360zip_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
360zip_setup.exe
Size 14.4MB
Sample240302-qf8yssdf8y
SHA256 1e131acb8cbb1b033ae3dec6fcadd06127f37adb3bbaa96cf75cd7096aa5ee1e
MD5 13a651e07ec6db6937ba357c4e6e9af1
SHA1 0debe97109960ec4f428a2e68278340314351425
SHA512 0746ff003be2ef5ff1dd15dc19200e85e53798cd7338e8816c4ae0ae098e6571b65767d7ddd8b2bd7e83d18abeffd84303d0d437d3c05302cd65c4a93559e129
SSDEEP 393216:VLzjWQzeJD4bIPJpfp9c1EYBtF5kOF1C8p5isT:5zjWQ6OM18FueIQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

360zip_setup.exe

.exe 14.4MB

360zip_setup.exe

IMPHASH ba8401543c8d512fc26ab0a2ad55cc9f
SHA256 1e131acb8cbb1b033ae3dec6fcadd06127f37adb3bbaa96cf75cd7096aa5ee1e
MD5 13a651e07ec6db6937ba357c4e6e9af1
SHA1 0debe97109960ec4f428a2e68278340314351425
SHA512 0746ff003be2ef5ff1dd15dc19200e85e53798cd7338e8816c4ae0ae098e6571b65767d7ddd8b2bd7e83d18abeffd84303d0d437d3c05302cd65c4a93559e129
SSDEEP 393216:VLzjWQzeJD4bIPJpfp9c1EYBtF5kOF1C8p5isT:5zjWQ6OM18FueIQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

62:b1:a3:7a:00:30:5f:7f:c2:da:b6:5e:96:50:27:e2:f5:59:c0:50:e4:32:1e:8b:b5:ad:00:9a:02:af:28:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 27, 2023

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

421442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\pack_node_prod\TemporarySource\daanquanyewuxian\360yasuo\release\1200-360yasuo-kong-20230327182840-\src\install\bin\Release\Installer.pdb

kernel32

GetFileSize WritePrivateProfileStringW GetPrivateProfileStringW MoveFileW GetVolumeInformationW CreateDirectoryW GetSystemDirectoryW SetFileTime GetShortPathNameW GetFullPathNameW SearchPathW GetTempFileNameW FindCloseChangeNotification FindFirstChangeNotificationW GetLogicalDriveStringsW GetFileInformationByHandle GetStdHandle CompareFileTime FileTimeToSystemTime WaitForMultipleObjects GetSystemWindowsDirectoryW GetCurrentThread GetThreadSelectorEntry GetThreadContext VirtualQuery SetThreadPriority VirtualAlloc OpenThread GetSystemInfo GetThreadPriority VirtualProtect SuspendThread GetFileSizeEx WriteFile LoadLibraryExW FreeResource InterlockedCompareExchange SystemTimeToFileTime GetSystemTime WideCharToMultiByte InterlockedIncrement CreateMutexW SetEndOfFile SetEnvironmentVariableA GetTimeZoneInformation GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA Process32NextW QueryPerformanceCounter GetWindowsDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA SetHandleCount InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler FatalAppExitA HeapCreate IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetStringTypeW LCMapStringW LCMapStringA CompareStringW SetFilePointer CompareStringA RtlUnwind GetStartupInfoW GetFileType WriteConsoleW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitThread SetWaitableTimer CreateWaitableTimerW CancelWaitableTimer lstrcmpiA lstrcmpA CreateThread ExpandEnvironmentStringsW GetProcessTimes DuplicateHandle SetErrorMode FileTimeToLocalFileTime GetFileTime ExitProcess OpenProcess CopyFileW TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW GetAtomNameW TlsSetValue TlsGetValue GetLocalTime Process32FirstW CreateToolhelp32Snapshot FindClose FindNextFileW FindFirstFileW lstrlenA ResetEvent SetEvent GlobalAlloc ResumeThread GlobalFree MulDiv GlobalUnlock GlobalLock CreateEventW GetCurrentProcessId DeviceIoControl LoadLibraryA GetSystemDirectoryA DeleteCriticalSection InitializeCriticalSection lstrcmpiW GetTimeFormatA InterlockedDecrement GetLastError SetLastError GetDiskFreeSpaceExW GetExitCodeThread RemoveDirectoryW Sleep RaiseException TerminateProcess GetCurrentThreadId FlushInstructionCache GetTickCount EnterCriticalSection LeaveCriticalSection MultiByteToWideChar lstrlenW lstrcpynW CreateFileW LocalAlloc LocalFree DeleteFileW MoveFileExW SetFileAttributesW GetFileAttributesW GetTempPathW GetVersionExW GetCurrentProcess GetModuleHandleW GetPrivateProfileIntW GetExitCodeProcess WaitForSingleObject CloseHandle CreateProcessW FreeLibrary FormatMessageW OutputDebugStringW SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime CreateFileA InterlockedExchange VirtualFree IsProcessorFeaturePresent GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetCPInfo ReadFile LoadLibraryW GetProcAddress GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetCommandLineW GetModuleHandleA

