6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc

Sharing

Copy URL Twitter E-mail

General

Target
6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc
Size 2.9MB
Sample240613-eblf6atbja
SHA256 6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc
MD5 546710658f7b7ff41365f25de4e79a67
SHA1 a18d53f7d432f2a041757eb92d4ccbd2b488b8bd
SHA512 b80bf752ba7f0ee9bd987111c6fa15450c9b16e79510160f6c0fb5240a7469de63eee44abaeb6a665a9e373d075ed3c125be863b780fa20d031c880baba33eb4
SSDEEP 49152:VbwgL6+nZEyhCI4URZmWRZmRQ6dUcBEik974ksBwig5P0zkzRmGORMyKzq+jlmiF:TlZ9YsxN2i
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc

.exe 2.9MB

6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc

IMPHASH dfcd047dc3229452a431dce426b91b55
SHA256 6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc
MD5 546710658f7b7ff41365f25de4e79a67
SHA1 a18d53f7d432f2a041757eb92d4ccbd2b488b8bd
SHA512 b80bf752ba7f0ee9bd987111c6fa15450c9b16e79510160f6c0fb5240a7469de63eee44abaeb6a665a9e373d075ed3c125be863b780fa20d031c880baba33eb4
SSDEEP 49152:VbwgL6+nZEyhCI4URZmWRZmRQ6dUcBEik974ksBwig5P0zkzRmGORMyKzq+jlmiF:TlZ9YsxN2i
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

46:b5:8f:1b:d0:44:b4:9b:ae:70:28:ac:a1:90:e8:8d:7a:ec:a8:bc:22:13:65:29:c9:71:a0:14:a2:85:e5:90

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Oct 26, 2021

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

2c:f0:96:0a:45:ee:d1:6b:cc:be:35:94:89:07:48:19:ac:7f:47:ec

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Oct 26, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1153560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError CloseHandle RaiseException DecodePointer DeleteCriticalSection GetModuleFileNameA GetCurrentProcess lstrlenW WriteFile CreateMutexW GetCurrentThreadId Sleep GetTempPathA CreateFileA DeleteFileA ExitProcess WinExec SetEndOfFile WriteConsoleW CreateFileW SetStdHandle GetProcessHeap FindClose InitializeCriticalSectionEx EnumSystemLocalesA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapSize HeapReAlloc SetFilePointerEx ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapAlloc GetFileType GetCommandLineW GetCommandLineA RtlUnwind GetStdHandle GetModuleFileNameW GetModuleHandleExW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo LocalFree IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader FreeLibrary LoadLibraryExW

user32

MessageBoxA

advapi32

RegDeleteValueA RegCloseKey RegOpenKeyExW RegSetValueExA

shell32

ord680 FindExecutableA

oleaut32

VariantClear

rpcrt4

UuidFromStringA

ntdll

RtlCaptureContext RtlEthernetStringToAddressA RtlLookupFunctionEntry RtlIpv4StringToAddressA RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

6c1a3419a328fd0828d46069beb777959a7869bc75af9bb5f00b98293c5054fc

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

rpcrt4

ntdll

generic