e2c9c800d0faf36a54eff4cf1dc88aa0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e2c9c800d0faf36a54eff4cf1dc88aa0N.exe
Size 186KB
Sample240901-hjxe6stgrp
SHA256 e986dd92d0b2fb4bc1c32179493d61ac972c54bcd5184c328688b1ab3131b8f0
MD5 e2c9c800d0faf36a54eff4cf1dc88aa0
SHA1 e6ced5de9843639acd86cd2a97d4b726528440dd
SHA512 0bc8405bb2c41c19dae929ab4990276206dd864fc62d5a2145bc56b40a251c61588f974d136735b5c3a1fdf0a814e5e18ecd132c46fa38fbae8a05026b71da2e
SSDEEP 3072:B0v7AWRX9d4CRCK7m2kNAHqz9MTROKSfX6LNpiedl2lQBV+UdE+rECWp7hKr8yHG:B0v7AgXX71kqK9MTROKSfXojTBV+Udvu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e2c9c800d0faf36a54eff4cf1dc88aa0N.exe

.dll 186KB

e2c9c800d0faf36a54eff4cf1dc88aa0N.exe

IMPHASH 95ead784b0640c46987d93db5567c1c1
SHA256 e986dd92d0b2fb4bc1c32179493d61ac972c54bcd5184c328688b1ab3131b8f0
MD5 e2c9c800d0faf36a54eff4cf1dc88aa0
SHA1 e6ced5de9843639acd86cd2a97d4b726528440dd
SHA512 0bc8405bb2c41c19dae929ab4990276206dd864fc62d5a2145bc56b40a251c61588f974d136735b5c3a1fdf0a814e5e18ecd132c46fa38fbae8a05026b71da2e
SSDEEP 3072:B0v7AWRX9d4CRCK7m2kNAHqz9MTROKSfX6LNpiedl2lQBV+UdE+rECWp7hKr8yHG:B0v7AgXX71kqK9MTROKSfXojTBV+Udvu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d1:63:05:4c:b0:01:87:ff:48:c0:a5:72:0a:6b:ec:09:62:6d:0a:f8:df:e7:a9:98:78:01:9e:01:94:ce:c5:9e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Aug 22, 2024

PE Signature issue

Digest

27:40:66:a0:22:87:ed:b1:91:f7:8e:99:79:2d:45:84:df:81:91:b0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Aug 22, 2024

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

06:86:ed:40:3e:c1:bf:44:1c:8f:33:5c:84:1e:ea:00

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 30, 2019 - Oct 2, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

01:09:1e:19:18:55:a7:0a:91:70:ef:18:e4:23:ea:d3

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 30, 2019 - Oct 2, 2022

Minor OS version

Major OS version

Entry point

72995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Project\shared\Output\Release\CodeLog.pdb

kernel32

WaitForSingleObject SetEvent GetLastError CreateEventW GetModuleHandleW GetProcAddress SetEndOfFile InterlockedIncrement SystemTimeToFileTime InterlockedDecrement SetFilePointerEx OutputDebugStringW UnlockFileEx GetPrivateProfileStringW WriteFile GetSystemDirectoryW GetVersionExW FileTimeToSystemTime GetModuleFileNameW CreateMutexW GetPrivateProfileIntW GetFileSizeEx LockFileEx LoadLibraryA GlobalMemoryStatusEx GetSystemInfo FileTimeToLocalFileTime GetCurrentProcessId GetSystemTime SetFileAttributesW SetErrorMode FreeLibrary GetLogicalDriveStringsW GetDiskFreeSpaceExW GetPrivateProfileIntA GetFileAttributesA GetPrivateProfileStringA GetModuleFileNameA GetPrivateProfileSectionNamesA HeapDestroy HeapCreate CreateThread CloseHandle GetCurrentThreadId GetExitCodeThread CreateFileW Sleep GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedExchange InterlockedCompareExchange ReleaseMutex OpenMutexW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetSystemTimeAsFileTime

user32

GetSystemMetrics

advapi32

RegQueryValueW RegOpenKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey

msvcr90

swprintf_s strcspn wcsrchr wcscat_s wcscpy_s mbstowcs vsprintf_s strcpy_s strcat_s _CxxThrowException __CxxFrameHandler3 ___lc_codepage_func ___lc_handle_func memset free fgetc fputc ungetc fflush setvbuf fwrite fgetpos fseek fsetpos fclose __iob_func abort setlocale __uncaught_exception _free_locale _malloc_crt __pctype_func __crtLCMapStringA isupper memcpy _calloc_crt islower _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common __clean_type_info_names_internal ??_V@YAXPAX@Z localeconv memchr sprintf_s ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ _purecall ??2@YAPAXI@Z memcpy_s ??3@YAXPAX@Z wcsstr _invalid_parameter_noinfo ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@XZ ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ memmove_s _vswprintf_c_l __RTDynamicCast

Sharing

General

Malware Config

Signatures

File Explorer

e2c9c800d0faf36a54eff4cf1dc88aa0N.exe

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

msvcr90

generic