97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303

Sharing

Copy URL Twitter E-mail

General

Target
97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303
Size 1.6MB
Sample241111-qcynnazbml
SHA256 97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303
MD5 874204395d1a596139f1d16c2daadf81
SHA1 e8812432261d9e61dff7f95d81c46bd0b74732ad
SHA512 ba52408de484d1e3370518bc22c2472887df8574e95fc3242f16ae07eac65040bfffe1d047656d65cb16859baa013a075644e2dae647570f40c8454f923ae14f
SSDEEP 24576:I1PggZFHyg7uGs+fxMy8KQMoapftjGKtNLfAaUtNLkTf+/53FEEs71Ay7vuy1uYs:IRRSFxKQMokRGKvQLkTm/5jWfuR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303

.exe 1.6MB

97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303

IMPHASH c25fb9485d19eb1486559fcdd395dffd
SHA256 97338e5c1aad55280d2d6ab72b8f9b41c66c3971c478f7f01b8a8f8481b0d303
MD5 874204395d1a596139f1d16c2daadf81
SHA1 e8812432261d9e61dff7f95d81c46bd0b74732ad
SHA512 ba52408de484d1e3370518bc22c2472887df8574e95fc3242f16ae07eac65040bfffe1d047656d65cb16859baa013a075644e2dae647570f40c8454f923ae14f
SSDEEP 24576:I1PggZFHyg7uGs+fxMy8KQMoapftjGKtNLfAaUtNLkTf+/53FEEs71Ay7vuy1uYs:IRRSFxKQMokRGKvQLkTm/5jWfuR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

c9:d1:7c:4e:49:21:fe:d4:0f:54:a3:33:ae:d3:56:9a:b7:aa:1f:68:ab:26:42:be:3c:36:ca:3c:a4:1a:75:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=成都斐阅科技有限公司,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Oct 15, 2021

CN=成都斐阅科技有限公司,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ad:1a:cf:ef:6e:e9:43:70:49:8d:aa:ba:fe:db:33:f4:51:d7:97:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=成都斐阅科技有限公司,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Chains

Oct 15, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=成都斐阅科技有限公司,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

03:c7:11:0e:9c:9a:43:ed:1e:61:e7:71:66:ec:6c:67

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 30, 2020 - Apr 18, 2023

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=成都斐阅科技有限公司,O=成都斐阅科技有限公司,L=成都市,ST=四川省,C=CN

Serial Number

04:9f:e8:44:1a:bc:3e:8b:bf:a7:31:14:73:7f:97:68

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 30, 2020 - Apr 18, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

615395

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\Gamebox\InstallAndUninstall\Release-Yxh\uninst.pdb

kernel32

CreateEventW DeleteFileW MoveFileExW DecodePointer InterlockedIncrement InterlockedDecrement FreeLibrary GetProcAddress GetShortPathNameW DebugBreak lstrcmpiW LoadLibraryExW GetModuleHandleW CopyFileW InterlockedExchange GetTickCount CloseHandle WaitForSingleObject SetEvent Sleep GetLongPathNameW LocalFree InitializeCriticalSection FindResourceExW FindResourceW GetModuleFileNameW SizeofResource LoadResource GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetFileInformationByHandle CompareFileTime FindCloseChangeNotification FindFirstChangeNotificationW SearchPathW CreateDirectoryW GetCurrentDirectoryW SetEndOfFile WriteConsoleW WaitForSingleObjectEx SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetWindowsDirectoryW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetTimeZoneInformation CreateProcessA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale EnterCriticalSection SetLastError GetLastError GetTimeFormatW GetDateFormatW GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread GetFileType SetStdHandle InterlockedFlushSList RtlUnwind FreeResource InterlockedCompareExchange lstrcmpiA lstrcmpA DeviceIoControl QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread FormatMessageW LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetDiskFreeSpaceExW GetSystemDirectoryW GetDriveTypeW GetLogicalDriveStringsW GetFileAttributesW CreateFileA GetFullPathNameW RemoveDirectoryW GetTempPathA DeleteFileA GetSystemWindowsDirectoryW GetCurrentThread GetLocalTime GetCommandLineW SetFileTime GetFileSizeEx GetExitCodeThread TerminateThread WTSGetActiveConsoleSessionId GetCurrentThreadId RaiseException ProcessIdToSessionId lstrlenW lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree OpenProcess GetCurrentProcessId CreateMutexW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVersionExW MulDiv VirtualAllocEx VirtualFreeEx GetCurrentProcess GetExitCodeProcess ReadProcessMemory WriteProcessMemory GetFileSize GetStdHandle WriteFile ReadFile FlushFileBuffers FindClose GetFileTime LoadLibraryW OutputDebugStringW GetPrivateProfileStringW GetTempPathW GetTempFileNameW CreateFileW SetFileAttributesW GetFileAttributesExW FindFirstFileW FindNextFileW MoveFileW AllocConsole GetConsoleWindow LocalAlloc TerminateProcess WaitForMultipleObjects CreateProcessW GetStartupInfoW Module32FirstW Module32NextW OutputDebugStringA SetFilePointer MapViewOfFile UnmapViewOfFile CreateFileMappingW GetSystemInfo GetSystemDefaultLangID ReleaseMutex lstrcmpW ResetEvent

