4x(24-06-27).rar
- SHA256 a47ef1b22b4797187294ec207237a8195273dab7d4543d46d5d23dafe520f853
Overview
overview
10Static
static
32024po.exe
windows7-x64
42024po.exe
windows10-2004-x64
4Timo.exe
windows7-x64
1Timo.exe
windows10-2004-x64
10[D]2024年...��.exe
windows7-x64
1[D]2024年...��.exe
windows10-2004-x64
1点击此�...��.exe
windows7-x64
8点击此�...��.exe
windows10-2004-x64
7票9254523...��.exe
windows7-x64
1票9254523...��.exe
windows10-2004-x64
1考勤异�...��.exe
windows7-x64
1考勤异�...��.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024po.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024po.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Timo.exe
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Timo.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
[D]2024年移动合作方人员出入管理门禁安装程序.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
[D]2024年移动合作方人员出入管理门禁安装程序.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
点击此处安装语言包.exe
Resource
win7-20240611-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
点击此处安装语言包.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral9
Sample
票925452362131助手.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
票925452362131助手.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
考勤异常信息统计结果查询工具.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
考勤异常信息统计结果查询工具.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 4x(24-06-27).rar
- Size 30.6MB
- Sample240627-ssramaxeje
- SHA256 a47ef1b22b4797187294ec207237a8195273dab7d4543d46d5d23dafe520f853
- MD5 d968f62a6d7bb3187c25b1eb53e0dae8
- SHA1 3e1c59a45a923b15b7f32f5a1cc246be07b58c08
- SHA512 b9711c7b8a2fa7fb6257d13738662e3ab381693aa642a68f28f7a705b18e520cfb74d8e88ab04bfa8dd87d45f97bd86366ec5e3f33cb799b1cec833be6d5fe18
- SSDEEP 786432:B72Jh0QWV3emCsQFEebPIGRl6XdXdf2zL:B72Jh0CTqaRSXpUL
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/2024po.exe.vir unpack001/Timo.exe.vir unpack001/[D]2024年移动合作方人员出入管理门禁安装程序.exe.vir unpack001/考勤异常信息统计结果查询工具.exe.vir
File Explorer
-
4x(24-06-27).rar.rar 30.6MB
-
2024po.exe.vir.exe 24.9MB
-
Timo.exe.vir.exe 192KB
-
[D]2024年移动合作方人员出入管理门禁安装程序.exe.vir.exe 1.2MB
-
点击此处安装语言包.exe.vir.exe 10.8MB
-
票925452362131助手.exe.vir.exe 804KB
-
考勤异常信息统计结果查询工具.exe.vir.exe 6.5MB
2024po.exe.vir
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f02847218879d4b9b16378ae8c217ae0d767f5a89eacdaa73b9abbe7371dff14
- MD5 a85707d05ff5a760afb050684ff7ec53
- SHA1 3e65e8722e8fb2590d6eb51621ac116d9e06e39d
- SHA512 9f36107b78363dbc637297b6f0dd395174ed86254f9a0d8a14ef2b73315915591b4e45a26d1601cad2a718d2e5b507a2fce9dcf13b2a95ef1f5c7a593b18eb91
- SSDEEP 786432:Jsbf9sI8h2PdCeixMdSC7BMwOY9F2lGEA:Cghws4eY2G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26003526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\GoldMiner-C--main\obj\Release\GoldMiner.pdb
mscoree
_CorExeMain
Name
.text
Size
24.8MB
Virtual Size
24.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Timo.exe.vir
- IMPHASH cbd03d548e96d66a238682ac4c7fe152
- SHA256 176e5d0fdb77b787e6ea0622eaffffde1ed810a14393b15f1793b51a57a50be9
- MD5 5ec5fd2a7ab1e0d940897a2ae2cbb537
- SHA1 98422219f54f90ed0ba93e1d568ff1e57cdbc0e9
- SHA512 c2832bb147a1e231e1fd052538802ded7fbf08d563a98984ea94d4b376d4da666b3a6cf4032f609fc2ce5ba3218097a62d0df974bc4dd14c57fe6c3706114ff6
- SSDEEP 3072:J6Bu8MeIh9kxFYlCR2zjkYavxyVCve9ehIe5NIgPA9FTJjcUyWU:JpKxFYlCR2zQYMwIOeE9AUfU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameA
VirtualProtect
VirtualFree
VirtualAlloc
CreateFileW
GetModuleHandleA
OpenProcess
Sleep
GetCurrentThread
GetSystemInfo
GetProcAddress
GetCurrentProcessId
GlobalMemoryStatusEx
GetTickCount
VirtualQueryEx
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLastError
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualQuery
VirtualProtectEx
SetLastError
FreeLibrary
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
Name
.text
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=30795,
count=138, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=261, version=31332,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=46, id=261, version=33030,
count=3, id=257, version=30795,
count=109, id=1, productName=Unmarked objects,
count=2, id=265, version=33130,
count=1, id=258, version=33130,
[D]2024年移动合作方人员出入管理门禁安装程序.exe.vir
- IMPHASH c110cb8d12060febe265ec48153846e2
- SHA256 5bb87482aca08d98dd1391f7b0f1a394b6a2e42f3ecf212f002f62e2059bd0c5
- MD5 31d12c85fad4c87d200f24834dbdd54d
- SHA1 dff64c7fe5060c5beb8d3387f58daf2fcfef42a4
- SHA512 b12ed5e81ce97f9efa3ef1381f892577422517a24724dc977d65e0cc72ee3e2b22dfee21f796c976eb1e5aa2b5b3bbfa017d2100e8787791dad27c6d7d71d374
