5871e8ec0525f7850cb608382a5f30b4

Sharing

Copy URL Twitter E-mail

General

Target
5871e8ec0525f7850cb608382a5f30b4
Size 1.3MB
Sample240409-1yrscadf46
SHA256 8aca56991f81e3d4ed9da29b87d8e7109a4017d9c35b44fd4d24885c3666bfef
MD5 5871e8ec0525f7850cb608382a5f30b4
SHA1 acef833944d86a6f0560519831a36be76514dbca
SHA512 fe3e3a8b5f073935cb17762ba56bc2030f5de235ab5d5ac78f57ef71c744231045db5657d2261a03b6858fed07d08e9bfe4c84d19bae9ae55d525640b0290160
SSDEEP 12288:GsFxpE2JExvhVP3dUQJJp2tCKIPJuWRXNdMTNHWsSPtWKHEpr7MfJq+/l4U4UsUR:Gc2hJuCXPMhH/iGprAfJTJNXqfZb2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

5871e8ec0525f7850cb608382a5f30b4

.exe 1.3MB

5871e8ec0525f7850cb608382a5f30b4

IMPHASH 5be5c0729ba1156c48a7f08a7314848c
SHA256 8aca56991f81e3d4ed9da29b87d8e7109a4017d9c35b44fd4d24885c3666bfef
MD5 5871e8ec0525f7850cb608382a5f30b4
SHA1 acef833944d86a6f0560519831a36be76514dbca
SHA512 fe3e3a8b5f073935cb17762ba56bc2030f5de235ab5d5ac78f57ef71c744231045db5657d2261a03b6858fed07d08e9bfe4c84d19bae9ae55d525640b0290160
SSDEEP 12288:GsFxpE2JExvhVP3dUQJJp2tCKIPJuWRXNdMTNHWsSPtWKHEpr7MfJq+/l4U4UsUR:Gc2hJuCXPMhH/iGprAfJTJNXqfZb2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

76:a2:fa:ca:45:c4:f4:8b:c2:93:fb:57:f5:d1:ad:dc:8e:b6:bc:75:1b:cf:3c:56:79:9d:11:39:4d:88:bb:6c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

Chains

Nov 27, 2023

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,ST=Ontario,C=CA

Serial Number

a6:25:99:b7:3b:8e:19:8d:7a:ba:99:1a:a1:a9:bf:3e

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 29, 2023 - Mar 28, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

17381

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Users\Administrator\Desktop\免杀工具38的\PayloadInResources\none

kernel32

GetModuleFileNameA FindResourceA LoadResource SizeofResource LockResource GetCurrentProcessId OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread CloseHandle WaitForSingleObject WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CompareStringEx MultiByteToWideChar GetCPInfo WideCharToMultiByte LCMapStringEx FormatMessageA GetLocaleInfoEx GetStringTypeW LocalFree RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCurrentThread HeapFree HeapReAlloc HeapAlloc OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler GetTimeZoneInformation HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW RtlUnwind

Name

.text

Size

937KB

Virtual Size

936KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

memcpy_

Size

1024B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

863B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5871e8ec0525f7850cb608382a5f30b4

PE Signature issue

kernel32

generic