tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

2.2MB
MD5

19a45f5d5554890987606380b83893e0
SHA1

ec6ddf2423e1def3deeae86556aa8b4c1ba696f0
SHA256

9eee6bf121ec26849ad1be64b5fed73a840a17e572ce50b3485da81a88b3b7c9
SHA512

20f61c351cdc889661c330e8b07fe079f96b99b51d13285884d56f159bbfe9cd7159125581e78bdf35bb9fa036fbd9be9baa1251a24fb2c8f2b401e6f3435bcf
SSDEEP

49152:gd/wpke3ePE3ydT7qmVOGdArZmCrZinUAt:YYVuP0y7VfdArYCreF

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows:6 windows x86

c3d9b0a1998eafd83313264341a566f1

Code Sign

0d:d7:d4:a7:85:99:05:84:d8:c0:83:76:59:17:32:72
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/04/2020, 00:00

Not After

12/04/2023, 12:00

Subject

CN=雷神（武汉）信息技术有限公司,O=雷神（武汉）信息技术有限公司,L=武汉市,ST=湖北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:fd:9b:d4:b4:28:1c:65:22:d9:60:11:df:46:c9:c4
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/04/2020, 00:00

Not After

12/04/2023, 12:00

Subject

CN=雷神（武汉）信息技术有限公司,O=雷神（武汉）信息技术有限公司,L=武汉市,ST=湖北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:37:ec:8d:cb:19:ff:5f:09:7f:66:f3:1e:f2:12:2e:a1:12:42:e4:ab:6f:5c:49:d8:2f:dd:5b:a9:11:71:cb
Signer

Actual PE Digest

5b:37:ec:8d:cb:19:ff:5f:09:7f:66:f3:1e:f2:12:2e:a1:12:42:e4:ab:6f:5c:49:d8:2f:dd:5b:a9:11:71:cb

Digest Algorithm

sha256

PE Digest Matches

true

12:8d:fd:3c:3c:38:e2:5f:7f:41:25:ad:66:16:97:c1:01:25:b0:9b
Signer

Actual PE Digest

12:8d:fd:3c:3c:38:e2:5f:7f:41:25:ad:66:16:97:c1:01:25:b0:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
StrStrIW
StrCpyW
PathIsRelativeW
StrStrIA

comctl32

_TrackMouseEvent
ord17

gdiplus

GdipDrawRectangleI
GdipCloneStringFormat
GdipDrawLineI
GdipCreateLineBrushI
GdipCreateLineBrush
GdipFillRectangle
GdipBitmapApplyEffect
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipFillEllipseI
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipFillPath
GdipMeasureString
GdipScaleMatrix
GdipDrawPath
GdipStringFormatGetGenericTypographic
GdipDeleteFont
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipStartPathFigure
GdipGetPathFillMode
GdipDeleteStringFormat
GdipDrawEllipseI
GdipDrawString
GdipSetStringFormatTrimming
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipCreateSolidFill
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipFree
GdipLoadImageFromFile
GdipCreateFontFromLogfontA
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRect
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteMatrix
GdipCreateMatrix
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipDrawBezierI
GdipCreateFontFromDC
GdipSetStringFormatLineAlign
GdipGetLogFontW
GdipGetFontCollectionFamilyList
GdipDeleteFontFamily
GdipPrivateAddMemoryFont
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneFontFamily
GdipCreateFont

winmm

timeSetEvent
timeGetDevCaps
timeGetTime
timeKillEvent

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

msimg32

AlphaBlend

libcurl

curl_easy_setopt
curl_easy_cleanup
curl_easy_perform
curl_easy_getinfo
curl_easy_init

kernel32

UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
ExitThread
CreateTimerQueue
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
MoveFileExW
SetLastError
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
GetCurrentThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
GetStringTypeW
IsDebuggerPresent
RtlUnwind
GetModuleHandleExW
ExitProcess
GetFileSizeEx
SetFilePointerEx
HeapAlloc
GetTimeZoneInformation
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
HeapReAlloc
SetStdHandle
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
SetEndOfFile
SignalObjectAndWait
OutputDebugStringA
GetFileType
FileTimeToSystemTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
VirtualQuery
SetEvent
GetVersionExW
GetStdHandle
TerminateThread
SetThreadPriority
ResetEvent
CreateEventW
WaitForSingleObject
TlsFree
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetPrivateProfileIntW
GetModuleFileNameW
GetCurrentThreadId
DeleteFileA
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
GetACP
FormatMessageW
GetLastError
OpenProcess
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
CloseHandle
Sleep
CreateToolhelp32Snapshot
Process32FirstW
TerminateProcess
Process32NextW
MoveFileW
DeleteFileW
CopyFileW
GetModuleHandleW
GetPrivateProfileStringA
RemoveVectoredExceptionHandler
VirtualProtect
GetCurrentProcess
CreateFileW
GetFileAttributesW
OutputDebugStringW
GetNativeSystemInfo
RaiseException
LoadLibraryW
GetLocalTime
AddVectoredExceptionHandler
GetProcAddress
FreeLibrary
IsWow64Process
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
GetCurrentDirectoryW
FindResourceW
LoadResource
SizeofResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GlobalSize
GetFileSize
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryW
WriteFile
GetEnvironmentVariableW
FindFirstFileW
FindClose
GetCommandLineW
FindNextFileW
RemoveDirectoryW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsAlloc

