3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4

Sharing

Copy URL Twitter E-mail

General

Target
3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4
Size 151KB
Sample240903-hpwe3azglm
SHA256 3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4
MD5 1a767b90b1277be18d2f0d6d0fdb4ede
SHA1 e4c8aca21e2600ede8a66b5bf05405fc106c4203
SHA512 70c5fce6ba496624d5d8f309380fa3571c9303efba82bc2298c1f667e903dafca627f9eb89463449908d1730458f2f91c3b021dcbad1a7bd438a067a92d825f3
SSDEEP 3072:NQ+rYDouSB6CLOkWQlRKlkl82lQBV+UdE+rECWp7hKfijj:8DoZTLOk5RakaBV+UdvrEFp7hKC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4

.exe 151KB

3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4

IMPHASH e4b30b230a9250f8822869541d1e6a1a
SHA256 3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4
MD5 1a767b90b1277be18d2f0d6d0fdb4ede
SHA1 e4c8aca21e2600ede8a66b5bf05405fc106c4203
SHA512 70c5fce6ba496624d5d8f309380fa3571c9303efba82bc2298c1f667e903dafca627f9eb89463449908d1730458f2f91c3b021dcbad1a7bd438a067a92d825f3
SSDEEP 3072:NQ+rYDouSB6CLOkWQlRKlkl82lQBV+UdE+rECWp7hKfijj:8DoZTLOk5RakaBV+UdvrEFp7hKC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

79:b5:02:92:c4:30:08:e2:a2:64:94:86:6f:bd:43:5d:f5:ee:9a:93:82:0f:fb:7e:d5:09:f7:cd:97:e4:89:fb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 16, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d2:9b:71:e1:4e:e7:c3:9f:09:7f:82:3d:82:81:b3:e5:d8:66:46:9d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Aug 16, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 17, 2022 - Jul 29, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:28:14:36:98:54:a8:5f:9b:8f:90:12:67:c0:3c:f2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 17, 2022 - Jul 29, 2025

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

35771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\winapps\gu6\exe\vc\GuProcessManagerService\sourcecode\gupmservice\Release\GUPMService.pdb

kernel32

FindResourceExW GetPrivateProfileStringW CreateMutexW SetPriorityClass GetPriorityClass OpenProcess ReleaseMutex GetPrivateProfileSectionW RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetTickCount FindResourceW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW InterlockedCompareExchange InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc LoadResource LockResource SizeofResource GetLogicalDriveStringsW lstrcmpiW QueryDosDeviceW lstrcatW GetCommandLineW lstrcpyW SetEvent InterlockedDecrement InterlockedIncrement GetCurrentThreadId GetModuleHandleW GetProcAddress CreateEventW CreateThread GetModuleFileNameW Sleep DeleteCriticalSection InitializeCriticalSection HeapDestroy WaitForSingleObject lstrlenW WideCharToMultiByte SetEndOfFile SetFilePointer WriteFile GetLastError CreateFileW CloseHandle QueryPerformanceCounter GetSystemTimeAsFileTime

user32

PostThreadMessageW GetMessageW DispatchMessageW TranslateMessage MessageBoxW CharUpperW CharNextW LoadStringW

advapi32

DeleteService OpenServiceW OpenSCManagerW SetServiceStatus DeregisterEventSource ReportEventW RegisterEventSourceW RegDeleteValueW RegCloseKey StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW ChangeServiceConfigW ChangeServiceConfig2W ControlService CloseServiceHandle CreateServiceW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW

shell32

ord165

ole32

CoUninitialize CoCreateInstance CoInitialize CoInitializeSecurity

oleaut32

SysFreeString UnRegisterTypeLi RegisterTypeLi SysStringLen

atl90

ord67 ord49 ord56 ord68 ord61 ord64 ord17 ord23 ord20

shlwapi

PathFileExistsW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

msvcr90

__set_app_type __p__fmode __p__commode __setusermatherr _configthreadlocale _initterm_e ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _invoke_watson _controlfp_s _adjust_fdiv _initterm _wcmdln exit _XcptFilter ??3@YAXPAX@Z memcpy_s memmove_s free _CxxThrowException calloc _recalloc __CxxFrameHandler3 _putws _vsnwprintf_s wcscpy_s wcsncpy_s wcsrchr wcsnlen memset wcschr _wcsnicmp _invalid_parameter_noinfo _wcsicmp wcsstr _vscwprintf vswprintf_s ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z _wtoi _except_handler4_common _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _amsg_exit __wgetmainargs _cexit _exit

Sharing

General

Malware Config

Signatures

File Explorer

3654fdab076963ca58eec6996b3a592841bde13c04ba3e53a36960e73cb256f4

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl90

shlwapi

msvcp90

psapi

msvcr90

generic