- SSDEEP 12288:FICsXIYPcFFydh2ZkcnahSEiXhxGIknEJMq2BDaok1JyDx:2CsXxcih2znu0GIvJh1JyDx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
397877
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\miansha\diaoyu\x64\Debug\diaoyu.pdb
kernel32
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateFileW
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RtlPcToFileHeader
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
GetCommandLineA
GetCommandLineW
HeapSize
HeapValidate
GetSystemInfo
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetCurrentThread
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
HeapQueryInformation
GetFileSizeEx
SetFilePointerEx
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
ReadConsoleW
CloseHandle
RtlUnwind
Name
.textbss
Size
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
811KB
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
512B
Virtual Size
278B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
283B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
147KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26213,
count=7, id=259, version=26213,
count=144, id=261, version=26213,
count=45, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=3, id=257, version=26213,
count=90, id=1, productName=Unmarked objects,
count=1, id=261, version=27051,
count=1, id=255, version=27051,
count=1, id=258, version=27051,
点击此处安装语言包.exe.vir
- IMPHASH 7ecca5b83f5c154d3e2fae824099d2c4
- SHA256 af884204ca0845632eb01c3a37a9d5609f2b7065b884500658da60080eaab617
- MD5 44ce97dc5b3054dfb4999933219887b7
- SHA1 23cedb5e66fbc1cf3c86a8812d6189ed3dd88b17
- SHA512 e602db55a559e6c8f96d8dc222af5debc0025675d6fcf8e98e89d4efbd65811819d1e6c8c3467576b850ceb25e0891edb1b648e130caf66046fbc643a584ae04
- SSDEEP 196608:PB/vhOCUMgKCZFB4IS+9G0eBF/6FLOyomFHKnPdfxxEBB2XCQkfLoaxA4JN1cdDD:PdJOCdgxZFBVeBUFqJbnf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3f:e5:8c:20:42:04:71:e0:de:ce:b2:df:ad:9d:e8:83:6b:32:cb:bb:6a:6f:e2:85:8e:a9:31:c8:49:cd:ee:d8
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jul 19, 2021
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
69:8d:27:74:10:60:58:3a:0c:c2:65:23:3e:6e:70:90:9f:f8:0f:b9
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jul 19, 2021
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 8, 2021 - Jul 11, 2022
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91110108700000458B,CN=Lenovo (Beijing) Limited,OU=ChinaServiceDriver,O=Lenovo (Beijing) Limited,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0f:c3:5e:9e:4e:dd:5b:cf:a4:be:5e:fe:96:b3:ac:27
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 8, 2021 - Jul 11, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
131799
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindResourceW
GetTickCount
LoadLibraryW
GetProcAddress
FreeLibrary
CreateDirectoryW
SetLastError
GetCommandLineW
FindNextFileW
GetCurrentProcess
FindClose
MultiByteToWideChar
GlobalFlags
GetSystemInfo
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
WideCharToMultiByte
VirtualQuery
SetEvent
CreateThread
ResetEvent
GetSystemTimeAsFileTime
lstrcmpiW
LockResource
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
CompareStringW
GetConsoleMode
GetConsoleOutputCP
GetFileType
SetFilePointerEx
GetStdHandle
GetCommandLineA
GetModuleHandleExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
OutputDebugStringW
FreeResource
InitializeCriticalSection
SizeofResource
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
TryEnterCriticalSection
GetProcessHandleCount
HeapFree
TerminateProcess
OpenProcess
GetCurrentProcessId
GetLocalTime
WriteFile
ExitProcess
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
CreateEventW
GetModuleFileNameW
CloseHandle
LoadResource
CreateFileW
Sleep
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
user32
PeekMessageW
GetMessageW
TranslateMessage
DefWindowProcW
DestroyWindow
MessageBoxW
ReleaseDC
DispatchMessageW
CharNextW
MonitorFromWindow
GetDC
LoadImageW
GetParent
GetDesktopWindow
LoadCursorW
LoadIconW
LoadStringW
SendMessageW
GetWindowLongW
WaitForInputIdle
gdi32
CreateDIBSection
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
SelectObject
SetDIBColorTable
advapi32
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
shell32
ShellExecuteW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
oleaut32
SystemTimeToVariantTime
VarUI4FromStr
comctl32
ImageList_AddMasked
InitCommonControlsEx
ImageList_Create
ImageList_Destroy
ws2_32
WSACleanup
gdiplus
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdiplusStartup
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImagePalette
GdipSetCompositingMode
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdiplusShutdown
GdipFree
GdipGetImageWidth
?get_active_implementation@simdutf@@YAAAV?$atomic_ptr@$$CBVimplementation@simdutf@@@internal@1@XZ
?get_available_implementations@simdutf@@YAABVavailable_implementation_list@internal@1@XZ
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10.5MB
Virtual Size
10.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=165, id=261, version=27412,
count=4, id=199, version=41118,
count=19, id=260, version=26706,
count=21, id=259, version=26706,
count=50, id=261, version=26706,
count=23, id=260, version=27412,
count=21, id=257, version=27412,
count=290, id=1, productName=Unmarked objects,
count=32, id=265, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
票925452362131助手.exe.vir
- IMPHASH e0f22ad3c983aa9c9ce4afda13b27307
- SHA256 8719467326ae08e270854cdef37e5ca93f33a7411002b5f61f9796659e91c8e4
- MD5 5adea3ab683a21d39d75b6aab6f9cd10
- SHA1 ca614a981a394a88a42d43492b0a737527bff171
- SHA512 85825cd5d64018177b66fcaa3506687af49a958d401e2865875233b04b53694c4a973c458965a97db47ec6cbc545c1671135214cdbb8d4fdc705965be69d954b
- SSDEEP 12288:9HjaxBmJ3owhLHLHXQbKODmKvg0HTLbCf7cKSyfIxF6YUx6tcJza1:lqBw31LbQbLmKBjCf7cZL6hx6GJG
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
03:42:61:f3:3a:45:2a:0d:36:5d:6e:ad:fa:c8:b1:d2:f9:ac:1f:6a
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=沈阳芝麻开门科技有限公司,O=沈阳芝麻开门科技有限公司,L=沈阳市,ST=辽宁省,C=CN,1.2.840.113549.1.9.1=#0c12627573696e65737340356b626f782e636f6d
Chains
Oct 9, 2013
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN
Serial Number
19:9d:f8:9e
Issuer
CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2009 - Aug 8, 2024
Subject
CN=沈阳芝麻开门科技有限公司,O=沈阳芝麻开门科技有限公司,L=沈阳市,ST=辽宁省,C=CN,1.2.840.113549.1.9.1=#0c12627573696e65737340356b626f782e636f6d
Serial Number
09:69:0a:76:fb:97:7e
Issuer
CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jun 28, 2013 - Jun 29, 2014
Subject
CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN
Serial Number
3d
Issuer
CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 1, 2011 - Mar 1, 2016
Minor OS version
0
Major OS version
6
Entry point
26384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
LocalAlloc
HeapAlloc
GetProcessHeap
LocalReAlloc
GetModuleFileNameA
GetCurrentProcess
WriteFile
VirtualAlloc
CreateMutexW
GetCurrentThreadId
EnumSystemLocalesA
GetTempPathA
HeapFree
DeleteFileA
ExitProcess
WinExec
Sleep
LoadLibraryW
GetProcAddress
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
DeleteCriticalSection
DecodePointer
RaiseException
CloseHandle
GetLastError
FindClose
GetEnvironmentVariableA
InitializeCriticalSectionEx
FindNextFileA
CreateFileA
FindFirstFileA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapSize
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
RtlUnwind
IsValidLocale
GetFileType
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
IsDebuggerPresent
OutputDebugStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
FreeLibrary
LoadLibraryExW
user32
MessageBoxA
advapi32
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExW
shell32
FindExecutableA
ord680
oleaut32
VariantClear
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Name
.text
Size
149KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
545KB
Virtual Size
550KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=18, id=260, version=26213,
count=188, id=261, version=26213,
count=9, id=259, version=26706,
count=1, id=262, version=26213,
count=68, id=261, version=26706,
count=34, id=260, version=26706,
count=23, id=257, version=26213,
count=179, id=1, productName=Unmarked objects,
count=8, id=265, version=27051,
count=1, id=259, version=27051,
count=1, id=258, version=27051,
考勤异常信息统计结果查询工具.exe.vir
- IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
- SHA256 2da3ae187b621059a4e9c2be286d79d5b4e3371c3d2a1cdb2f76f7b895aff47e
- MD5 33b53d552861ded63f1c39eb195732fa
- SHA1 db3eb7f683fc782b1149b35927c03ec039d80ee1
- SHA512 d5016eaab5b64cd185345163556b4373366b6d048bd0d02e849c86fd2d478968c13db3f789c0c1789a20e141d8f17cc941f0a6b37b2676768b57804e101f9c5c
- SSDEEP 98304:IGd53n+zkSfHlHLtSEqtoixB0N5RWgz2yI32w6DU:fbjKlrZSlB0QgzioU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
418176
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
236KB
Virtual Size
607KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
295B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
376KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
34B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
647KB
Virtual Size
647KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
497KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
307KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