user32

MonitorFromPoint SetClipboardData EmptyClipboard CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable UnregisterClassA SetTimer LoadCursorW ShowWindow GetDlgItem SetWindowTextW EnableWindow MapWindowPoints FindWindowExW GetForegroundWindow MapVirtualKeyW GetKeyNameTextW GetWindowRect KillTimer InvalidateRect SetWindowLongW GetDesktopWindow GetMessageW SetDlgItemTextW PostThreadMessageW PostMessageW PostQuitMessage SetWindowPos EndPaint GetWindowTextW GetClientRect GetWindowLongW SubtractRect GetWindowThreadProcessId SendMessageW BeginPaint wsprintfW GetWindowDC GetActiveWindow CharToOemW AttachThreadInput GetUpdateRect ReleaseDC SetRect GetWindow MonitorFromWindow GetMonitorInfoW LoadImageW GetWindowTextLengthW ReleaseCapture GetDlgCtrlID SystemParametersInfoW SetCapture CreateDialogParamW CallWindowProcW SetCursor GetDC PtInRect ClientToScreen GetCapture UpdateWindow DrawFocusRect GetSystemMetrics InflateRect DrawEdge GetSysColor IsWindowEnabled OffsetRect FillRect DrawTextW MessageBoxW PeekMessageW TranslateMessage DispatchMessageW CharNextW DefWindowProcW BringWindowToTop SetForegroundWindow FindWindowW CharLowerBuffW SetWindowRgn GetParent AdjustWindowRectEx GetMenu DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW IsWindow RedrawWindow IsIconic CopyRect

gdi32

OffsetViewportOrgEx CreatePatternBrush CreateDIBPatternBrushPt CreateFontW GetDeviceCaps CreateSolidBrush GetCurrentObject CreateDIBSection StretchBlt SetTextColor CreatePolygonRgn CreateFontIndirectW GetObjectW GetStockObject SetViewportOrgEx BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteObject DeleteDC SelectObject SetBkMode GetBitmapBits

advapi32

GetAce RegGetKeySecurity GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority RegQueryValueExA GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW GetUserNameW OpenThreadToken OpenProcessToken GetTokenInformation GetAclInformation AddAce InitializeAcl EqualSid IsValidSid GetLengthSid CopySid RegEnumValueW BuildExplicitAccessWithNameW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW ConvertSidToStringSidW LookupAccountNameW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid RegSetKeySecurity

shell32

CommandLineToArgvW SHGetSpecialFolderPathA ShellExecuteW SHFileOperationW SHFreeNameMappings SHAppBarMessage SHGetSpecialFolderLocation ord165 SHGetFileInfoW SHGetPathFromIDListW SHChangeNotify SHGetSpecialFolderPathW SHBrowseForFolderW

ole32

CreateStreamOnHGlobal CoUninitialize CoInitialize OleInitialize CoCreateGuid CoInitializeEx CoInitializeSecurity CoSetProxyBlanket OleUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

SysAllocString VarUI4FromStr SysFreeString OleLoadPicture SysAllocStringByteLen VariantClear VariantCopy VariantInit

shlwapi

PathIsURLW StrToIntExW PathGetDriveNumberW PathFileExistsW PathIsRootW PathFindExtensionW StrStrW SHGetValueW StrStrIW PathIsPrefixW SHGetValueA PathFileExistsA StrCmpIW PathAppendA PathCombineA StrStrIA PathIsDirectoryW SHDeleteKeyW SHSetValueW PathRemoveArgsW PathUnquoteSpacesW PathAppendW PathCombineW PathRemoveFileSpecW

comctl32

ImageList_SetImageCount ImageList_Add ImageList_GetIconSize ImageList_Create _TrackMouseEvent ImageList_Destroy ImageList_Draw InitCommonControlsEx ImageList_Duplicate ImageList_Remove

msimg32

AlphaBlend

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

secur32

GetUserNameExW

setupapi

SetupIterateCabinetW

wintrust

CryptCATAdminAcquireContext WTHelperProvDataFromStateData CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext

crypt32

CertGetNameStringW

userenv

UnloadUserProfile

wininet

InternetOpenW FtpGetFileSize HttpQueryInfoW HttpSendRequestExW HttpOpenRequestW InternetSetOptionA InternetConnectW InternetSetStatusCallbackW InternetReadFile InternetReadFileExA FtpOpenFileW HttpEndRequestW InternetWriteFile FtpCommandW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetCrackUrlW CreateUrlCacheEntryW GetUrlCacheEntryInfoW CommitUrlCacheEntryW InternetCloseHandle InternetOpenUrlW

urlmon

ObtainUserAgentString

netapi32

Netbios

psapi

EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW GetProcessMemoryInfo EnumProcesses

comdlg32

GetSaveFileNameW GetOpenFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

360zip_setup.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

secur32

setupapi

wintrust

crypt32

userenv

wininet

urlmon

netapi32

psapi

comdlg32

generic