Latesten-v[.]winx--Setup[.]exe

Latesten-v.winx--Setup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 6d2c14b76193cfe77c0c7047449dfa1668e7ba5784f17a8964fc80a73fcbb8a2
MD5 2a897f05f2217690266588fb4214c819
SHA1 2c2a240a6b211e14f909bcd472fe83fc23931862
SHA512 813910bbf3c1f5e71951fb1df44cca7bc117083770e2b90c2001d9069f4ce3d87fad90b99695612d5510bd03254f2c7da95939968bba411ef8a26f43d0d40042
SSDEEP 24576:A0aNw7SGM9f7gx1zK/KAmoS2H6sGyE8T9SuUtJP99h+hBd3Ezu2FFl:AXGM9cx8r9lEGouuPvh+tol
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f8:c4:5c:fa:88:37:4f:d5:12:04:5f:d2:3c:f5:99:18:32:c3:b8:32:28:ab:09:ca:92:ac:dc:6a:fe:5b:93:94

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Free Time Software Technology Co.\, Ltd.,O=Free Time Software Technology Co.\, Ltd.,ST=Shanghai,C=CN

Chains

Apr 27, 2025

CN=Free Time Software Technology Co.\, Ltd.,O=Free Time Software Technology Co.\, Ltd.,ST=Shanghai,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Free Time Software Technology Co.\, Ltd.,O=Free Time Software Technology Co.\, Ltd.,ST=Shanghai,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Free Time Software Technology Co.\, Ltd.,O=Free Time Software Technology Co.\, Ltd.,ST=Shanghai,C=CN

Serial Number

02:35:85:ac:9c:85:1e:8e:c0:c0:98:59:1c:b1:7d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 15, 2025 - Apr 3, 2028

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/Bad.ppt

SHA256 146230651a8af2d571bcc7bf24b5abdd4c5bd36c87999a459ad85f1c5622432b
MD5 384b2a44d7ed2506175f7a8aee30681a
SHA1 8bef10b530122d2b0ab7127a1f29a5c95b867d3f
SHA512 65746bfe50792667ac27665faf4c338bf9522bd2c9cab794f0c8ff425e530076211815120ac767548f3992bc98f8d230db914c8f75ed0569b82d8a5947b97b04
SSDEEP 1536:Bgr4N/1iFYKiewSzXGyRSoaffIHay9MA/IQGTaYfbAVX2hRCn+BAmyPQ:Sr4x1iFYKbb7GyRKgH7ai8oX2hR73yPQ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Bucks.ppt

SHA256 941c214a10f3bccd6dbe7a4e90de7dfc7e46c42be8ef55a0600292a15428876a
MD5 43439e3e7dd1e89cd86207dd59b32228
SHA1 2f384788585932d782d1663cc6a587bd5cd93317
SHA512 5e1cb426c79e7c75302ec35e0b4b0e412a07303233b936261d93edfe0d5d49e4035f903e8a19fc53ac54d81154b9436f46da0851c81e79c07a75a1b2562cd1b8
SSDEEP 768:sLKU4FgXN4ExNnzBwVPfCrXHOtCsz0AEz:GQwbVwNqrXiQX
MD5 SHA1 SHA512 SSDEEP

$TEMP/Resistance.ppt

SHA256 41b0e3c801002943bfde4c3833d35e9ad66cedc8fdb7a754e8008d7859252ba1
MD5 7e97ce43fd0b39e5cb0afebf5c93211a
SHA1 4656713e9bbf651392c2dd8c341c40a203084f08
SHA512 f6af639c1f77b8a5f48c299caee19b24892caab33920376e75c46e951fdb7adf667c290873c9bee580a0d8a23b52f7619f8e9ad3b32861d648114b70a214bef0
SSDEEP 12288:Mu/Zl8KWvVjJiBoLG8wTfiJLBJlUfeWMLWsVjr4JErDCEPRpUS:3/0vVjJkoLG8yEFHUfm/VYJE/j/
MD5 SHA1 SHA512 SSDEEP

