e1be56630a2cc4397116e186dd64af09cee0b079711d956e9df37307beaa28bb

Sharing

Copy URL

Twitter E-mail

General

Target

e1be56630a2cc4397116e186dd64af09cee0b079711d956e9df37307beaa28bb
Size

2.8MB
MD5

2380ade91d104c61738fed685200a272
SHA1

09559341e012ff7713e11a6e2474823da5a5cac4
SHA256

e1be56630a2cc4397116e186dd64af09cee0b079711d956e9df37307beaa28bb
SHA512

26c8c22679c103e2f15de790c555e3febb2a25b3bf9e3297a8775b4f44b5bd8e5d8cffa740cdeaf307e899af150f21baf5b000063a0a495c7f8e9b57d44eaedf
SSDEEP

24576:iBduHPuJD/0lHcJD/0sJbvEJbvb6PzI/JbU/JbU/m0hvguc00hvguc00hvgucON8:rPPCU9aaSDxD1

Score

1^/10

Malware Config

Signatures

Files

e1be56630a2cc4397116e186dd64af09cee0b079711d956e9df37307beaa28bb
.dll windows:4 windows x86

9f7ffb06514957b955f0e9a1ce93e4af

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/05/2022, 00:00

Not After

19/07/2024, 23:59

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/05/2022, 00:00

Not After

19/07/2024, 23:59

Subject

SERIALNUMBER=22671299,CN=Realtek Semiconductor Corp.,O=Realtek Semiconductor Corp.,L=Hsinchu City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:d2:f7:5a:d8:4b:4b:c0:5d:36:3a:00:ab:60:4b:c5:3a:8a:a9:19:a7:13:99:ea:9f:e4:0b:84:b7:2f:af:10
Signer

Actual PE Digest

5a:d2:f7:5a:d8:4b:4b:c0:5d:36:3a:00:ab:60:4b:c5:3a:8a:a9:19:a7:13:99:ea:9f:e4:0b:84:b7:2f:af:10

Digest Algorithm

sha256

PE Digest Matches

false

48:07:6b:60:1b:fc:1b:63:eb:2d:87:92:23:ad:76:9f:a1:44:d9:a1
Signer

Actual PE Digest

48:07:6b:60:1b:fc:1b:63:eb:2d:87:92:23:ad:76:9f:a1:44:d9:a1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiOpenDevRegKey
SetupOpenInfFileA
SetupCloseInfFile
SetupFindNextLine
SetupGetFieldCount
SetupGetStringFieldA
SetupFindFirstLineA
CM_Get_DevNode_Status_Ex
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList

kernel32

GlobalFlags
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
MoveFileA
GetThreadLocale
ReadFile
SetFilePointer
FlushFileBuffers
GetFullPathNameA
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetCurrentDirectoryA
GetProcessHeap
RaiseException
ExitProcess
HeapSize
GetACP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetDriveTypeA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
WritePrivateProfileStringA
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
GlobalFree
GlobalLock
GlobalUnlock
FormatMessageA
GetModuleHandleA
GetProcAddress
GetSystemDefaultLangID
GetUserDefaultLangID
SetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
Sleep
SetLastError
GetCurrentThread
GetCurrentProcess
GlobalAlloc
GetWindowsDirectoryA
lstrcatA
LoadLibraryA
GetFileSize
WriteFile
FreeLibrary
lstrlenA
CompareStringW
CompareStringA
LocalFree
LocalAlloc
CreateFileA
DeviceIoControl
CloseHandle
GetVersionExA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GetCommandLineA

user32

ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetDlgCtrlID
GetWindowRect
GetClassNameA
GetWindowTextA
SetWindowTextA
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
GetWindow
PtInRect
GetSystemMetrics
CharUpperA
wsprintfA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DestroyMenu
RealGetWindowClassA
GetDesktopWindow
PostMessageA
MessageBoxA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
PostQuitMessage
CheckMenuItem
EnableMenuItem
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
SendMessageA
ModifyMenuA

gdi32

DeleteDC
GetStockObject
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueExA
GetUserNameA
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupPrivilegeNameA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyA
RegEnumValueA
RegCloseKey
RegSetValueExA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

