP

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

Exports

Exports

?$TSS0@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4HA
??4?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z
?create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@23@XZ
?getInstance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SAAEAUPolymorphicCasters@23@XZ
?instance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@0AEAUPolymorphicCasters@23@EA
?t@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4U534@A

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 556KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.n0r0
Size: - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.n0r1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.n0r2
Size: 10.3MB - Virtual size: 10.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17c39fcdaf105cdebd8cb0da88e1f2bd

Code Sign

44:11:9a:7d:bc:20:d5:4b:b5:78:9b:bb:69:e8:ba:a2Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

89:25:cb:60:d5:f0:c7:1a:d8:a8:81:c0:fc:14:98:df:d8:a8:66:e2:2d:f6:16:32:a6:54:05:28:be:3d:ea:84Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ntdll

kernel32

user32

gdi32

advapi32

shell32

ws2_32

crypt32

version

wldap32

iphlpapi

dxgi

d3d11

Exports

Exports

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 556KB

.data Size: - Virtual size: 87KB

.pdata Size: - Virtual size: 84KB

_RDATA Size: - Virtual size: 244B

.n0r0 Size: - Virtual size: 5.6MB

.n0r1 Size: 3KB - Virtual size: 3KB

.n0r2 Size: 10.3MB - Virtual size: 10.3MB

.reloc Size: 512B - Virtual size: 292B

.rsrc Size: 63KB - Virtual size: 63KB

44:11:9a:7d:bc:20:d5:4b:b5:78:9b:bb:69:e8:ba:a2
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

89:25:cb:60:d5:f0:c7:1a:d8:a8:81:c0:fc:14:98:df:d8:a8:66:e2:2d:f6:16:32:a6:54:05:28:be:3d:ea:84
Signer

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 556KB

.data
Size: - Virtual size: 87KB

.pdata
Size: - Virtual size: 84KB

_RDATA
Size: - Virtual size: 244B

.n0r0
Size: - Virtual size: 5.6MB

.n0r1
Size: 3KB - Virtual size: 3KB

.n0r2
Size: 10.3MB - Virtual size: 10.3MB

.reloc
Size: 512B - Virtual size: 292B

.rsrc
Size: 63KB - Virtual size: 63KB