3e07c1732acff5a9091e0deeba01bd40N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3e07c1732acff5a9091e0deeba01bd40N.exe
Size 572KB
Sample240905-r6wltstepc
SHA256 3b678b1503b9170555550401e3137331b226cfa619cb90fa5d6f08e8a79d4d80
MD5 3e07c1732acff5a9091e0deeba01bd40
SHA1 9da789174a58450b1d2d6757e7aa4686d99cc0be
SHA512 7edd6b7ebe6e3623683780b06d893813167c6368c992ffbeaf44575fd19e09c478f3dafe6302f4b63a497b7bb9e782ebd52ba97d5543a18499dfd02116bdbbca
SSDEEP 12288:xxFCjf0he63DV82F2fpZluLzhkEnjbmXoCQICrZuTQKn7q4Y/En4lnZBjvrEH78R:xxFPMZlMz9INCgUKe4Y/KcnHrEH78R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

3e07c1732acff5a9091e0deeba01bd40N.exe

.dll 572KB

3e07c1732acff5a9091e0deeba01bd40N.exe

IMPHASH a8e4e1fe33697a4cfe2bb5ea52824f1f
SHA256 3b678b1503b9170555550401e3137331b226cfa619cb90fa5d6f08e8a79d4d80
MD5 3e07c1732acff5a9091e0deeba01bd40
SHA1 9da789174a58450b1d2d6757e7aa4686d99cc0be
SHA512 7edd6b7ebe6e3623683780b06d893813167c6368c992ffbeaf44575fd19e09c478f3dafe6302f4b63a497b7bb9e782ebd52ba97d5543a18499dfd02116bdbbca
SSDEEP 12288:xxFCjf0he63DV82F2fpZluLzhkEnjbmXoCQICrZuTQKn7q4Y/En4lnZBjvrEH78R:xxFPMZlMz9INCgUKe4Y/KcnHrEH78R
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

5f:26:d9:2c:01:d4:92:f4:f4:bf:08:f5:87:10:ac:ba:dd:8e:ad:cc:5d:30:6c:a6:30:fa:96:25:0f:24:5c:d3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91510107765360104N,CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6ada6e4beafe58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Sep 4, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

27:e3:22:b1:d7:fb:e4:a8:d7:09:d2:35:45:06:ac:a7:de:6d:cc:2c

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Sep 4, 2024

Subject

CN=CHENGDU YIWO Tech Development Co.\, Ltd.,O=CHENGDU YIWO Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

06:86:ed:40:3e:c1:bf:44:1c:8f:33:5c:84:1e:ea:00

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 30, 2019 - Oct 2, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:bd:22:19:37:f2:d7:96:fa:70:29:54:7b:19:03:01

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 21, 2022 - Dec 2, 2024

Minor OS version

Major OS version

Entry point

315529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\svn\clean\ShareLib\aliyunlog\Release\AliyunWrap.pdb

advapi32

CryptDestroyKey CryptEncrypt CryptReleaseContext CryptImportKey CryptAcquireContextA CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountNameW GetUserNameW RegCloseKey RegQueryValueExW RegOpenKeyW CreateProcessAsUserW OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor

ws2_32

htons ntohs WSAGetLastError getsockname setsockopt WSAIoctl WSAStartup WSACleanup socket select __WSAFDIsSet WSASetLastError send recv getsockopt gethostname ioctlsocket getaddrinfo freeaddrinfo listen accept recvfrom sendto connect closesocket getpeername bind

wldap32

ord35 ord32 ord200 ord30 ord79 ord143 ord33 ord301 ord217 ord211 ord27 ord41 ord46 ord50 ord26 ord22 ord60

kernel32

GetProcessHeap SetEndOfFile SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount FlushFileBuffers SetStdHandle GetCurrentDirectoryA GetFullPathNameA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP VirtualAlloc VirtualFree WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection ReleaseMutex LeaveCriticalSection CreateThread WaitForSingleObject CloseHandle Sleep CopyFileW SetLastError GetLastError FormatMessageA VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA LoadLibraryA GetProcAddress GetModuleHandleA QueryPerformanceFrequency SleepEx ReadFile PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle FreeLibrary GetTickCount QueryPerformanceCounter ExpandEnvironmentStringsA HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA EnterCriticalSection OpenProcess GetStartupInfoA SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetTimeZoneInformation RaiseException RtlUnwind ExitProcess HeapSize InterlockedDecrement InterlockedIncrement TlsFree SetEvent OpenEventW CreateEventW CreateMutexW GetCurrentProcess CreateProcessW GetFileAttributesA TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW CreateFileW WriteFile GetFileAttributesW GetPrivateProfileIntW GetLocalTime GlobalMemoryStatusEx GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeFormatA GetDateFormatA GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc HeapReAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetCurrentProcessId GetFileInformationByHandle SetFilePointer ExitThread GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue

shlwapi

StrRChrA

psapi

EnumProcessModules GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

rpcrt4

UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

3e07c1732acff5a9091e0deeba01bd40N.exe

PE Signature issue

PE Signature issue

advapi32

ws2_32

wldap32

kernel32

shlwapi

psapi

iphlpapi

rpcrt4

generic