b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867

Sharing

Copy URL Twitter E-mail

General

Target
b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867
Size 1.6MB
Sample240511-pgqyyaae75
SHA256 b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867
MD5 113e36e668eb92c3fd687b0e7853fe93
SHA1 a8b92728bc401e642f12c3e16ae720960eb21ca6
SHA512 2bd067c756845fbd90c76e0310b75e4e86b98e72e41fe821da979899dfc970464f89618bd2df71f5d6fe9b6129e028f8aef683dd58bc4df04de6792e63a055d7
SSDEEP 24576:2Fh69Fnix1kHcPGlFERUmu4TtWzmq3fjmNVPvpK0vMTuFU9Kr61B9wrEH7zwh:C69Fikjs+vjmNZvpX0TuF2Z1jm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867

.dll 1.6MB

b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867

IMPHASH 8a750bf910e26f401e6725747d15674a
SHA256 b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867
MD5 113e36e668eb92c3fd687b0e7853fe93
SHA1 a8b92728bc401e642f12c3e16ae720960eb21ca6
SHA512 2bd067c756845fbd90c76e0310b75e4e86b98e72e41fe821da979899dfc970464f89618bd2df71f5d6fe9b6129e028f8aef683dd58bc4df04de6792e63a055d7
SSDEEP 24576:2Fh69Fnix1kHcPGlFERUmu4TtWzmq3fjmNVPvpK0vMTuFU9Kr61B9wrEH7zwh:C69Fikjs+vjmNZvpX0TuF2Z1jm
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

0f:99:53:c5:04:72:ef:44:ff:1f:4d:b8:f0:42:7e:74:53:c9:91:31:27:45:b9:f1:9e:1b:01:5f:da:bd:79:20

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 7, 2022

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

69:ee:e8:70:3f:c8:6d:52:14:b1:c7:5f:84:fb:1c:40:1b:ab:e8:14

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 7, 2022

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:a8:f7:25:76:dc:7b:14:7a:18:63:9e:8d:4d:eb:37

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 28, 2021 - Mar 1, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

943651

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\641453\out\Release_i18n\safemon.pdb

kernel32

GetSystemInfo GetCurrentProcessId OpenProcess GetModuleFileNameA lstrcmpiA OutputDebugStringW GetShortPathNameW Sleep GetCommandLineW LoadLibraryExW GetPrivateProfileIntW TlsGetValue GetTickCount ExpandEnvironmentStringsW InterlockedIncrement InterlockedDecrement WaitForSingleObject GetPrivateProfileIntA CreateThread CreateFileA CreateFileMappingA MapViewOfFileEx UnmapViewOfFile VirtualAllocEx VirtualFreeEx GetVersionExA CreateDirectoryA SetEndOfFile SetUnhandledExceptionFilter GetSystemDirectoryA CreateRemoteThread VirtualAlloc VirtualFree IsBadStringPtrW VirtualProtect CreateFileMappingW MapViewOfFile GetPrivateProfileStringA GetPrivateProfileSectionW CreateEventW SetEvent WaitForMultipleObjects GlobalSize GlobalLock GlobalUnlock GetProcessHeap HeapAlloc lstrcpynW lstrcmpA OpenFileMappingW GetLocalTime IsDebuggerPresent OpenMutexW GetModuleHandleA CreateDirectoryW CopyFileW IsBadCodePtr GetSystemTime SystemTimeToFileTime LoadLibraryA CreateProcessW GetExitCodeThread GetTempPathW GetTempFileNameW HeapFree GetEnvironmentVariableW ResetEvent lstrcmpW ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock CreateMutexW GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime GetPrivateProfileStringW SetFilePointer GetVersionExW FreeResource SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetStdHandle HeapCreate ExitProcess GetCPInfo LCMapStringW LCMapStringA RtlUnwind GetCommandLineA GetSystemTimeAsFileTime UnhandledExceptionFilter SuspendThread LocalAlloc GetFileAttributesW LoadLibraryW GetSystemDirectoryW LocalFree SearchPathW VirtualQuery GetLongPathNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetLastError GetFileAttributesExW lstrcpynA WideCharToMultiByte lstrlenW TerminateProcess MultiByteToWideChar InterlockedCompareExchange lstrlenA WriteFile CloseHandle ReadFile GetFileSize CreateFileW SetLastError RaiseException lstrcmpiW GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetCurrentThread SetErrorMode IsBadReadPtr TlsSetValue GetModuleFileNameW FreeLibrary GetModuleHandleW TlsFree TlsAlloc DeleteCriticalSection InitializeCriticalSection GetProcAddress LeaveCriticalSection EnterCriticalSection SetThreadContext GetThreadContext ResumeThread DeviceIoControl HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent InterlockedExchange DebugBreak