ChkAPOSupportDolbyPCEE4_DAA
ChkAPOSupportDolbyPCEE4_DHT
ChkBroadComID
ChkDellAlienwareModel
ChkDellControlinStartMenu
ChkDolbyPCEE4_SelectorDemoOnly_Supported
ChkDolbyPCEE4_SelectorEditorOnly_Supported
ChkDolbyPCEE4_SelectorOnly_Supported
ChkDolbyPCEE4_SetupPCEE4Prog_NoDemo
ChkDolbyPCEE4_SetupPCEE4Prog_NoEditor
ChkDolbyPCEE4_SetupPCEE4Prog_NoSelector
ChkHDMISupported
ChkLoadDrvPrivilege
ChkRtkCPLSupported
ChkRtkNewGUISupported
ChkRtkRegKeyEmpty_x64_CU
ChkRtkRegKeyEmpty_x64_LM
ChkRtkRegKeyEmpty_x86_CU
ChkRtkRegKeyEmpty_x86_LM
ChkSupportAPODTSAPOUltraPCBoost
ChkSupportAPOSupportSonceFocus30
ChkSupportAPOSupportSonceFocus30_NoSonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicMasterGUI
ChkSupportDolbySpruce
ChkSupportDolby_DS1_DAA
ChkSupportDolby_DS1_DHT
ChkSupportHP_AIO
ChkSupportHP_AIO_SonicFocusBeats
ChkSupportMaxxAudio30
ChkSupportMaxxVolumeSD
ChkSupportSoundRoom
Chk_AsusOnlySupportSonicRadar3
Chk_AudioMgrShortcutW81_Supported
Chk_DTSEntryLevelForSetupProgram
Chk_DolbyFlex3_UseDS1PCF
Chk_ExecuteDTSStudioSoundInstallers
Chk_GUISubType_RTGS_HP_BEATS_Supported
Chk_GUISubType_RTGS_HP_BEATS_TOWER_Supported
Chk_GUISubType_RTGS_HP_BanO_DTS_Supported
Chk_GUISubType_RTGS_HP_BanO_DTS_TOWER_Supported
Chk_GUISubType_RTGS_HP_BanO_Supported
Chk_GUISubType_RTGS_HP_BanO_TOWER_Supported
Chk_HP_AIO_Model_Customized01_Supported
Chk_HP_ShortcutFolderNameReq
Chk_MAXX_MA3TCelticUI_Supported
Chk_SRSAPO3Support
Chk_SRS_GUISubType_Supported
Chk_SRS_HPPremiumBlackSkin_RTGS_HPDTS_SOUND_Supported
Chk_SRS_HPPremiumBlackSkin_Supported
Chk_SSTEnableDTS
Chk_SSTEnableDolbyAX2
Chk_SetupDS1Prog_AddEditorShortcut
Chk_SupportDTSHPX
Chk_SupportDolbyDAX2
Chk_SupportNahimicAPO_Supported
Chk_SupportNahimicSonicRadar20_Supported
Chk_SupportSonicMapper2
Chk_SupportSonicMapper3
Chk_SupportYamahaAPO
Chk_SupportYamahaAPO2
Chk_VistaNoDoblyUI_Official_Supported
ConfirmRtkDrv
DelIncorrectUserFile
DrvInfVerCompare
ExtractBANG_OLUFSENIcon
ExtractBOPlayIcon
ExtractBeatsIcon
ExtractDTSIcon
ExtractHideWin
ExtractRtkIcon
ExtractSRSIcon
ExtractSetupService
GetAudioInterface
GetDrvPolicy
GetHDASubID
GetOSVersion
GetRtkHDAudioGlobalPolicy
GetRtkHDAudioGlobalPolicy_APODTSAPOUltraPCBoost_All
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30_SF3GUIType
GetRtkHDAudioGlobalPolicy_APOUseMaxx30
GetRtkHDAudioGlobalPolicy_APOUseMaxxVolumeSD
GetRtkHDAudioGlobalPolicy_HPAIOModel
GetRtkHDAudioGlobalPolicy_SonicFocusBeats
GetRtkHDAudioGlobalPolicy_SoundRoom
GetRtkHDAudioGlobalPolicy_SupDSpruce
HideISWizardWin
IdentifyDrvSupport
IsMediaCenterOS
IsServerOS
SetCDfmt
SetDSHWAcceleration_BasicLv

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f7ffb06514957b955f0e9a1ce93e4af

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5a:d2:f7:5a:d8:4b:4b:c0:5d:36:3a:00:ab:60:4b:c5:3a:8a:a9:19:a7:13:99:ea:9f:e4:0b:84:b7:2f:af:10Signer

48:07:6b:60:1b:fc:1b:63:eb:2d:87:92:23:ad:76:9f:a1:44:d9:a1Signer

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 163KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 28KB - Virtual size: 25KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:8f:52:fa:f6:4c:42:1e:ab:b2:27:5a:e1:48:c5:19
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5a:d2:f7:5a:d8:4b:4b:c0:5d:36:3a:00:ab:60:4b:c5:3a:8a:a9:19:a7:13:99:ea:9f:e4:0b:84:b7:2f:af:10
Signer

48:07:6b:60:1b:fc:1b:63:eb:2d:87:92:23:ad:76:9f:a1:44:d9:a1
Signer

.text
Size: 164KB - Virtual size: 163KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 28KB - Virtual size: 25KB