Accomplished

SHA256 97c1d9b0131d88ce2987025c88fed03bdaab4336bf2e702aa5b6a40150c3f679
MD5 652e3e72b2a6627431c06bc17c1b98b5
SHA1 30bb14fb7c218668dbf525bca993eee7be343257
SHA512 a2133958aff63a35787f011f5df456711421e8ad7b3ea1eadc50884f9b4682e5e0fa5fe2e7300da02fa1e57df0d6fa5c9af9dc23bf5368b0895167ecaee3f94b
SSDEEP 1536:ZJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3l:ZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRf
MD5 SHA1 SHA512 SSDEEP

Alto

SHA256 ab7056de9609c998cf24fb89094a66544505a85c56d8a64bc7a67fd81f2904fb
MD5 4eea3375b80689ca3410bdcb9e554712
SHA1 fe9b57293428628776a5f3c986212aac68db66cb
SHA512 6f2b9a563d4925f5b8a128ebd683e6b535f083df8d6e10f0bc77d981d636004dd4effd1d718a6d500ab64f615739da208877bfe550723c3c8b42cb2668cb875b
MD5 SHA1 SHA512

Beaver

SHA256 0ae168273aaf36b39fff1be347f440fc915b1ce101d70abd5bd4b925cd4a1f90
MD5 41eefc3707268cf6c5a332684cb439fe
SHA1 3dba4f5e5aae811415aeec68f118d992283fcf6b
SHA512 c44539ed75c5aef80adcc9df06f5416939c1e7e5caf8e3ff0fffc081c744ea78798f575405f70d3e3ef2517842d4e29b70358dcda805aa3a12b598fb19a4ddc0
SSDEEP 1536:oKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xu:u6whxjgarB/5elDWy4ZNoGmROL7Y
MD5 SHA1 SHA512 SSDEEP

Comfortable

SHA256 01f09807a3dfc6bc369149bed075f854ac235d188a130c8a5ebd88bf3e7f3686
MD5 11645e99f4c284df6d7afd0fe64ba43b
SHA1 49dd39b4425b7643d7ece2df972f3a72f98adc6d
SHA512 ed7a676113f1b470efeb362c68be836d77b4dbd9555087678b0815e0cfd43d884bd008da2921a613ead4a72d245694acc179bfd3b335ba39500605ada89571a7
SSDEEP 1536:uv18fRQLTh/5fhjLueoMmOrrHL/uDoiouK+r5bLmbZzW9FfTubb1/Dde6YF640LK:uv18mLthfhnueoMmOqDoioO5bLezW9Fd
MD5 SHA1 SHA512 SSDEEP

Demonstration

SHA256 7ed3ffb64c3df2339bdf59c2e90078212dc79d72bbf098d304033371f0cb9508
MD5 d90408e80ef19b27f99ffaa30e125f7a
SHA1 3c4d1371ddff4b33792675c6bc9c67a129bc9037
SHA512 d7872b567044f970cc34367a170a114a683a40fcef462fd7f20de6ca2454803d36537acdbba2dee226eda9ca35a472a0563f2e69cacfd869083fdce36b52268e
SSDEEP 3072:O5mjccBiqXvpgF4qv+32eOyKODOSpQSAU4Cz:OaccB3gBmmLsiS+SAhCz
MD5 SHA1 SHA512 SSDEEP

Diego

SHA256 08143592766cd5ff3e617c4747a40295679428f64a1304932574d22b58c0f787
MD5 03aabeb95963675bbe04a53b157aa7be
SHA1 947e36121cca27ecb74fb0d0d24850e9f8c5ee72
SHA512 cf48725cbe63a5f88305f81bcd710c0aeac955beb4441943ae105939f37dd9f7d328c3a6d43abf5d20346d8c2135a7285ea8df797e62b35a92d2c71294d5cde8
SSDEEP 1536:E8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneI:w0Imbi80PtCn
MD5 SHA1 SHA512 SSDEEP

Fact

SHA256 633a71fa627cde562d69a668f1a411d18a2875f4c2d7926aacc31199204f42a1
MD5 98c0143fd87bc94695f568368bb4f248
SHA1 17b50317dc983fd7fb153461f2537afdbaa78d52
SHA512 73b3360eeb6a37d4c2c6aade27e4f8e43da8bc90f3e34fd0e391b7a263bd34797568fdae37672c24892b18149dcad6ea856dab13fd3d92fab2f6cfd243e6451a
SSDEEP 3072:LPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIW:LPj0nEo3tb2j6AUkB0CThp6vmVn+
MD5 SHA1 SHA512 SSDEEP

Regulations

SHA256 4bc46c8b73d8f2b73d73cc4320e1ddc2ea41e3737fa22bee2ef0f549525256f3
MD5 1d395135ca8b921a48bb2416872cecbc
SHA1 3b3f9cf51a367adaa28c6a696be2bfbfa567de20
SHA512 48d2a443b5ef9a07d940eba914e9d4a86a68181d48c8a223230571a675e3ff916b1d6377e08bbb0a7f31678a32cb90ffd766b09154b9b17b2749c255c6a218cd
SSDEEP 768:YLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:YTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Sewing

SHA256 5a46529c20ad20ace46273d2e9076214add33861d34e871c293cf0f9817c9adb
MD5 7c6b4eb5397e60bff8af6915dd63838c
SHA1 7035ccf70f945071fa057eb9e3e9e796edf6ec2f
SHA512 323bae509be0dd520b78e880fea0637b01b2933f7059e01d3f66a3344eab1a30f6cb4ef64677a107d6b04a15de6cc9b53709c008fc29c382e1800a3d48030765
SSDEEP 1536:5j62SfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPI:5jfTq8QLeAg0Fuz08XvBNbjaAtsPI
MD5 SHA1 SHA512 SSDEEP

Works

SHA256 22cf3af5a0011f81d9f2a766d420fb1240f327f5199287cd746f1639d42414aa
MD5 7f94050c8ccb18d1d792d824b60e1df1
SHA1 9fbcc58823bc214f4dac0fdb0ae3aabd0df12fce
SHA512 a6cdbd6997c4c43479b39a756a21a74dca1ef5d9e209e2a648205f0dd176043aff1ccbc608720301abaa6607aad53639500c0335c6a86c85d18da6cabe2028d2
SSDEEP 3072:EZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfx:EK5vPeDkjGgQaE/loUDtfx
MD5 SHA1 SHA512 SSDEEP

$TEMP/Swimming.ppt

SHA256 8fa96cfa014172b1f1607d24138e14a71d729f5b822c4ae843aa71e21307cdf6
MD5 e53f3ad596e37bc1ae6ca9ae26295e94
SHA1 2fc1fcb1c81ffb26aba38558ce6ad165af8f9ca6
SHA512 48948e3d282aefcb8d2ca32eca4548706fc2e43b1b32e3b6014e9ae6027ce5ab2e9b3b1671d6e39d04c926a635c312b9ea684ac5b045d202c2ec84f2fbd2433c
SSDEEP 1536:5n+d/+LX9ZmR408RYlivpp5xQBkbX9e3J76N2oTjT+qlJnW2:5n+l+HmRp8RhLjQsc35Y2oTjT7HW2
MD5 SHA1 SHA512 SSDEEP

BlowCzech/Ghana.ppt

SHA256 60eadc3277f9db0ae1bd29c570313ad1f7ad49123b5ef88a4d9c84f65b4ead7e
MD5 958c4549bde1b7306155984892a1f963
SHA1 8e98f68be41cc64f522c26f218142bcb0a29dc1d
SHA512 9e653c6ceebf117eabb8496edfac57707399ac84812614e841f4f7c16e683f42eb469f4bc9aeb7de2892b318ef7ed2fa77cd1c9de1e489a4fb85cf459c1f06aa
SSDEEP 1536:7Z+izhL5+QglMAPXrmtw9ojgiocM77QpjBeQLCyqDGQv1B2+OSlT:5zn+8Av3ug4g7GhLfoGOLOSlT
MD5 SHA1 SHA512 SSDEEP

