e46d39f25a204eb429a7aeadaa2452491d80be0180069233f1fd572cae3449ca

Sharing

Copy URL Twitter E-mail

General

Target

e46d39f25a204eb429a7aeadaa2452491d80be0180069233f1fd572cae3449ca
Size

6.2MB
MD5

639352a39347b1672ef7aa3a1218af81
SHA1

b4a212dde40051c55642d52bbe9856bae1a0506c
SHA256

e46d39f25a204eb429a7aeadaa2452491d80be0180069233f1fd572cae3449ca
SHA512

d37839cd26817b1b4fbcf01cb03518424bce92a331299d224f213be61f2a61c91d308ef1e8251e5d7a8b276d9570b3d5316ceb192be146a120a73ae0d058daa8
SSDEEP

196608:G4A+CyiI/8K1mnQTifn72SA/xOq5PiUD6VJvOgyK36DthD:LxiC3mJVA/oq5PiUWJvxHWtN

Score

1^/10

Malware Config

Signatures

Files

e46d39f25a204eb429a7aeadaa2452491d80be0180069233f1fd572cae3449ca
.exe windows:6 windows x64 arch:x64

133468016d2a989be1d503f2a763c24f

Code Sign

74:e1:a3:d1:42:03:74:7b:b9:31:81:93:d9:8f:a5:db
Certificate

Issuer

CN=jifeidashi

Not Before

09/01/2024, 05:40

Not After

31/12/2039, 23:59

Subject

CN=jifeidashi

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:c4:40:8e:29:2e:b2:c6:6b:b1:bd:ba:af:66:d5:4f:02:29:a1:18
Signer

Actual PE Digest

7f:c4:40:8e:29:2e:b2:c6:6b:b1:bd:ba:af:66:d5:4f:02:29:a1:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

gdi32

BitBlt

kernel32

AddVectoredExceptionHandler
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

___lc_codepage_func

user32

ActivateKeyboardLayout
CharUpperBuffW

wtsapi32

WTSSendMessageW

Exports

Exports

_cgo_dummy_export
goELEMENT_COMPARATOR
goElementEventProc
goKeyValueCallback
goLPCBYTE_RECEIVER
goLPCSTR_RECEIVER
goLPCWSTR_RECEIVER
goNATIVE_FUNCTOR_INVOKE
goNATIVE_FUNCTOR_RELEASE
goSciterElementCallback
goSciterHostCallback
go_send
hook_create_screen_info
hook_get_auto_repeat_delay
hook_get_auto_repeat_rate
hook_get_multi_click_time
hook_get_pointer_acceleration_multiplier
hook_get_pointer_acceleration_threshold
hook_get_pointer_sensitivity
hook_post_event
hook_run
hook_set_dispatch_proc
hook_set_logger
hook_stop

Sections

.text
Size: - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 442KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

133468016d2a989be1d503f2a763c24f

Code Sign

74:e1:a3:d1:42:03:74:7b:b9:31:81:93:d9:8f:a5:dbCertificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

7f:c4:40:8e:29:2e:b2:c6:6b:b1:bd:ba:af:66:d5:4f:02:29:a1:18Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

user32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 4.6MB

.data Size: - Virtual size: 532KB

.rdata Size: - Virtual size: 4.5MB

.pdata Size: - Virtual size: 14KB

.xdata Size: - Virtual size: 13KB

.bss Size: - Virtual size: 442KB

.edata Size: - Virtual size: 812B

.idata Size: - Virtual size: 7KB

.CRT Size: - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.vmp0 Size: - Virtual size: 3.1MB

.vmp1 Size: 6.2MB - Virtual size: 6.2MB

.reloc Size: 512B - Virtual size: 48B

.rsrc Size: 15KB - Virtual size: 15KB

74:e1:a3:d1:42:03:74:7b:b9:31:81:93:d9:8f:a5:db
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

7f:c4:40:8e:29:2e:b2:c6:6b:b1:bd:ba:af:66:d5:4f:02:29:a1:18
Signer

.text
Size: - Virtual size: 4.6MB

.data
Size: - Virtual size: 532KB

.rdata
Size: - Virtual size: 4.5MB

.pdata
Size: - Virtual size: 14KB

.xdata
Size: - Virtual size: 13KB

.bss
Size: - Virtual size: 442KB

.edata
Size: - Virtual size: 812B

.idata
Size: - Virtual size: 7KB

.CRT
Size: - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.vmp0
Size: - Virtual size: 3.1MB

.vmp1
Size: 6.2MB - Virtual size: 6.2MB

.reloc
Size: 512B - Virtual size: 48B

.rsrc
Size: 15KB - Virtual size: 15KB