ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f

Sharing

Copy URL Twitter E-mail

General

Target
ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f
Size 298KB
Sample240724-py2f1awepk
SHA256 ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f
MD5 531341bca3483ea43e5a5afd3ee2f328
SHA1 2279a3a72ee35340b443c55ce2df7090dd6efe60
SHA512 f6d7db245255b7488969d6196d3004c16866afefe46b87a73e8db1e2f6689accb23b4bfdb561632ec7e0c2aede7c9ad0cd2740cf37297078836a73ad4c4e0c05
SSDEEP 6144:2gnSY3FmZ5yFLtT6bXKcxskKAO7BherZsQrIvK:2/Z5yFL5WX9KtLeVFrIC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f

.exe 298KB

ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f

IMPHASH d4c283344803f1715714c4acaba00282
SHA256 ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f
MD5 531341bca3483ea43e5a5afd3ee2f328
SHA1 2279a3a72ee35340b443c55ce2df7090dd6efe60
SHA512 f6d7db245255b7488969d6196d3004c16866afefe46b87a73e8db1e2f6689accb23b4bfdb561632ec7e0c2aede7c9ad0cd2740cf37297078836a73ad4c4e0c05
SSDEEP 6144:2gnSY3FmZ5yFLtT6bXKcxskKAO7BherZsQrIvK:2/Z5yFL5WX9KtLeVFrIC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

25:00:eb:c1:bb:08:0e:b7:3d:89:35:58:69:7e:f3:ca:ca:51:99:79:ab:21:dd:83:3b:1f:d0:80:19:2f:fb:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91522730MA6DJY9R40,CN=Guizhou Qi'ang Kangyuan Rosa Roxburghii Development Co.\, Ltd.,O=Guizhou Qi'ang Kangyuan Rosa Roxburghii Development Co.\, Ltd.,L=Qiannan Buyi and Miao Autonomous Prefecture,ST=Guizhou,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Subject

Serial Number

23:d2:ca:ae:31:b7:54:60:ac:db:d1:b4:2d:6e:77:43

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2024 - Jun 14, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

36365

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\207\11404\Out\Win32\Release\kldw.pdb

psapi

GetProcessImageFileNameA

kernel32

CloseHandle SetFilePointerEx LocalFree GetFileSize GetExitCodeProcess HeapFree EnterCriticalSection GetCommandLineW OutputDebugStringA GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetFilePointer GetCurrentThreadId GetSystemDirectoryA LoadLibraryW HeapAlloc GetLocalTime GetProcAddress DeleteCriticalSection ReadProcessMemory GetCurrentProcessId GetProcessHeap FreeLibrary VirtualProtect GetHandleInformation VirtualAlloc TerminateProcess WaitForMultipleObjects GetProcessId UnmapViewOfFile DuplicateHandle OpenProcess SetEvent GetModuleHandleW InterlockedIncrement MapViewOfFile InitializeCriticalSectionAndSpinCount OutputDebugStringW RaiseException DecodePointer ExitProcess GetSystemDirectoryW LoadLibraryExW SetEndOfFile ReadConsoleW WriteConsoleW DeleteFileW GetDiskFreeSpaceExW GetLastError GetVersion CreateFileW WaitForSingleObject FindClose WriteFile GetCurrentProcess FindNextFileW FindFirstFileW CompareFileTime ReadFile MultiByteToWideChar WideCharToMultiByte GetStringTypeW EncodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead FindFirstFileExW GetModuleHandleExW FreeResource LockResource LoadResource FindResourceW RtlUnwind GetCommandLineA HeapReAlloc GetStdHandle GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle HeapSize

advapi32

RegQueryValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryInfoKeyW LookupPrivilegeValueW SetSecurityDescriptorDacl SetEntriesInAclA AdjustTokenPrivileges SetFileSecurityW AllocateAndInitializeSid OpenProcessToken FreeSid InitializeSecurityDescriptor

Sharing

General

Malware Config

Signatures

File Explorer

ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f

PE Signature issue

psapi

kernel32

advapi32

generic