user32

ReleaseDC GetDC GetSystemMetrics SetWindowPos DestroyWindow PostQuitMessage SendMessageW GetWindowTextLengthW RedrawWindow LoadCursorW GetParent SetWindowLongW GetWindowLongW GetWindowRect GetClientRect MoveWindow CopyRect SetRect OffsetRect IsRectEmpty SetCursor UpdateLayeredWindow IsWindowVisible SetTimer KillTimer SetWindowRgn FindWindowExW GetWindowThreadProcessId BringWindowToTop SetWindowTextW EndDialog GetActiveWindow IsDialogMessageW PtInRect SystemParametersInfoW WaitForInputIdle GetShellWindow PostThreadMessageW LoadStringW SendMessageTimeoutW UnregisterClassA BeginPaint EndPaint MapWindowPoints GetWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW LoadImageW MonitorFromWindow GetMonitorInfoW GetWindowTextW EnableWindow FindWindowW GetMessageW InvalidateRect ScreenToClient DialogBoxParamW PostMessageW ShowWindow TranslateMessage MessageBoxW CharNextW PeekMessageW DispatchMessageW

gdi32

SaveDC CreateCompatibleBitmap CombineRgn CreateRectRgn EnumFontFamiliesW CreateFontIndirectW GetDeviceCaps GetTextExtentPoint32W GetStockObject CreateCompatibleDC CreateFontW BitBlt RestoreDC ExtTextOutW SetBkMode SetBkColor SetViewportOrgEx SelectObject DeleteObject DeleteDC

advapi32

ImpersonateLoggedOnUser CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyW RegQueryValueExW SetTokenInformation CreateWellKnownSid GetLengthSid DuplicateTokenEx AllocateAndInitializeSid FreeSid CheckTokenMembership RevertToSelf GetTokenInformation RegEnumKeyExA CreateProcessAsUserW RegOpenKeyExA RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenCurrentUser OpenThreadToken EqualSid RegEnumValueW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W ControlService CreateServiceW DeleteService LockServiceDatabase QueryServiceConfigW QueryServiceConfig2W QueryServiceLockStatusW StartServiceW UnlockServiceDatabase CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam RegQueryValueExA CryptGenRandom

shell32

SHGetFolderPathA SHFileOperationW CommandLineToArgvW SHGetFolderPathW SHGetDesktopFolder SHGetSpecialFolderPathW SHCreateDirectoryExA SHGetSpecialFolderLocation SHGetPathFromIDListW ord165 SHCreateDirectoryExW ShellExecuteW ShellExecuteExW SHChangeNotify

ole32

CoSetProxyBlanket CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoTaskMemAlloc CoInitializeSecurity CLSIDFromProgID StringFromGUID2 OleRun CoCreateGuid CreateStreamOnHGlobal CoTaskMemFree CoTaskMemRealloc

oleaut32

SysAllocStringByteLen SysStringLen GetErrorInfo SetErrorInfo CreateErrorInfo SysFreeString VarUI4FromStr VariantChangeType VariantCopy VariantClear VariantInit SysAllocString SysStringByteLen

wininet

InternetCrackUrlW InternetSetCookieExW InternetGetConnectedState

shlwapi

SHGetValueA StrCmpNIW StrTrimA StrStrIW StrCmpIW StrToIntExW StrStrIA PathAppendW PathRemoveFileSpecW PathFileExistsW PathFindFileNameW PathIsRelativeW StrCmpW PathCanonicalizeW PathIsDirectoryW SHGetValueW SHSetValueW AssocQueryStringW PathCompactPathW PathFindExtensionA PathFindExtensionW PathFindFileNameA wnsprintfW PathCombineW PathRelativePathToW PathAppendA PathCombineA SHDeleteKeyW PathUnquoteSpacesW PathRemoveArgsW PathIsPrefixW SHSetValueA

comctl32

InitCommonControlsEx _TrackMouseEvent

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipDrawImagePointRectI GdipDrawImageRectRectI GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipDrawImageRectRect GdipGetImageHeight GdiplusShutdown GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdiplusStartup GdipGetImageWidth GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipAlloc GdipFree GdipCloneImage GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming

psapi

GetModuleFileNameExW EnumProcesses EnumProcessModules

urlmon

URLDownloadToCacheFileA URLDownloadToFileW URLDownloadToCacheFileW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

winmm

timeGetTime

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

secur32

GetUserNameExW

crypt32

CryptBinaryToStringA CryptStringToBinaryW CryptBinaryToStringW CryptStringToBinaryA CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

generic

count=17, id=241, version=40116,

count=183, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27031,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=6, id=261, version=27032,

count=5, id=199, version=41118,

count=24, id=259, version=26706,

count=35, id=260, version=26706,

count=78, id=261, version=26706,

count=1, id=260, version=27031,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=478, id=1, productName=Unmarked objects,

count=93, id=261, version=27031,

count=1, id=255, version=27031,

count=2, id=151,

count=1, id=258, version=27031,