36d424455d25070cd413800ffc8b81932ed0f73b750455095c06f55cee025b5f

Sharing

Copy URL Twitter E-mail

General

Target

36d424455d25070cd413800ffc8b81932ed0f73b750455095c06f55cee025b5f
Size

765KB
MD5

efcc852df294fb7ba3888a090ebb0033
SHA1

6564f58c5e5b8b04f9bfe8be5e4ea2c6db0e91ea
SHA256

36d424455d25070cd413800ffc8b81932ed0f73b750455095c06f55cee025b5f
SHA512

a2e33d17b27f4dc501e848cfaf3c16ba835bae3c55b4eae1d94f11a0758ccc9a9b552685e3a651c263ed3ecebc870729fd104ed1bc48d2ac30f2c92f6d3fa145
SSDEEP

12288:JaHB/STGV+ScS1VIIC0jKh+WkrHWUkw3BZOpSqK:MHB/STGUScczjKTUk6ZOFK

Score

1^/10

Malware Config

Signatures

Files

36d424455d25070cd413800ffc8b81932ed0f73b750455095c06f55cee025b5f
.exe windows:6 windows x64 arch:x64

5f7479be2d23c7356dd2068b20b564be

Code Sign

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3
Certificate

Issuer

CN=Developer ID Certification Authority,OU=G2,O=Apple Inc.,C=US

Not Before

16/01/2024, 09:43

Not After

16/01/2029, 09:43

Subject

CN=Developer ID Application: UGREEN GROUP LIMITED (4X996UV8LC),OU=4X996UV8LC,O=UGREEN GROUP LIMITED,C=US,0.9.2342.19200300.100.1.1=#130a34583939365556384c43

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3
Certificate

Issuer

CN=Developer ID Certification Authority,OU=G2,O=Apple Inc.,C=US

Not Before

16/01/2024, 09:43

Not After

16/01/2029, 09:43

Subject

CN=Developer ID Application: UGREEN GROUP LIMITED (4X996UV8LC),OU=4X996UV8LC,O=UGREEN GROUP LIMITED,C=US,0.9.2342.19200300.100.1.1=#130a34583939365556384c43

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f1:d2:fe:ef:81:59:33:4f:ca:7f:75:41:51:e4:b3:65:79:e2:db:7a
Signer

Actual PE Digest

f1:d2:fe:ef:81:59:33:4f:ca:7f:75:41:51:e4:b3:65:79:e2:db:7a

Digest Algorithm

sha1

PE Digest Matches

true

bb:ff:5e:19:27:4a:94:ea:37:6d:bf:8e:ea:9f:5b:b6:39:d5:80:a8:7a:41:7f:42:c2:8f:29:13:03:80:a3:5e
Signer

Actual PE Digest

bb:ff:5e:19:27:4a:94:ea:37:6d:bf:8e:ea:9f:5b:b6:39:d5:80:a8:7a:41:7f:42:c2:8f:29:13:03:80:a3:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

iphlpapi

GetBestRoute
GetAdaptersInfo

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
GetCurrentThreadId
SetEvent
WaitForSingleObject
CreateEventA
HeapAlloc
HeapFree
GetProcessHeap
GlobalMemoryStatusEx
GetVersionExA
GetSystemTime
GetLocalTime
GetTickCount64
GetHandleInformation
SetLastError
Sleep
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetModuleHandleW
GetProcAddress
SetFileCompletionNotificationModes
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
CreateMutexA
GetLastError
CloseHandle
CreateIoCompletionPort
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

ws2_32

WSAGetLastError
getaddrinfo
freeaddrinfo
shutdown
htonl
setsockopt
WSACleanup
send
recvfrom
recv
listen
getsockopt
getsockname
connect
ioctlsocket
sendto
ntohs
closesocket
gethostname
inet_ntop
WSAStartup
WSAIoctl
accept
socket
htons
bind
inet_pton
ntohl

vcruntime140

__current_exception_context
__C_specific_handler
memmove
memcmp
memcpy
strstr
strchr
memset
__current_exception

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fclose
fopen
fread
fseek
__stdio_common_vsprintf
__p__commode
_sopen_s
_write
_lseek
_close
ftell
rewind
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

calloc
_set_new_mode
realloc
malloc
free

api-ms-win-crt-runtime-l1-1-0

strerror
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
strerror_s
terminate
__p___argv
__p___argc
_exit
_errno
exit
_initterm_e
_initterm
_seh_filter_exe
_set_app_type
abort
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_getpid

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-string-l1-1-0

_strdup
tolower
strncpy
strlen
strncmp
strcmp
isalpha
isspace
_strnicmp
strnlen
strncpy_s
strcspn

api-ms-win-crt-filesystem-l1-1-0

remove
_access
rename

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_mktime64
_time64

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

glc_add_service_mapping
glc_connect
glc_del_service_mapping
glc_reconnect
glc_start
glc_stop
gld_accept
gld_add_service_forward
gld_del_service_forward
gld_start
gld_stop
glp_all_peers_info
glp_configure
glp_configure_v2
glp_connective_report
glp_destroy
glp_exit
glp_get_random_remote
glp_peer_count
glp_peer_info
glp_send_msg
glp_send_msg2
glp_set_license_server
glp_set_netype
glp_set_report_server
glp_set_speed_limit
glp_sip_refresh
glp_sip_state
glp_tunnel_priority
glp_version

Sections

.text
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 266KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f7479be2d23c7356dd2068b20b564be

Code Sign

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

f1:d2:fe:ef:81:59:33:4f:ca:7f:75:41:51:e4:b3:65:79:e2:db:7aSigner

bb:ff:5e:19:27:4a:94:ea:37:6d:bf:8e:ea:9f:5b:b6:39:d5:80:a8:7a:41:7f:42:c2:8f:29:13:03:80:a3:5eSigner

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

kernel32

advapi32

ws2_32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 453KB - Virtual size: 453KB

.rdata Size: 266KB - Virtual size: 266KB

.data Size: 2KB - Virtual size: 66KB

.pdata Size: 20KB - Virtual size: 20KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

1b:7a:b7:40:1d:bd:2c:d0:b7:05:b6:48:fb:bc:79:a3
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

f1:d2:fe:ef:81:59:33:4f:ca:7f:75:41:51:e4:b3:65:79:e2:db:7a
Signer

bb:ff:5e:19:27:4a:94:ea:37:6d:bf:8e:ea:9f:5b:b6:39:d5:80:a8:7a:41:7f:42:c2:8f:29:13:03:80:a3:5e
Signer

.text
Size: 453KB - Virtual size: 453KB

.rdata
Size: 266KB - Virtual size: 266KB

.data
Size: 2KB - Virtual size: 66KB

.pdata
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB