aa73e1d2292c1de04bb35904fba8bb1d0832a3cfa9d3145f6ac942163ab0e353

Sharing

Copy URL Twitter E-mail

General

Target

aa73e1d2292c1de04bb35904fba8bb1d0832a3cfa9d3145f6ac942163ab0e353
Size

2.4MB
MD5

2714bd0b1fd991e29975c25eaf7c6e8e
SHA1

c63acf51fdfd971e50174d2dab7adeb044f4d08b
SHA256

aa73e1d2292c1de04bb35904fba8bb1d0832a3cfa9d3145f6ac942163ab0e353
SHA512

6c2f5993f3d425786ecbcab91e04d0aa0e5aef738941cbdd551746cbc92a91c61a515906f8ff2da1a8360c59647a375e88bb9db39d0bba8dd6b33aa932cf7419
SSDEEP

49152:a3CPyJq/wWOm5Gl7Gmvkx+3EdPZtyMXasA0rU/V:a3CPyJq/wZCG4mcOEntyg

Score

1^/10

Malware Config

Signatures

Files

aa73e1d2292c1de04bb35904fba8bb1d0832a3cfa9d3145f6ac942163ab0e353
.exe windows:5 windows x86 arch:x86

ca1ec87dd8c11cfd0cca05d611fa29b4

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:d5:00:e7:6b:c2:bd:85:65:bf:15:60:11:5b:cf:fe
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

26/09/2023, 00:00

Not After

13/03/2024, 23:59

Subject

SERIALNUMBER=91440300MA5G63CT5C,CN=Shenzhen Kaixin Kangaroo Technology Co.\, Ltd.,O=Shenzhen Kaixin Kangaroo Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b7b1e59cb3e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:63:94:64:76:b0:30:66:3f:a6:98:03:3e:f6:6e:c9:0b:fc:35:54:fd:9a:7a:90:fa:45:cd:76:ab:7e:5c:2f
Signer

Actual PE Digest

2d:63:94:64:76:b0:30:66:3f:a6:98:03:3e:f6:6e:c9:0b:fc:35:54:fd:9a:7a:90:fa:45:cd:76:ab:7e:5c:2f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
GetModuleHandleW
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
RaiseException
GetLastError
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
InterlockedDecrement
SizeofResource
GetCurrentProcessId
DeleteCriticalSection
CreateThread
SetEvent
Sleep
CreateEventW
GetThreadTimes
GetVersionExW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetLongPathNameW
GetExitCodeProcess
WriteFile
GetTickCount
GetTempPathW
CreateFileW
GetFileAttributesW
DeleteFileW
CopyFileW
HeapReAlloc
HeapSize
GetFileSize
ReadFile
WideCharToMultiByte
FindClose
FileTimeToSystemTime
lstrcpyW
FindFirstFileW
FindNextFileW
MoveFileExW
GetPrivateProfileIntW
LoadLibraryW
GetEnvironmentVariableW
GetSystemDirectoryW
CreateDirectoryW
WTSGetActiveConsoleSessionId
LocalFree
GetSystemInfo
WaitForSingleObject
GetVolumeInformationW
ReleaseMutex
CreateMutexW
GlobalAlloc
GlobalFree
LocalAlloc
OpenProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadProcessMemory
FindResourceW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetCurrentThread
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
FlushFileBuffers
GetConsoleCP
WriteConsoleW
SetEndOfFile
GetFullPathNameW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MapViewOfFile
CloseHandle
FlushViewOfFile
UnmapViewOfFile
OpenFileMappingW
IsBadReadPtr
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
ExitThread
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
LoadResource
VirtualFree
SetLastError
HeapFree
VirtualProtect
GetPrivateProfileStringW
WritePrivateProfileStringW
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
FormatMessageA

user32

wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
CharNextW

advapi32

OpenProcessToken
RegisterEventSourceW
DeregisterEventSource
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyW
RegEnumKeyW
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
ReportEventW
ImpersonateLoggedOnUser
RevertToSelf
RegQueryValueExW
RegCreateKeyExW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW

ole32

CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoUninitialize
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW
PathAddBackslashW

wtsapi32

WTSQueryUserToken

shell32

SHGetSpecialFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wininet

InternetOpenW
HttpQueryInfoW
InternetQueryOptionW
InternetCloseHandle
InternetSetOptionW
InternetOpenUrlW
InternetReadFile

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301

ws2_32

recv
WSACleanup
WSAStartup
send
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
bind
closesocket
connect
getpeername
gethostname
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
listen
accept
ioctlsocket

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 530KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca1ec87dd8c11cfd0cca05d611fa29b4

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:d5:00:e7:6b:c2:bd:85:65:bf:15:60:11:5b:cf:feCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

2d:63:94:64:76:b0:30:66:3f:a6:98:03:3e:f6:6e:c9:0b:fc:35:54:fd:9a:7a:90:fa:45:cd:76:ab:7e:5c:2fSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

shell32

userenv

wininet

wldap32

ws2_32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 530KB - Virtual size: 530KB

.data Size: 20KB - Virtual size: 46KB

.gfids Size: 512B - Virtual size: 512B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 171KB - Virtual size: 170KB

.reloc Size: 78KB - Virtual size: 78KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:d5:00:e7:6b:c2:bd:85:65:bf:15:60:11:5b:cf:fe
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

2d:63:94:64:76:b0:30:66:3f:a6:98:03:3e:f6:6e:c9:0b:fc:35:54:fd:9a:7a:90:fa:45:cd:76:ab:7e:5c:2f
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 530KB - Virtual size: 530KB

.data
Size: 20KB - Virtual size: 46KB

.gfids
Size: 512B - Virtual size: 512B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 171KB - Virtual size: 170KB

.reloc
Size: 78KB - Virtual size: 78KB