5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208.exe
Size 3.9MB
Sample240827-jktlca1grp
SHA256 5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208
MD5 0220e55e567338d2ff26878a3a4ac252
SHA1 2d2e853e5221314208066e2c34993afabd884e63
SHA512 1963c455efed002b775e00fd0f226613a9b7ff90275e226e66888ae56adfbf248ac46eec1e57537b2a8a86e7dac2aabf0c26b7b7d245dae4a116c8f6f44c28b6
SSDEEP 49152:OR/KpmZub9f2S8W2ILeWl+C1p9jWy5Snd0eigXJCkF1dnJbMeVJoXxBatJFVUXYq:Y/jTYLP1Sy5E0Be10eVJwBwVaTcY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208.exe

.exe 3.9MB

5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208.exe

IMPHASH 16c8c7a62c852018ed02e453e144c998
SHA256 5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208
MD5 0220e55e567338d2ff26878a3a4ac252
SHA1 2d2e853e5221314208066e2c34993afabd884e63
SHA512 1963c455efed002b775e00fd0f226613a9b7ff90275e226e66888ae56adfbf248ac46eec1e57537b2a8a86e7dac2aabf0c26b7b7d245dae4a116c8f6f44c28b6
SSDEEP 49152:OR/KpmZub9f2S8W2ILeWl+C1p9jWy5Snd0eigXJCkF1dnJbMeVJoXxBatJFVUXYq:Y/jTYLP1Sy5E0Be10eVJwBwVaTcY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

e9:b6:c4:07:9f:0f:96:e9:60:08:95:eb:4e:92:60:dc:39:9a:21:29:ec:79:70:54:fa:81:5f:84:21:98:fc:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91131001320077680T,CN=Langfang Jinjie Health Technology Co.\, Ltd.,O=Langfang Jinjie Health Technology Co.\, Ltd.,L=Langfang,ST=Hebei,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Subject

Serial Number

37:0f:fe:e7:c9:66:69:39:1b:d0:0d:b0:50:de:30:e4

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2024 - Aug 15, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

2475172

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

mpr

WNetEnumResourceW WNetGetUniversalNameW WNetGetConnectionW WNetCloseEnum WNetOpenEnumW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB FlatSB_GetScrollInfo ImageList_Write ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_Draw ImageList_Remove

shell32

SHBrowseForFolderW ExtractIconW SHGetMalloc SHGetFileInfoW SHChangeNotify Shell_NotifyIconW ShellExecuteW SHGetPathFromIDListW ShellExecuteExW

user32

CopyImage CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx GetMessageW PeekMessageW MonitorFromWindow GetDlgCtrlID ScrollWindowEx SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW OffsetRect IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW GetSystemMenu WaitForInputIdle ShowOwnedPopups GetScrollRange GetScrollPos SetScrollPos GetActiveWindow SetActiveWindow DrawEdge InflateRect GetKeyboardLayoutList OemToCharBuffA LoadBitmapW DrawFocusRect EnumChildWindows GetScrollBarInfo SendNotifyMessageW ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics SetWindowLongW PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild ClientToScreen SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ExitWindowsEx ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetClassLongW ActivateKeyboardLayout GetParent CharToOemBuffA DrawTextW SetScrollRange InsertMenuItemW PeekMessageA GetPropW SetClassLongW MessageBoxW MessageBeep SetPropW SetRectEmpty UpdateWindow RemovePropW GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient SendMessageTimeoutW BringWindowToTop SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowPos SetWindowRgn GetMenuItemCount RemoveMenu AppendMenuW GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW DestroyCursor ReplyMessage GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowLongW GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement LoadTypeLib GetErrorInfo VariantInit VariantClear SysFreeString SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy RegisterTypeLib VariantChangeType VariantCopyInd

advapi32

RegSetValueExW RegEnumKeyExW AdjustTokenPrivileges OpenThreadToken GetUserNameW RegDeleteKeyW LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegQueryInfoKeyW AllocateAndInitializeSid FreeSid EqualSid RegDeleteValueW RegFlushKey RegQueryValueExW RegEnumValueW GetTokenInformation InitializeSecurityDescriptor RegCloseKey RegCreateKeyExW SetSecurityDescriptorDacl

netapi32

NetWkstaGetInfo NetApiBufferFree

kernel32

SetFileAttributesW SetFileTime GetACP GetExitCodeProcess IsBadWritePtr CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect QueryPerformanceFrequency FindNextFileW GetFullPathNameW VirtualFree ExitProcess HeapAlloc WriteProfileStringW GetCPInfoExW RtlUnwind GetCPInfo GetStdHandle FileTimeToLocalFileTime GetModuleHandleW FreeLibrary HeapDestroy CompareFileTime ReadFile CreateProcessW TransactNamedPipe GetLastError GetModuleFileNameW SetLastError FindResourceW OpenMutexW CreateThread CompareStringW CopyFileW CreateMutexW LoadLibraryA ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion RaiseException MoveFileW GlobalAddAtomW GetSystemTimeAsFileTime FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread GetLogicalDrives LocalFileTimeToFileTime SetNamedPipeHandleState LoadLibraryExW TerminateProcess LockResource FileTimeToSystemTime GetShortPathNameW GetCurrentThreadId UnhandledExceptionFilter MoveFileExW VirtualQuery GlobalFindAtomW VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex FlushFileBuffers LoadResource SuspendThread GetTickCount WritePrivateProfileStringW GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetSystemInfo GetCommandLineW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW DeviceIoControl GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW GetSystemDirectoryW DeleteFileW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateNamedPipeW ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetOverlappedResult GetSystemDefaultUILanguage EnumCalendarInfoW GetProfileStringW LocalAlloc GetUserDefaultLangID RemoveDirectoryW IsDBCSLeadByte CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

ole32

StgCreateDocfileOnILockBytes CoCreateInstance CLSIDFromString CoUninitialize IsEqualGUID OleInitialize CoFreeUnusedLibraries CreateILockBytesOnHGlobal CLSIDFromProgID OleUninitialize CoDisconnectObject CoInitialize CoTaskMemFree CoTaskMemAlloc StringFromCLSID

gdi32

Arc Pie SetBkMode SelectPalette CreateCompatibleBitmap ExcludeClipRect RectVisible SetWindowOrgEx MaskBlt AngleArc Chord SetTextColor StretchBlt SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable RoundRect RestoreDC SetRectRgn GetTextMetricsW RemoveFontResourceW GetWindowOrgEx CreatePalette CreateBrushIndirect PatBlt LineDDA PolyBezierTo GetStockObject CreateSolidBrush Polygon Rectangle MoveToEx DeleteDC SaveDC BitBlt Ellipse FrameRgn GetDeviceCaps GetBitmapBits GetTextExtentPoint32W GetClipBox Polyline IntersectClipRect GetSystemPaletteEntries CreateBitmap AddFontResourceW CreateDIBitmap GetStretchBltMode CreateDIBSection CreatePenIndirect SetStretchBltMode GetDIBits CreateFontIndirectW PolyBezier LineTo GetRgnBox EnumFontsW CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject SetBkColor CreateCompatibleDC GetObjectW GetBrushOrgEx GetCurrentPositionEx SetROP2 GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel ArcTo GdiFlush SetPixel EnumFontFamiliesExW GetPaletteEntries

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

30KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

68B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5dbc3e721cd340dd80bfa7d0127d920f5f2630aa4b3b3ecfb8d2af9f28f0e208.exe

PE Signature issue

mpr

comdlg32

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

kernel32

ole32

gdi32

generic