73f27839453a62fb155d59906863550d[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

73f27839453a62fb155d59906863550d.bin
Size

55.5MB
MD5

9ce29cfaab9f33291d1dc4c226ebd92c
SHA1

8ebc7ae4718e668a0364f512ab39967fdda3132d
SHA256

ba7403d4635fefb7919e21ffec960eae354768c0cad2f20a3f70f77358b206c7
SHA512

9a39e56baed992d26f9941b94f76ee71567368a764a143530495426a305a6045844e1a85a6b3bf7c9575cf7368c20943832007c6d72d3d6d19a48d197cfd2483
SSDEEP

786432:By/D57lwv77zSp/+Z/tALjbIaU8fRM3Fk6yJMr+G6rN7+85kY2USkgTAOwV+zDq2:E96ALjbHU8f0FPZr+9RkLJAOa0k0aWL

Score

1^/10

Malware Config

Signatures

Files

73f27839453a62fb155d59906863550d.bin
.zip

Password: infected
14f570dc8b296106bee56861d4b1edbccf975dc60bb45d9676f2815c48940c8b.exe
.exe windows:6 windows x86 arch:x86

Password: infected

6bbc4ee11bdaad81fa3b78171481d7ba

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:43:56:70:23:b6:5a:b6:a8:26:bb:d4:76:cf:c5:70
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/11/2022, 00:00

Not After

26/08/2025, 23:59

Subject

SERIALNUMBER=91510100MA7EUJ0408,CN=Chengdu Aishang Office Technology Co.\, Ltd.,OU=R&D department,O=Chengdu Aishang Office Technology Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c12e59b9be5b79de5a4a9e5ba9ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:9c:7e:f8:1b:ff:1b:bd:94:bb:bb:6a:99:67:85:1e:4b:e9:ab:c5:39:bb:af:8d:12:7a:01:0a:53:39:71:f1
Signer

Actual PE Digest

f1:9c:7e:f8:1b:ff:1b:bd:94:bb:bb:6a:99:67:85:1e:4b:e9:ab:c5:39:bb:af:8d:12:7a:01:0a:53:39:71:f1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\work\capture\ScreenRecorder\rel\Win32\Setup.pdb

Imports

kernel32

MultiByteToWideChar
WritePrivateProfileStringW
lstrcmpiW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetVersion
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
WriteConsoleW
FlushFileBuffers
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetConsoleCtrlHandler
GetConsoleOutputCP
SetStdHandle
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
GetStdHandle
ExitProcess
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLocaleInfoEx
LCMapStringEx
GetCPInfo
CompareStringEx
FormatMessageA
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
GetLastError
RaiseException
DecodePointer
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
OpenEventW
LocalAlloc
GetStartupInfoW
CreatePipe
CopyFileW
CreateDirectoryW
MoveFileW
CreateThread
GetPrivateProfileIntW
GetFileTime
SetFileTime
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetVersionExW
WideCharToMultiByte
GetPrivateProfileStringW
SystemTimeToFileTime
LocalFileTimeToFileTime
GetComputerNameW
GetTickCount
GetSystemTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
K32GetModuleFileNameExW
K32EnumProcessModules
TerminateProcess
Thread32First
Thread32Next
GetCurrentProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
ReadProcessMemory
LoadLibraryW
lstrcpyW
lstrlenW
GetProcessId
Module32FirstW
Module32NextW
GlobalAlloc
GlobalFree
lstrcmpA
WTSGetActiveConsoleSessionId
GetThreadLocale
SetThreadLocale
DeleteFileW
Sleep
CreateFileW
DeviceIoControl
GetSystemInfo
GetWindowsDirectoryW
GetSystemDirectoryW
GetEnvironmentVariableW
GetTempPathW
LocalFree
GlobalLock
GlobalUnlock
GetFileSize
ReadFile
WriteFile
SetFilePointer
GetFileAttributesExW
OutputDebugStringW
FileTimeToSystemTime
lstrlenA
SetFileAttributesW
MoveFileExW
lstrcpynA
InitializeCriticalSection
FlushViewOfFile
UnmapViewOfFile
SetEndOfFile
CreateFileMappingW
MapViewOfFile
GetFileSizeEx
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetLongPathNameW
IsBadReadPtr
GetDriveTypeW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetNativeSystemInfo
ResetEvent
SetEvent
PostQueuedCompletionStatus
GetExitCodeThread
TerminateThread
CreateEventW
CreateIoCompletionPort
GetQueuedCompletionStatus
SetErrorMode
FreeResource
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleA
GetCurrentProcessId
MulDiv
GetTempFileNameW
CreateFileA

user32

TranslateMessage
GetMessageW
MessageBoxW
GetMonitorInfoW
MonitorFromWindow
LoadIconW
GetWindow
GetParent
wsprintfW
GetWindowThreadProcessId
MapWindowPoints
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SetActiveWindow
FindWindowW
FindWindowExW
SetFocus
WaitForInputIdle
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
CharLowerBuffW
PostMessageW
SetRectEmpty
EqualRect
SetCursor
ClientToScreen
GetCursorPos
PtInRect
ScreenToClient
GetDoubleClickTime
CopyRect
IntersectRect
DrawTextW
GetDC
ReleaseDC
LoadImageW
IsRectEmpty
GetIconInfo
DrawIconEx
DispatchMessageW
SystemParametersInfoW
BeginPaint
EndPaint
IsIconic
InvalidateRect
TrackMouseEvent
SetCapture
ReleaseCapture
SetWindowRgn
EnableWindow
GetWindowTextW
IsWindowVisible
IsZoomed
MonitorFromRect
OffsetRect
SetLayeredWindowAttributes
SetWindowTextW
GetWindowTextLengthW
GetFocus
MonitorFromPoint
UpdateLayeredWindow
UpdateWindow
PeekMessageW
GetWindowRect
GetClientRect
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
PostQuitMessage
SendMessageW
LoadCursorW
SetWindowLongW
GetWindowLongW
KillTimer
SetTimer
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
FillRect
CharNextW
GetForegroundWindow

