f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d

Sharing

Copy URL Twitter E-mail

General

Target
f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d
Size 1.1MB
Sample240302-s34npsfa63
SHA256 f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d
MD5 0e4a18801f37f73a8ad0dc9ef8fa89b0
SHA1 08bc496984750ee1ab3b15e10df10ef7eef01227
SHA512 4ec3c00cb932729e4122f42a41e08ada20773d37b54a47b79bc1d96f65d636741e48eb5e8d2f972af127f0b14f7a1f8932a7e81b923c43b46f718018b6c8919b
SSDEEP 24576:V2mj42MEVQPGEorkSYxuX/qDkbSrh/qtoT/cgB8SnLZrEH7x:xjnMEVQuFkS1ukurNqtoTkgCSnG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d

.dll 1.1MB

f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d

IMPHASH 42dd31ca86c177758d73ef96895182f6
SHA256 f0191acd3b8eaebba0a3281e8eaa6a2f547b20379bddee154439d1ee6b68617d
MD5 0e4a18801f37f73a8ad0dc9ef8fa89b0
SHA1 08bc496984750ee1ab3b15e10df10ef7eef01227
SHA512 4ec3c00cb932729e4122f42a41e08ada20773d37b54a47b79bc1d96f65d636741e48eb5e8d2f972af127f0b14f7a1f8932a7e81b923c43b46f718018b6c8919b
SSDEEP 24576:V2mj42MEVQPGEorkSYxuX/qDkbSrh/qtoT/cgB8SnLZrEH7x:xjnMEVQuFkS1ukurNqtoTkgCSnG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ba:df:ca:9b:30:55:e9:51:32:27:c2:ba:6a:52:49:78:c5:f9:f5:5b:8f:e8:3d:a3:99:1c:f8:4b:03:b9:b8:a9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 24, 2023

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

466445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\719743\out\Release\360Base.pdb

kernel32

DeleteCriticalSection GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW InterlockedDecrement InterlockedIncrement GetCurrentProcessId ReadFile InterlockedCompareExchange SetFilePointer FreeLibraryAndExitThread HeapSize GetPrivateProfileStringW LockResource FindResourceExW HeapDestroy GetProcessHeap GetCurrentProcess GetSystemWindowsDirectoryW GetVersionExW FreeResource SetFilePointerEx GetFileSizeEx CreateFileMappingW MapViewOfFileEx UnmapViewOfFile lstrcmpA LocalFree GetFileSize WriteFile GetLocalTime GetCurrentThreadId FlushFileBuffers SystemTimeToFileTime FindFirstFileW FindNextFileW FindClose DeleteFileW FileTimeToLocalFileTime FileTimeToSystemTime GetFileAttributesExW MoveFileExW QueryPerformanceCounter LockFileEx UnlockFileEx MapViewOfFile GetModuleHandleExW CreateThread GetFileType ReleaseMutex GetACP lstrlenA LocalFileTimeToFileTime InterlockedExchange MultiByteToWideChar GetUserDefaultLCID LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary VirtualProtect GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemInfo TerminateProcess Sleep CreateMutexW WaitForSingleObject InitializeCriticalSectionAndSpinCount GetLocaleInfoW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage CreateFileW FindNextFileA FindFirstFileExA SetStdHandle GetConsoleCP GetConsoleMode EnumSystemLocalesW IsValidLocale GetModuleFileNameA ExitProcess InterlockedFlushSList RtlUnwind OpenThread HeapWalk HeapUnlock HeapLock CreateFileA InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcatA GlobalMemoryStatus LoadLibraryA GetSystemDirectoryA GetModuleHandleA GetStdHandle GetCPInfo GetStringTypeW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread OutputDebugStringW IsDebuggerPresent InitializeCriticalSection GetTickCount WideCharToMultiByte LeaveCriticalSection EnterCriticalSection DeviceIoControl HeapFree HeapReAlloc HeapAlloc SetErrorMode SetLastError GetLastError RaiseException CloseHandle GetFileAttributesW lstrcmpiA

user32

MessageBoxA CharNextW GetProcessWindowStation GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW GetTokenInformation OpenProcessToken CryptReleaseContext CryptGenRandom CryptAcquireContextW ConvertStringSecurityDescriptorToSecurityDescriptorW RegisterEventSourceA

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoCreateInstance CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysAllocString VarUI4FromStr

shlwapi

SHGetValueA PathFindFileNameW StrRChrW PathCombineW PathAppendW StrTrimA PathFileExistsW SHGetValueW PathRemoveFileSpecW StrCmpIW StrCmpNIW StrStrIW StrStrIA PathAddBackslashW SHSetValueA SHSetValueW

version

VerQueryValueW GetFileVersionInfoSizeW

crypt32

CryptMsgControl CertFindCertificateInStore CryptQueryObject CertFreeCertificateContext CertGetCertificateContextProperty CertGetNameStringW CryptDecodeObjectEx CryptDecodeObject CertGetCertificateChain CertAddStoreToCollection CertOpenStore CertCloseStore CertOpenSystemStoreW CryptMsgGetParam CryptMsgClose CryptMsgUpdate CertFreeCertificateChain CryptMsgOpenToDecode

iphlpapi

GetAdaptersInfo

generic

count=17, id=241, version=40116,

count=166, id=243, version=40116,

count=30, id=242, version=40116,

count=10, id=260, productName=VS2017 v15.4.5 build 25547, version=25547,

count=3, id=261, version=27045,

count=9, id=260, version=27045,

count=9, id=260, productName=VS2017 v15.5.2 build 25831, version=25831,

count=7, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=199, version=41118,

count=24, id=259, version=26706,

count=9, productName=Unmarked objects (old),

count=247, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=33, id=260, version=26706,

count=60, id=261, version=26706,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=319, id=1, productName=Unmarked objects,

count=1, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,

count=61, id=265, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,