421b689fe070ef0f9ee9e71d4e809161-14_setup_XA_mui_Free[.]exe[.]600[.]1006[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
421b689fe070ef0f9ee9e71d4e809161-14_setup_XA_mui_Free.exe.600.1006.exe
Size 225.0MB
Sample240611-pgdnlsxbjn
SHA256 317debaf5cd447549e448e6b929b3e2ea5ae54864b35dbb18833e7a87e6a1636
MD5 d54254438c5c1d2c3cf234e583ed6c97
SHA1 becbb2ef95317e5f8ae5782538364aa58b9cb980
SHA512 6087b1ea0e3ce1f0daeca7c42e28dfc88db80a9aad48bb7f94e736be309bd78074d4ab06ec057fc88a198f8998cc51fc08174e925ca44c54cf7b2fffeccd8da8
SSDEEP 6291456:qo5Y69DnhF6Rn0lo108kbmXMdyDq/1pA0F0QkDTqaHXXbV/T:qo5Y69DnkndYJ7S0GQkZ3LV/T
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

421b689fe070ef0f9ee9e71d4e809161-14_setup_XA_mui_Free.exe.600.1006.exe

.exe 225.0MB

421b689fe070ef0f9ee9e71d4e809161-14_setup_XA_mui_Free.exe.600.1006.exe

IMPHASH f012b964c985922d9021f9f32db93269
SHA256 317debaf5cd447549e448e6b929b3e2ea5ae54864b35dbb18833e7a87e6a1636
MD5 d54254438c5c1d2c3cf234e583ed6c97
SHA1 becbb2ef95317e5f8ae5782538364aa58b9cb980
SHA512 6087b1ea0e3ce1f0daeca7c42e28dfc88db80a9aad48bb7f94e736be309bd78074d4ab06ec057fc88a198f8998cc51fc08174e925ca44c54cf7b2fffeccd8da8
SSDEEP 6291456:qo5Y69DnhF6Rn0lo108kbmXMdyDq/1pA0F0QkDTqaHXXbV/T:qo5Y69DnkndYJ7S0GQkZ3LV/T
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

f4:53:8b:84:a8:00:3d:a2:e6:9d:4c:01:b1:29:e2:83:5b:a7:0a:96:24:29:27:b8:1f:1b:f0:dc:fe:9a:70:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Apr 1, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

7e:36:8a:97:cd:d9:be:6e:03:d7:b8:ee:86:95:60:d2:bf:f5:c1:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Apr 1, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1697247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\rc_bugfix_master_v12_2403_branch\Build\Release\WPSOffice\office6\KPacket_xa.pdb

msi

ord90

kernel32

GetModuleFileNameW VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount lstrlenW GetFileSize FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW DeleteFileW SetEndOfFile SetFilePointer SetFilePointerEx WriteFile GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileExW GetStdHandle ReadFile MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetModuleHandleW GetProcAddress MoveFileW GetLogicalDriveStringsW GetModuleHandleA GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask VerSetConditionMask GetCurrentThread GetSystemWow64DirectoryW FreeLibrary LoadLibraryW LocalFree VerifyVersionInfoW GetDateFormatW GetTimeFormatW OpenProcess ReadProcessMemory GetPrivateProfileStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW ExpandEnvironmentStringsW GetDiskFreeSpaceExW GetFileAttributesExW Sleep TerminateProcess lstrcmpW GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW CreateFileA lstrcpynA lstrlenA CreateThread GetLocalTime ReleaseMutex OpenEventW OpenFileMappingW GetCommandLineW SetDllDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW GetFileSizeEx GetLongPathNameW GetTempFileNameW QueryDosDeviceW OutputDebugStringW SetErrorMode SetPriorityClass ProcessIdToSessionId LocalAlloc GetDriveTypeW EncodePointer GetNativeSystemInfo SetProcessWorkingSetSizeEx IsWow64Process GetLocaleInfoW GetUserDefaultLangID SetUnhandledExceptionFilter MapViewOfFileEx lstrcmpiW AllocConsole AttachConsole WriteConsoleW GetProcessId GetSystemTime GetModuleHandleExW FileTimeToSystemTime SystemTimeToFileTime AreFileApisANSI VirtualProtect VirtualQuery LoadLibraryExA DeviceIoControl TerminateThread SystemTimeToTzSpecificLocalTime WaitForSingleObjectEx UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW FormatMessageW GetStringTypeW TryEnterCriticalSection SwitchToThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo CompareStringW LCMapStringW InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache RtlUnwind InterlockedFlushSList ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA DuplicateHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode GetTimeZoneInformation CreatePipe ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait GetThreadTimes QueryDepthSList UnregisterWaitEx FormatMessageA LockFileEx UnlockFile HeapCompact DeleteFileA LoadLibraryA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate

Sharing

General

Malware Config

Signatures

File Explorer

421b689fe070ef0f9ee9e71d4e809161-14_setup_XA_mui_Free.exe.600.1006.exe

msi

kernel32

generic