advapi32

RegNotifyChangeKeyValue
RegOpenKeyW
RegCreateKeyW
RegSetValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegEnumKeyW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetSidSubAuthorityCount
DuplicateTokenEx
CreateProcessAsUserW
OpenSCManagerW
EnumServicesStatusExW
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
DeleteService
ControlService
ChangeServiceConfigW
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
CreateServiceW
StartServiceW
OpenServiceW
AccessCheck
MapGenericMask
DuplicateToken
GetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountNameW
GetUserNameW
GetUserNameA
LookupAccountNameA
GetSidIdentifierAuthority
IsValidSid
SetTokenInformation
RegConnectRegistryW
GetLengthSid
RegQueryValueExW

shell32

SHChangeNotify
ShellExecuteExW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ord165
SHGetFolderPathW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderLocation
CommandLineToArgvW

ole32

CoInitializeSecurity
CoCreateGuid
CoInitializeEx
CoSetProxyBlanket
CreateStreamOnHGlobal
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
OleRun

oleaut32

SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VariantCopy
VariantClear
VariantInit
SysAllocString
GetErrorInfo
VarUI4FromStr
SysAllocStringLen
VariantChangeType
VarDateFromStr
SystemTimeToVariantTime
SetErrorInfo
LoadRegTypeLi
VariantTimeToSystemTime
LoadTypeLi
SysStringLen
SysFreeString
CreateErrorInfo

shlwapi

StrCpyNW
PathIsRootW
PathCombineW
PathCanonicalizeW
PathRemoveBackslashW
PathIsPrefixW
PathCommonPrefixW
PathRelativePathToW
StrFormatByteSizeW
PathAddBackslashW
StrCmpIW
PathFileExistsW
StrToIntExW
PathSearchAndQualifyW
PathRemoveExtensionW
PathFindFileNameW
PathRemoveFileSpecW
ord176
AssocQueryStringW
SHDeleteKeyW
SHSetValueW
SHDeleteValueW
UrlGetPartW
PathAppendW
PathIsDirectoryW
SHGetValueW

comctl32

ord17
InitCommonControlsEx

msimg32

AlphaBlend

crypt32

CryptBinaryToStringW
CryptStringToBinaryA
CryptStringToBinaryW
CertGetNameStringW
CryptBinaryToStringA

gdiplus

GdipSetStringFormatAlign
GdipCreateHBITMAPFromBitmap
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDrawString
GdipMeasureString
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdiplusStartup
GdipDeleteStringFormat
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipCreateStringFormat
GdipCloneBrush
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipDeleteBrush
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipSetStringFormatLineAlign
GdipFree

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetOpenW
InternetSetOptionW
InternetConnectW
InternetReadFile
InternetSetFilePointer
InternetCloseHandle
InternetQueryOptionW
HttpSendRequestW
HttpOpenRequestW

dbghelp

ImageDirectoryEntryToData
ImageNtHeader

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

Netbios

iphlpapi

GetIpAddrTable
GetAdaptersInfo

secur32

GetUserNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wintrust

CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
WinVerifyTrust

gdi32

GetObjectW
DeleteObject
CreateDIBSection
CreateCompatibleDC
SelectObject
SetTextColor
SetBkMode
SetPixel
BitBlt
DeleteDC
SetStretchBltMode
StretchBlt
GetBitmapBits
SetBitmapBits
CreateSolidBrush
CreateRoundRectRgn
GetTextExtentPointW
SetBkColor
CreateRectRgn
GetDeviceCaps
GetStockObject
SetTextCharacterExtra
GetCurrentObject
GetTextColor
CreateFontIndirectW
RestoreDC
Rectangle
CreatePen
SaveDC
CreateRectRgnIndirect
ExtSelectClipRgn
CombineRgn

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 54.8MB - Virtual size: 54.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

6bbc4ee11bdaad81fa3b78171481d7ba

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:43:56:70:23:b6:5a:b6:a8:26:bb:d4:76:cf:c5:70Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

f1:9c:7e:f8:1b:ff:1b:bd:94:bb:bb:6a:99:67:85:1e:4b:e9:ab:c5:39:bb:af:8d:12:7a:01:0a:53:39:71:f1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

crypt32

gdiplus

wininet

dbghelp

wtsapi32

userenv

netapi32

iphlpapi

secur32

version

wintrust

gdi32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 238KB - Virtual size: 238KB

.data Size: 14KB - Virtual size: 33KB

.rsrc Size: 54.8MB - Virtual size: 54.8MB

.reloc Size: 63KB - Virtual size: 62KB

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:43:56:70:23:b6:5a:b6:a8:26:bb:d4:76:cf:c5:70
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

f1:9c:7e:f8:1b:ff:1b:bd:94:bb:bb:6a:99:67:85:1e:4b:e9:ab:c5:39:bb:af:8d:12:7a:01:0a:53:39:71:f1
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 238KB - Virtual size: 238KB

.data
Size: 14KB - Virtual size: 33KB

.rsrc
Size: 54.8MB - Virtual size: 54.8MB

.reloc
Size: 63KB - Virtual size: 62KB