5_MedicationRoy[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5_MedicationRoy.exe
Size 1.1MB
Sample240214-phmynsbc28
SHA256 a12adcef2a153e0926843befaad18c7378d8d1b698400c51a69b229f99979d54
MD5 56de3f4de890ed5d08ee23d162ccb5b3
SHA1 f945339ba02aef28ac7fcedf922081fe5507b397
SHA512 91b25346a237d41b7a85f31bb31f081346afc682647611169f5769a74d2df6a317585b5589a566fb3afe6a82469286149bb4174ab962507e5405aa2a0b50b092
SSDEEP 24576:lzCmT/4sKowJXrP+garXNKZQCawrKdIQZgMCNBypVD1yX36G7fbZcK:lzbT/dw7kXaawrMIQZgMC/yv1S36G7Ff
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

5_MedicationRoy.exe

.exe 1.1MB

5_MedicationRoy.exe

IMPHASH 36603b42a93421cfa64e8207b9ee7696
SHA256 a12adcef2a153e0926843befaad18c7378d8d1b698400c51a69b229f99979d54
MD5 56de3f4de890ed5d08ee23d162ccb5b3
SHA1 f945339ba02aef28ac7fcedf922081fe5507b397
SHA512 91b25346a237d41b7a85f31bb31f081346afc682647611169f5769a74d2df6a317585b5589a566fb3afe6a82469286149bb4174ab962507e5405aa2a0b50b092
SSDEEP 24576:lzCmT/4sKowJXrP+garXNKZQCawrKdIQZgMCNBypVD1yX36G7fbZcK:lzbT/dw7kXaawrMIQZgMC/yv1S36G7Ff
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

fe:3b:a4:c3:c2:0a:5b:d3:2e:64:35:5d:57:8a:59:3f:6f:f4:fd:53:79:89:3f:49:ff:44:00:0b:ab:24:d8:35

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

Chains

Jan 12, 2024

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

c8:41:99:0c:00:f0:67:bd:07:a5:e6:39:cb:45:18:14:70:e9:a8:1c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

Chains

Jan 12, 2024

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

Serial Number

02:f0:38:12:5d:ed:80:34:87:02:59:90:76:a4:26:77

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2023 - Mar 24, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=HITPAW CO.\, LIMITED,O=HITPAW CO.\, LIMITED,L=Sheung Wan,C=HK

Serial Number

02:f0:38:12:5d:ed:80:34:87:02:59:90:76:a4:26:77

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2023 - Mar 24, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

118013

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

SetLastError GetDiskFreeSpaceExW SetFileAttributesW GetLocalTime SystemTimeToFileTime CreateThread GetExitCodeThread Sleep GetCurrentDirectoryW SetCurrentDirectoryW GetTempPathW GetFileAttributesW MultiByteToWideChar WideCharToMultiByte FindFirstFileW FindClose CompareFileTime CreateDirectoryW ExpandEnvironmentStringsW lstrlenA WriteFile GetStdHandle lstrcmpW GetSystemTimeAsFileTime DeleteFileW FindNextFileW RemoveDirectoryW GetModuleHandleW lstrcmpiA LoadLibraryA SetThreadLocale GetEnvironmentVariableW FindResourceExA SizeofResource LoadResource LockResource MulDiv GlobalAlloc GlobalFree GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDefaultLCID lstrcmpiW GetLocaleInfoW SetEnvironmentVariableW GetVersionExW GetModuleFileNameW SetProcessWorkingSetSize GetCurrentProcess GetDriveTypeW CreateFileW CreateEventW SetEvent ResetEvent InitializeCriticalSection GetCurrentThreadId GetSystemDirectoryW SuspendThread TerminateThread IsBadReadPtr GetProcAddress lstrcpyW LocalFree DeleteCriticalSection EnterCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc GetFileSize SetFilePointer ReadFile SetFileTime SetEndOfFile GetFileInformationByHandle WaitForMultipleObjects DecodePointer EncodePointer ExitThread HeapFree HeapAlloc HeapReAlloc GetCommandLineA HeapSetInformation RaiseException HeapSize ExitProcess IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess InitializeCriticalSectionAndSpinCount HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId LoadLibraryW RtlUnwind GetStringTypeW LCMapStringW GetExitCodeProcess CloseHandle WaitForSingleObject GetQueuedCompletionStatus ResumeThread SetInformationJobObject CreateIoCompletionPort AssignProcessToJobObject CreateJobObjectW GetLastError CreateProcessW GetStartupInfoW GetCommandLineW lstrlenW GetTickCount FormatMessageW

user32

GetClientRect GetSystemMetrics PtInRect CallNextHookEx SetWindowsHookExW SetWindowLongW UnhookWindowsHookEx SetFocus SystemParametersInfoW LoadIconW LoadImageW GetWindow GetDC DrawTextW ClientToScreen DialogBoxIndirectParamW MessageBeep DefWindowProcW CallWindowProcW DrawIconEx GetSystemMenu GetDlgItem EnableWindow CreateWindowExA wvsprintfW GetWindowTextW GetWindowTextLengthW KillTimer DispatchMessageW GetMessageW SetTimer SetWindowPos GetDesktopWindow GetWindowRect CreateWindowExW CharUpperW wsprintfW SendMessageW BringWindowToTop ShowWindow EndDialog IsWindow GetKeyState MessageBoxA wsprintfA CopyImage ReleaseDC GetSysColor GetWindowDC DestroyWindow GetMenu GetWindowLongW GetClassNameA SetWindowTextW ScreenToClient EnableMenuItem GetParent

gdi32

SetStretchBltMode StretchBlt CreateCompatibleBitmap DeleteDC CreateFontIndirectW DeleteObject SelectObject CreateCompatibleDC GetObjectW GetCurrentObject GetDeviceCaps

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW SHGetMalloc

ole32

CoInitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

OleLoadPicture SysAllocString SysAllocStringLen VariantClear SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

5_MedicationRoy.exe

PE Signature issue

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic