Whyet-4[.]9[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Whyet-4.9.exe
Size 20.2MB
Sample241229-sefa7stpfx
SHA256 38622c32cac325c68f2fbf7148255a9813e7caeb53e3b95ebea56a6da5cb22ba
MD5 f317c17035501aaad0abfaf9fba4c085
SHA1 f522fec1296c065cd4c3eaf52d1c4fbc26fd9f28
SHA512 147e484e12adf36e9c3a446b3a08af2c274e4acdff04b2eb5a3164771b3eb9c7e1f15858289b7c19eabc97f99d06936ead9ff94ce05f892af45d757ac65a9d08
SSDEEP 393216:OecgR96USu2VkX3mGZHoRJ3+j8yvn7lbt0lWL:kVHemGZMkT7lbt0YL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Whyet-4.9.exe

.exe 20.2MB

Whyet-4.9.exe

IMPHASH 357b59ff56f808887438b8bd8ad0eaa6
SHA256 38622c32cac325c68f2fbf7148255a9813e7caeb53e3b95ebea56a6da5cb22ba
MD5 f317c17035501aaad0abfaf9fba4c085
SHA1 f522fec1296c065cd4c3eaf52d1c4fbc26fd9f28
SHA512 147e484e12adf36e9c3a446b3a08af2c274e4acdff04b2eb5a3164771b3eb9c7e1f15858289b7c19eabc97f99d06936ead9ff94ce05f892af45d757ac65a9d08
SSDEEP 393216:OecgR96USu2VkX3mGZHoRJ3+j8yvn7lbt0lWL:kVHemGZMkT7lbt0YL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

88:8f:99:b9:b9:9d:77:34:b8:ec:e6:43:5c:fd:6e:13:4e:90:5b:03:c4:9b:ec:35:0a:d1:79:b4:68:00:c5:d2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 24, 2023

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2022 - Jan 6, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

11548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

_lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA GetFileAttributesA RemoveDirectoryA DeleteFileA lstrlenA GetCurrentDirectoryA CloseHandle GetExitCodeProcess GetLastError LocalFree GetCurrentProcess MoveFileExA Sleep GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc HeapSize IsValidCodePage lstrcpyA GetTempPathA CompareStringA GetOEMCP GetACP GetModuleHandleW ExitProcess DecodePointer HeapFree HeapAlloc GetCommandLineA GetStartupInfoW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc RtlUnwindEx WriteFile GetStdHandle GetModuleFileNameW HeapSetInformation GetVersion HeapCreate FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

Whyet-4.9.exe

PE Signature issue

kernel32

user32

advapi32

shell32

generic