63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643

Sharing

Copy URL Twitter E-mail

General

Target
63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643
Size 2.3MB
Sample240603-pytfdsgc36
SHA256 63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643
MD5 005a507781df6e31b4ebc41d2d879216
SHA1 288e2397d5828fca16390b98a6dd93bdfedb69f5
SHA512 01210a6e6dba09e995f136112667e40493fe2b5489b30291c50d380e4f2ac8dc6b37e2008533e4d203e1c812661b782f8c52ed0429e17b0f501d26bc18c0d3a4
SSDEEP 24576:J1QAnUbiH8ox1PWdRPCuONRGYRMksJHe7U4hpZKJHI/mFWioNxu/I:JSAn2iH8wM0NRGYRMzH6TlKJV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643

.exe 2.3MB

63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643

IMPHASH c10b4f99f1d75aaa6dd5eab7520d80b5
SHA256 63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643
MD5 005a507781df6e31b4ebc41d2d879216
SHA1 288e2397d5828fca16390b98a6dd93bdfedb69f5
SHA512 01210a6e6dba09e995f136112667e40493fe2b5489b30291c50d380e4f2ac8dc6b37e2008533e4d203e1c812661b782f8c52ed0429e17b0f501d26bc18c0d3a4
SSDEEP 24576:J1QAnUbiH8ox1PWdRPCuONRGYRMksJHe7U4hpZKJHI/mFWioNxu/I:JSAn2iH8wM0NRGYRMzH6TlKJV
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

46:1f:cf:7d:9f:36:90:55:12:26:d0:64:e6:d7:62:42:c7:50:1a:58:1f:ed:d2:35:e2:d5:50:af:2a:a3:cd:59

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91230103MA19HKLM8B,CN=黑龙江祥硕科技有限公司,O=黑龙江祥硕科技有限公司,L=哈尔滨市,ST=黑龙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e58d97e5b297e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c0ce9bb91e9be99e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 2, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0f:62:61:c8:45:6b:53:bd:4e:6b:61:2a:fc:2a:f4:91

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 17, 2022 - Jul 11, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

202593

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose FindFirstFileA GetVolumeInformationA WritePrivateProfileStringA FileTimeToLocalFileTime SetErrorMode HeapReAlloc HeapAlloc HeapFree RtlUnwind GetCommandLineA GetStartupInfoA RaiseException VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapSize HeapCreate GetStdHandle UnhandledExceptionFilter DuplicateHandle IsDebuggerPresent GetACP IsValidCodePage LCMapStringA LCMapStringW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringW SetEnvironmentVariableA GetFileSize UnlockFile LockFile SetFilePointer FileTimeToSystemTime GetFullPathNameA GetFileTime GetFileAttributesA GetModuleHandleW GetOEMCP GetCPInfo GlobalFlags TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetModuleFileNameW GetThreadLocale InterlockedIncrement GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA InterlockedExchange lstrcmpA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv lstrlenA FreeResource GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW TerminateProcess SetEndOfFile GetFileSizeEx GetTickCount WriteFile SetLastError GetModuleHandleA VirtualQueryEx SetFilePointerEx ReadFile GetProcAddress FreeLibrary WinExec WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource GetVersionExA GetModuleFileNameA CreateMutexA ExitProcess CreateFileA FlushFileBuffers GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId Sleep VirtualFree GetCurrentProcess VirtualProtectEx LoadLibraryA MultiByteToWideChar LoadLibraryExW VirtualAllocEx CreateEventA WaitForSingleObject ResetEvent SetEvent CreateToolhelp32Snapshot GetLastError Process32First Process32Next SetUnhandledExceptionFilter CloseHandle

user32

PostThreadMessageA IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA GetPropA RemovePropA IsWindow SetFocus GetWindowTextLengthA GetLastActivePopup SetActiveWindow DispatchMessageA BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageA MapWindowPoints ScrollWindow TrackPopupMenu GetKeyState SetMenu SetScrollRange GetScrollRange SetScrollPos ShowScrollBar IsWindowVisible UpdateWindow GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx GetParent ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect GetMenu OffsetRect IntersectRect GetWindowPlacement GetWindowRect GetWindow GetWindowLongA SetWindowLongA PostMessageA SetWindowPos AttachThreadInput GetSystemMetrics LoadIconA GetForegroundWindow InvalidateRect SetForegroundWindow KillTimer SetTimer IsIconic GetSystemMenu SendMessageA AppendMenuA DrawIcon ReleaseCapture GetFocus SetCapture GetClientRect FillRect SetWinEventHook GetWindowThreadProcessId GetWindowInfo SystemParametersInfoA GetClassNameA GetWindowTextA EnableWindow RegisterClipboardFormatA UnregisterClassA MessageBeep GetNextDlgGroupItem CharUpperA UnpackDDElParam LoadMenuA ReuseDDElParam LoadAcceleratorsA InsertMenuItemA CreatePopupMenu SetRectEmpty BringWindowToTop TranslateAcceleratorA InvalidateRgn SetRect CopyAcceleratorTableA GetSysColorBrush DestroyMenu GetMenuItemInfoA CharNextA SetWindowContextHelpId MapDialogRect GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog ShowOwnedPopups GetMessageA TranslateMessage GetActiveWindow ValidateRect PostQuitMessage InflateRect EndPaint BeginPaint GetWindowDC ReleaseDC GetDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetCursorPos SetCursor ClientToScreen SetWindowRgn IsRectEmpty GetScrollPos LoadCursorA

gdi32

SetMapMode LineTo MoveToEx DeleteObject GetViewportExtEx GetWindowExtEx BitBlt GetPixel PtVisible RectVisible TextOutA ExtTextOutA Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush CreateCompatibleDC GetStockObject CreatePen CreateSolidBrush CreateFontIndirectA CreateRectRgnIndirect GetMapMode GetBkColor GetTextExtentPoint32A GetRgnBox CreateCompatibleBitmap SetBkMode RestoreDC SaveDC Ellipse LPtoDP DPtoLP CreateEllipticRgn GetDeviceCaps CreateBitmap GetObjectA SetBkColor SetTextColor GetClipBox ScaleWindowExtEx GetTextColor

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter OpenPrinterA DocumentPropertiesA

advapi32

RegCreateKeyExA RegQueryValueA RegOpenKeyA RegEnumKeyA RegDeleteValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl RegDeleteKeyA

shell32

DragFinish DragQueryFileA

shlwapi

PathFindExtensionA PathIsUNCA PathFindFileNameA PathStripToRootA

oledlg

ord8

ole32

CoTaskMemFree CoTaskMemAlloc CoUninitialize CoGetClassObject CoInitialize CLSIDFromProgID CLSIDFromString StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysFreeString VariantInit VariantChangeType VariantClear SysAllocString SysStringLen SysAllocStringByteLen OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate VariantCopy SysAllocStringLen

wininet

InternetCloseHandle InternetReadFile InternetSetFilePointer HttpQueryInfoA InternetOpenUrlA InternetSetStatusCallback InternetOpenA

ws2_32

WSAStartup

Sharing

General

Malware Config

Signatures

File Explorer

63b95706c18b393c0bf7e7534a6ef7cef95ecc413a550d5e6ff2f2a6b47a2643

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

wininet

ws2_32

generic