user32

UnregisterClassW
GetUserObjectInformationW
GetProcessWindowStation
WaitMessage
SetTimer
GetWindowThreadProcessId
SendMessageW
PostMessageW
FindWindowW
FindWindowExW
IsWindow
PostQuitMessage
MessageBoxA
GetWindowLongW
IsIconic
IsZoomed
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
ScreenToClient
GetClientRect
OffsetRect
GetWindowRect
SetWindowRgn
SetWindowLongW
MessageBoxW
MoveWindow
ShowWindow
IsWindowVisible
SetForegroundWindow
SetWindowTextW
SetWindowPos
DefWindowProcW
DestroyWindow
ReleaseDC
LoadCursorW
RegisterClassW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
GetWindow
EnableWindow
SetFocus
LoadImageW
GetSystemMetrics
CallWindowProcW
SetPropW
GetPropW
GetDC
InvalidateRect
GetKeyState
GetCursorPos
GetFocus
SetCapture
ReleaseCapture
BeginPaint
EndPaint
GetUpdateRect
IsRectEmpty
IntersectRect
UpdateLayeredWindow
PtInRect
TranslateMessage
DispatchMessageW
CharNextW
GetDesktopWindow
UnionRect
SetCursor
ClientToScreen
GetSysColor
GetAsyncKeyState
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
wsprintfW
MapWindowPoints
GetParent
KillTimer
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

GetDeviceCaps
CreateDIBSection
GetObjectA
StretchBlt
BitBlt
DeleteDC
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
SetStretchBltMode
CreateRectRgnIndirect
ExtSelectClipRgn
SelectObject
CreateFontIndirectW
GetStockObject
GetObjectW
DeleteObject
CreateCompatibleDC
CreateRoundRectRgn

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource

shell32

ShellExecuteW
ord165

ole32

CoCreateInstance
CreateStreamOnHGlobal

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 897KB - Virtual size: 896KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1008KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3d9b0a1998eafd83313264341a566f1

Code Sign

0d:d7:d4:a7:85:99:05:84:d8:c0:83:76:59:17:32:72Certificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:fd:9b:d4:b4:28:1c:65:22:d9:60:11:df:46:c9:c4Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

5b:37:ec:8d:cb:19:ff:5f:09:7f:66:f3:1e:f2:12:2e:a1:12:42:e4:ab:6f:5c:49:d8:2f:dd:5b:a9:11:71:cbSigner

12:8d:fd:3c:3c:38:e2:5f:7f:41:25:ad:66:16:97:c1:01:25:b0:9bSigner

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

gdiplus

winmm

imm32

msimg32

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 897KB - Virtual size: 896KB

.rdata Size: 279KB - Virtual size: 278KB

.data Size: 26KB - Virtual size: 548KB

.rsrc Size: 1008KB - Virtual size: 1008KB

.reloc Size: 53KB - Virtual size: 52KB

0d:d7:d4:a7:85:99:05:84:d8:c0:83:76:59:17:32:72
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:fd:9b:d4:b4:28:1c:65:22:d9:60:11:df:46:c9:c4
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

5b:37:ec:8d:cb:19:ff:5f:09:7f:66:f3:1e:f2:12:2e:a1:12:42:e4:ab:6f:5c:49:d8:2f:dd:5b:a9:11:71:cb
Signer

12:8d:fd:3c:3c:38:e2:5f:7f:41:25:ad:66:16:97:c1:01:25:b0:9b
Signer

.text
Size: 897KB - Virtual size: 896KB

.rdata
Size: 279KB - Virtual size: 278KB

.data
Size: 26KB - Virtual size: 548KB

.rsrc
Size: 1008KB - Virtual size: 1008KB

.reloc
Size: 53KB - Virtual size: 52KB