b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048

Sharing

Copy URL Twitter E-mail

General

Target
b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048
Size 2.8MB
Sample241109-af9bkaskfv
SHA256 b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048
MD5 6ad23faf181c57af1ebef075a83b3471
SHA1 7187fdc1863c6559b5e6ec600502936b2360da71
SHA512 415ae76ecd2ddf4537cbe459dfb4dfa46d21a873fb34da68797ea045835eec5c31f080bd4d8fcad758de2aabc8bb6050078565274c5c6f9fcc44e3db9d6e17cf
SSDEEP 49152:KieXnLjdaEnJUi4bmd5GPxChCuQT8Ux+/5el:MXnPdVd4G5eChvU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048

.exe 2.8MB

b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048

IMPHASH c9463a795cac1d1b636ba2b46dd56a23
SHA256 b2248f853ce95df07f1bcd30d77a6c29696b0758c51a5e272fdae1fbe5c94048
MD5 6ad23faf181c57af1ebef075a83b3471
SHA1 7187fdc1863c6559b5e6ec600502936b2360da71
SHA512 415ae76ecd2ddf4537cbe459dfb4dfa46d21a873fb34da68797ea045835eec5c31f080bd4d8fcad758de2aabc8bb6050078565274c5c6f9fcc44e3db9d6e17cf
SSDEEP 49152:KieXnLjdaEnJUi4bmd5GPxChCuQT8Ux+/5el:MXnPdVd4G5eChvU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b7:7e:75:ec:95:e0:f2:e8:43:e2:00:20:89:23:be:20:a5:04:38:fa:e1:49:93:50:3b:e5:e6:84:75:c1:d1:65

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=913100006317722856,CN=Shanghai Oriental Webcasting Co. Ltd.,O=Shanghai Oriental Webcasting Co. Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 11, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:03:d3:41:0e:57:67:8d:f3:fc:a1:3a:38:44:3e:84

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 27, 2023 - Mar 24, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2968290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess WaitForSingleObject LocalAlloc OpenProcess CreateToolhelp32Snapshot Process32NextW GlobalAlloc Process32FirstW GlobalFree LocalFree CreateProcessW GetExitCodeProcess VirtualFree VirtualAlloc GetCurrentThreadId Sleep ReadProcessMemory GetModuleHandleW lstrcmpiW GetTickCount GetSystemInfo VirtualProtect SetLastError LoadLibraryA GetNativeSystemInfo IsBadReadPtr UnmapViewOfFile FlushViewOfFile MapViewOfFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent CreateThread SizeofResource InterlockedDecrement LoadResource FindResourceW InterlockedIncrement LoadLibraryExW GetEnvironmentVariableW RemoveDirectoryW CreateDirectoryW GetCurrentProcessId GetDriveTypeW GetFileSize MoveFileExW DeleteFileW FileTimeToSystemTime GetFileAttributesW GetTempPathW WriteFile ReadFile lstrcpyW FindClose GetLongPathNameW FindNextFileW FindFirstFileW WideCharToMultiByte GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc MultiByteToWideChar HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetModuleFileNameW GetPrivateProfileIntW lstrlenW WritePrivateProfileStringW GetPrivateProfileStringW GetSystemDirectoryW GetVolumeInformationW ReleaseMutex CreateMutexW FreeLibrary GetProcAddress LoadLibraryW CloseHandle SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW CopyFileW WTSGetActiveConsoleSessionId GetLastError GetVersionExW CreateFileW DeviceIoControl OutputDebugStringA GetCurrentProcess OpenFileMappingW SetPriorityClass GetUserDefaultLCID IsValidLocale FindFirstFileExW GetFullPathNameW GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx ExitThread RtlUnwind FreeLibraryAndExitThread GetThreadTimes SystemTimeToTzSpecificLocalTime WinExec OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FormatMessageA SleepEx WaitForMultipleObjects GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA VerSetConditionMask GetModuleHandleA GetSystemDirectoryA VerifyVersionInfoA GetModuleHandleExW SwitchToFiber DeleteFiber

user32

CharNextW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW LoadStringW

advapi32

RegCloseKey GetFileSecurityW SetFileSecurityW GetSecurityDescriptorDacl GetSecurityDescriptorControl AddAccessAllowedAce GetAce RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW SetTokenInformation CreateProcessAsUserW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor DuplicateTokenEx LookupAccountSidW GetTokenInformation RevertToSelf RegEnumKeyW ImpersonateLoggedOnUser RegOpenKeyW LookupAccountNameW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW RegCreateKeyW RegSetValueW EqualSid GetLengthSid InitializeAcl GetAclInformation AddAce

shell32

SHGetSpecialFolderPathW ShellExecuteExW SHGetSpecialFolderPathA SHFileOperationW SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW PathAddBackslashW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wldap32

ord33 ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord35 ord79 ord30 ord200 ord301

ws2_32

WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname

wtsapi32

WTSQueryUserToken

wininet

InternetSetOptionW InternetCloseHandle InternetQueryOptionW InternetOpenUrlW InternetReadFile HttpQueryInfoW InternetOpenW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

540KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

285KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

263KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=241, version=40116,

count=198, id=243, version=40116,

count=30, id=242, version=40116,

count=16, id=261, version=24245,

count=6, id=199, version=41118,

count=26, id=259, version=24237,

count=14, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=12, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=125, id=261, version=24237,

count=39, id=260, version=24237,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=412, id=1, productName=Unmarked objects,

count=55, id=265, version=24245,

count=1, id=255, version=24245,

count=1, id=151,

count=1, id=258, version=24245,