2dd6c16d2b8c5383a9d853e5da19ddad48f41625807586df25e13069e766be39

Sharing

Copy URL Twitter E-mail

General

Target

2dd6c16d2b8c5383a9d853e5da19ddad48f41625807586df25e13069e766be39
Size

573KB
MD5

0b8c8ff529f9518c019dda902c67e2e2
SHA1

bcf9b041963cc9117f937f86093c5e6d58fa8f70
SHA256

2dd6c16d2b8c5383a9d853e5da19ddad48f41625807586df25e13069e766be39
SHA512

63f6073906c85d94f0585fdb959b279d63cedbae60975e01bc56870fcf1474c99f8ad1c54b2e1cc1d128c01a1a74dbdf8088198015634d2eacaab90d25865168
SSDEEP

12288:3a0khClMKTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKKtj7g:q00C2KTKK4KKDyK5FZ1EEEEmEEE1EEEI

Score

1^/10

Malware Config

Signatures

Files

2dd6c16d2b8c5383a9d853e5da19ddad48f41625807586df25e13069e766be39
.exe windows:5 windows x86 arch:x86

5323c2e2266929a8fae13ef72c171a1d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5b
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/08/2021, 00:00

Not After

01/08/2024, 23:59

Subject

CN=DingTalk Technology Co.\,Ltd.,O=DingTalk Technology Co.\,Ltd.,L=杭州市,ST=浙江省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5b
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/08/2021, 00:00

Not After

01/08/2024, 23:59

Subject

CN=DingTalk Technology Co.\,Ltd.,O=DingTalk Technology Co.\,Ltd.,L=杭州市,ST=浙江省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:85:44:38:74:06:59:20:15:d4:62:6d:10:e4:e0:d7:86:76:8a:e2:ea:d8:c7:17:03:01:9f:8d:52:dd:8a:ab
Signer

Actual PE Digest

bd:85:44:38:74:06:59:20:15:d4:62:6d:10:e4:e0:d7:86:76:8a:e2:ea:d8:c7:17:03:01:9f:8d:52:dd:8a:ab

Digest Algorithm

sha256

PE Digest Matches

false

bb:23:d9:cf:12:a9:bc:6b:0a:c2:21:5a:ed:e5:ca:f0:38:ee:11:51
Signer

Actual PE Digest

bb:23:d9:cf:12:a9:bc:6b:0a:c2:21:5a:ed:e5:ca:f0:38:ee:11:51

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins\workspace\ci.dingding.manual.new\DingTalk-Win\win\bin\release\DingtalkScheme.exe.pdb

Imports

kernel32

GetCommandLineW
DecodePointer
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexW
Sleep
FindResourceExW
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
ReadConsoleW
ReadFile
SetEndOfFile
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
CreateFileW
GetStringTypeW
SetStdHandle
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW

shell32

ShellExecuteExW

shlwapi

PathFileExistsW

user32

IsIconic
SetActiveWindow
ShowWindow
SendMessageTimeoutW
GetPropW
BringWindowToTop
SetForegroundWindow
EnumWindows
FindWindowW
IsWindowVisible

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5323c2e2266929a8fae13ef72c171a1d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bd:85:44:38:74:06:59:20:15:d4:62:6d:10:e4:e0:d7:86:76:8a:e2:ea:d8:c7:17:03:01:9f:8d:52:dd:8a:abSigner

bb:23:d9:cf:12:a9:bc:6b:0a:c2:21:5a:ed:e5:ca:f0:38:ee:11:51Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

shlwapi

user32

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 302KB - Virtual size: 301KB

.reloc Size: 163KB - Virtual size: 163KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:af:69:d7:a3:81:e9:2b:82:9f:9d:6e:3d:ad:92:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bd:85:44:38:74:06:59:20:15:d4:62:6d:10:e4:e0:d7:86:76:8a:e2:ea:d8:c7:17:03:01:9f:8d:52:dd:8a:ab
Signer

bb:23:d9:cf:12:a9:bc:6b:0a:c2:21:5a:ed:e5:ca:f0:38:ee:11:51
Signer

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 302KB - Virtual size: 301KB

.reloc
Size: 163KB - Virtual size: 163KB