5e4d4b4620a777f294cee42388dd700d030152c1d96d7d20ac2be7a383800d70
- SHA256 5e4d4b4620a777f294cee42388dd700d030152c1d96d7d20ac2be7a383800d70
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026.04.29裁员名单及补偿方案WPS.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026.04.29裁员名单及补偿方案WPS.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 5e4d4b4620a777f294cee42388dd700d030152c1d96d7d20ac2be7a383800d70
- Size 206KB
- Sample260429-mnxc7aaw21
- SHA256 5e4d4b4620a777f294cee42388dd700d030152c1d96d7d20ac2be7a383800d70
- MD5 10b67ba1eb781c04f5473d82e308d5de
- SHA1 4832caccc1b4f53cc9bf5880be3be8c8bacb6345
- SHA512 6bdcde232fca1d51558a20d4423799abf6bf6e3b9ec1394f8d234cb734764af2ae9aa4bcfbdb770dd798cbbce066cc7739802ce70e76cdc13e2c42f4d2927ef0
- SSDEEP 6144:FW4VSAqVsikcVHxWxwuyn6O24dRw+8DzZCqyIf5:Fp4rVsisCHF24dREDzZCcB
- TLSH T1E424234590EC42569735F53B1B53A2C42D8FA0E014EA936D22E43D4AD73CFEE743A92E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack002/2026.04.29裁员名单及补偿方案WPS.exe
File Explorer
-
5e4d4b4620a777f294cee42388dd700d030152c1d96d7d20ac2be7a383800d70.zip 206KB
-
2026.04.29裁员名单/2026.04.29裁员名单及补偿方案WPS.rar.rar 205KB
-
2026.04.29裁员名单及补偿方案WPS.exe.exe 485KB
2026.04.29裁员名单/2026.04.29裁员名单及补偿方案WPS.rar
- SHA256 586853514e5f2caeed84f1b9ef93463ab9d783f9a3ee673d90889d29aa9abaef
- MD5 e4ea876462589bbf01ad95ebd11f9d52
- SHA1 65b206e1e32a99d69449032387b344a6688516bb
- SHA512 535330cf5a40f3c1a8270ab8f9b1940ff22bc98b7b4e0f6ca6bdfc6fc21630657b068f50c06a5c95010faeda035c323d32cf64c8ed7c931623c33f068f1f44d6
- SSDEEP 6144:TW4VSAqVsikcVHxWxwuyn6O24dRw+8DzZCqyIfa:Tp4rVsisCHF24dREDzZCci
- TLSH T1F924234590EC42561B35F52B1B5362C42D8FA4E014EA936D23E93D4AD73CFEDB03A92E
- MD5 SHA1 SHA512 SSDEEP TLSH
2026.04.29裁员名单及补偿方案WPS.exe
- IMPHASH 068d31f962d279038667cf141732e0f5
- SHA256 ab823214b29d4fd7900762be4f2f63a3a022aa2ac556fe562e8f18e69ac757a8
- MD5 e0ff5616ea729be30b4efcddaa8d5816
- SHA1 6038daa6fe64b3a8fdad00b1591d37dc5f73c14f
- SHA512 bc26699441816ddf5aeb6590fd5d2472c41496d59bbf80d6839c2366e67b8bf6e10673ae71cd92a1efe318a480d33c9c6c2c6ae8ff34d345f0d6b9f45d37ca44
- SSDEEP 6144:NxtcYk/V8Uyt64fQRTzN/OBcUTCwqhRtUuZYFq6/yQHgl3LTdHU/Ve1F0:NxymUyg4fETw+xwqhRK06qwk3d0tP
- TLSH T165B45B47F99652BCD059C079834A8633E632B88A0730B9FB07D44A302E59FE67B3D759
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
ea:81:2f:60:e4:81:d9:84:6c:2e:b4:84:17:99:60:a4:53:2a:79:2b
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Beijing Kingsoft Security software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN
Chains
Nov 12, 2014
CN=Beijing Kingsoft Security software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 10, 2010 - May 10, 2015
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=Beijing Kingsoft Security software Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Kingsoft Security software Co.\,Ltd,L=beijing,ST=beijing,C=CN
Serial Number
07:bc:3a:51:b5:89:e5:af:43:29:1d:f8:4e:a4:c5:71
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 26, 2011 - Dec 25, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
6
Entry point
4416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
abort
calloc
exit
fflush
fprintf
free
fwrite
getenv
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcslen
advapi32
CloseServiceHandle
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
StartServiceW
SystemFunction036
bcrypt
BCryptGenRandom
kernel32
AddVectoredExceptionHandler
CloseHandle
CompareStringOrdinal
CreateFileMappingA
CreateFileW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FlushInstructionCache
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetSystemTimes
GetTempPathW
GetTickCount64
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalFree
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
PostQueuedCompletionStatus
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFileEx
ReadProcessMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetFileInformationByHandle
SetFileTime
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualAllocEx
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WriteConsoleW
WriteFileEx
WriteProcessMemory
__C_specific_handler
ntdll
NtCreateNamedPipeFile
NtOpenFile
NtQueryInformationProcess
NtQuerySystemInformation
NtReadFile
NtWriteFile
RtlGetVersion
RtlNtStatusToDosError
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
pdh
PdhCloseQuery
PdhRemoveCounter
powrprof
CallNtPowerInformation
psapi
GetModuleFileNameExW
GetModuleInformation
GetProcessMemoryInfo
shell32
CommandLineToArgvW
ShellExecuteExW
Name
.text
Size
378KB
Virtual Size
378KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