user32

CallWindowProcW SetParent SetWindowPos IsWindow ShowWindow GetClientRect MoveWindow GetWindowLongW GetSystemMetrics RedrawWindow SetWindowLongW GetParent DefWindowProcW GetWindowRect UnregisterClassA ScreenToClient InvalidateRect EnumChildWindows IsWindowVisible DestroyWindow GetClassNameW FindWindowExW RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW PostQuitMessage EnumThreadWindows EndDialog DialogBoxParamW PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterClassW GetMonitorInfoW MonitorFromPoint DestroyMenu EndPaint BeginPaint AppendMenuW TrackPopupMenu CreatePopupMenu DrawTextW RegisterWindowMessageW InflateRect OffsetRect CopyRect KillTimer SetTimer SendMessageW GetWindowTextW SetWindowTextW SetRectEmpty SetRect DrawIconEx PostMessageW PtInRect GetDC ReleaseDC GetCursorPos wsprintfW FindWindowW LoadImageW CharNextW SendMessageTimeoutW UnhookWindowsHookEx BroadcastSystemMessageW SetWindowsHookExW CallNextHookEx

gdi32

CreateFontIndirectW ExtTextOutW SetBkColor SetTextColor SetBkMode GetStockObject BitBlt CreateDIBSection SetStretchBltMode StretchBlt SelectObject CreateCompatibleDC DeleteDC DeleteObject GetObjectW SetViewportOrgEx CreateCompatibleBitmap CreateBitmap SetPixel PatBlt

advapi32

RegQueryValueExA CryptAcquireContextW LookupAccountNameW SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl InitializeSecurityDescriptor SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken CryptGenRandom CryptReleaseContext RegQueryValueExW

shell32

ord51 SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathA SHGetSpecialFolderPathA CommandLineToArgvW

ole32

CoUninitialize CoCreateInstance CoInitialize StringFromCLSID StringFromGUID2 GetHGlobalFromStream CoTaskMemFree CoTaskMemAlloc CoCreateGuid CreateStreamOnHGlobal CoTaskMemRealloc

oleaut32

SysStringByteLen SysAllocStringByteLen UnRegisterTypeLi SysAllocStringLen VariantClear SysFreeString DispCallFunc SysStringLen LoadTypeLi VariantInit VarUI4FromStr LoadRegTypeLi SysAllocString VarBstrCmp

shlwapi

StrCmpW StrChrW StrDupW PathIsDirectoryW PathFindExtensionW StrCmpNIA PathRemoveFileSpecW StrCmpNW UrlGetPartW StrCmpNIW StrStrIA PathGetArgsW UrlUnescapeW PathFileExistsA PathRemoveFileSpecA PathCombineA StrStrW PathMatchSpecW SHSetValueW SHDeleteKeyW PathRemoveExtensionW PathRemoveBackslashW PathIsRootW PathIsPrefixW UrlGetPartA StrDupA StrChrA wnsprintfW PathAppendW PathFindFileNameW StrRChrIW StrRStrIW StrChrIW StrCmpIW StrStrIW SHGetValueW PathFileExistsW StrCpyNW PathCombineW

psapi

EnumProcessModules GetModuleInformation GetModuleBaseNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

oleacc

AccessibleObjectFromPoint

urlmon

UrlMkSetSessionOption UrlMkGetSessionOption

ws2_32

htonl ntohl WSASetLastError getpeername inet_ntoa inet_addr

netapi32

NetApiBufferFree NetWkstaUserGetInfo

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.share

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARE

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b9709df2ba4632f51a07db5d3a269947ee1b828572ee0d8cb72941a926d06867

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

version

oleacc

urlmon

ws2_32

netapi32

generic