BlowCzech/Message.ppt

SHA256 e389f2519234f4a52125369689256fd1ef3860f4239fa3126a5859824b369094
MD5 48c14f3a3c4619586b8c79ce5e41b34b
SHA1 59ef016c015152371fe475ddf784a80bc444719b
SHA512 64a3908f5319f9dc038acab83fc8b4049513a2d10d2630778fd0584d1571acf42d33dde81cb4afd3ced6976cc0089325702584fca58add339269c1435b4b074c
SSDEEP 1536:RiyingzFG3ex+7FF++DIbzvQm5KsMXUDkXzdLt4LatI+ZnZKieza1aR5oleTPUL:R2gzFG3eM7FUbbpMXUq5R4mtI+jIJ5op
MD5 SHA1 SHA512 SSDEEP

JusticeInstalling/Ages.ppt

SHA256 085674a0085d57fb888804bcbe06b1701da5e92cd11082a86267a8b4b2d73423
MD5 8b5805a0d2cdbaa93483dc6888997432
SHA1 f4aacab3216d934eef368557be2ded6401b04c0f
SHA512 8389cdfe09c10e79e927072dc9a6426e5d964afc04a3c6ff2dbe4257059b69d4a6be6a98579478969e3acf82773d6747b8b933aa4e12a476e6a155c614956e0b
SSDEEP 768:7UKIpXEZlT5z7NjwLAV01RRZY19hL+5/2Lfd/NQHHPtITY4KJS4W:4pwTFVGyMOgmTYlJS5
MD5 SHA1 SHA512 SSDEEP

JusticeInstalling/Desirable.ppt

SHA256 dd2bfad6d773547e78be51ed5f104df27dd469fbd65f80155a1db8eda4c740df
MD5 923bf20a51d7ca0b1a005873a2831ba6
SHA1 788be0abbf388c65a6e2cca02fe117c244f72c0f
SHA512 083d70ff3447c1b8bbb14e96bf4bf4cc0d63a094ba59dca99039a0818d210137084e13e9e6c7fd25f94468956cf6b8db0736f749a6e4d810d153522e9b078718
SSDEEP 1536:O/suLGQl71Ck9h2ddMz7ckH/BlEzCoioWdYLln/rh0gW:+suLGo/h2vMzrH/7eCoc40gW
MD5 SHA1 SHA512 SSDEEP

JusticeInstalling/Talked.ppt

SHA256 6a2f63656e19a414d3869b88132d9f33f25fc680a5659f855b2f8dee19a25bfd
MD5 536a5999e7631789b886060127e3434f
SHA1 1c51f00ce8b7ecfc0248abf9a5a5ebff20821011
SHA512 043ff1d92c9bc8c5c4a2936dfd13d1255c321b4293be046ba2e3c2b34fc4510ecd005490ee2d3eeacc784f7332782b44b603d915c6687e08462ffa26766c3b91
SSDEEP 768:FEsmcN7UBeJEg/AgZjeQS/WE3JrdkQHADOibYMZDfV6uBww+l8Xem9SXhOk9Sys9:yPGUIJEgRhRSOE3bwqumPl8OkSHSy1U
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

Latesten-v.winx--Setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Bad.ppt

$TEMP/Bucks.ppt

$TEMP/Resistance.ppt

Accomplished

Alto

Beaver

Comfortable

Demonstration

Diego

Fact

Regulations

Sewing

Works

$TEMP/Swimming.ppt

BlowCzech/Ghana.ppt

BlowCzech/Message.ppt

JusticeInstalling/Ages.ppt

JusticeInstalling/Desirable.ppt

JusticeInstalling/Talked.ppt