98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa.zip
- SHA256 98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
V9se0A/37RXs3.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
V9se0A/37RXs3.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
V9se0A/UxEnhance64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
V9se0A/UxEnhance64.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target 98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa.zip
- Size 7.7MB
- Sample260429-nktcssaz7t
- SHA256 98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa
- MD5 5a3e63028a81cd58801444924f5f789b
- SHA1 e8aff39395532f7394e6f5addb8db7026951240a
- SHA512 19412036bcee7a01d58cf1e55db5ebf6c9091084680870a65a335de096d91ae76c38844d9e87206d8c78b6b4935b27d6bfd5213f1df76270eaac250f8142986c
- SSDEEP 196608:hiVurjfxpgofPYHL6dEA+7Cu2ghXeQcx+RO4/1T3nNnmUwmBYV0P:/p7Xy6ad7Bvc0ROATLA0P
- TLSH T1E78633DA25DACDF64A4847AD83238EA32736DB10872350685FE117E55FAEE5E4F0C831
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/V9se0A/UxEnhance64.dll
File Explorer
-
98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa.zip.zip 7.7MB
-
V9se0A/37RXs3.exe.exe 135KB
-
V9se0A/UxEnhance64.dll.dll 3.1MB
-
V9se0A/adoresd.dat.png 4.7MB
-
V9se0A/msadox.tb8KB
V9se0A/37RXs3.exe
- IMPHASH c79e73eafa46ab4b3f81c361fe54c70d
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
84:82:61:e4:18:7b:b8:af:1f:b0:5d:6e:9a:d6:fb:24:a6:8b:0e:a5:4e:2c:e6:7b:d8:08:ca:79:2e:fe:22:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
Jun 7, 2024
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Minor OS version
0
Major OS version
6
Entry point
8876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\qci_workspace\root-workspaces\__qci-pipeline-237585-1\output\platforms_output\Windows\bin\Release\UxEnhanceHost.pdb
uxenhance64
?DisableUxEnhance@@YA_NXZ
?EnableUxEnhance@@YA_NXZ
kernel32
TlsGetValue
WriteConsoleW
FlushFileBuffers
OutputDebugStringA
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventA
GetCurrentProcessId
OpenProcess
LocalFree
WaitForMultipleObjects
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
CreateFileW
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
GetStringTypeW
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
shell32
CommandLineToArgvW
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=121, id=243, version=40116,
count=13, id=242, version=40116,
count=8, id=259, version=24123,
count=35, id=261, version=24123,
count=18, id=260, version=24123,
count=2, id=261, version=23013,
count=6, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=101, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
V9se0A/UxEnhance64.dll
- IMPHASH 58e683abec29a387daf56221678b4318
- SHA256 8193ce8996b0c4b1a22591a28e58386661d3436c19bfc0cc7ceb754c5f742245
- MD5 61040878bf337a67235fe82a8400c392
- SHA1 31b7a09e4abfa902e54ba28485c501d3afabf8bd
- SHA512 68710be08b2050223d773f2459bf2ca374b8df1199832755cb0a3f2022585ea96c68069afc5ecbd06b2c93040a40965f0223ce5f85cd22e85223f51a56b96f5d
- SSDEEP 49152:k8xUfn0rHSPj8d2uTVwtOYy1Ce3MXWY8Wt6I0VjqB/3q2ieE4TedO3EMB/iwdZ5a:cfKS8d2P+3MWEk1Vej6dMEMkOZ5acbCB
- TLSH T162E522A572C638F7C066C7B5D42278AE317D3B41EF638D4FB3C86A019E121285B3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2467883
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
?DisableUxEnhance@@YA_NXZ
?EnableUxEnhance@@YA_NXZ
Name
.text
Size
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.%H"
Size
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.P[T
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.5aO
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
V9se0A/adoresd.dat
- SHA256 f2ecb0e8d52d53e242268540a0dbc969747cb64a30602c2654a11999c8ff4119
- MD5 850eab56de9b9932363ace507ac4073e
- SHA1 59d4f02c42911ad2a28e52684f08318849c93920
- SHA512 3d72e16db6ee5310d45ec52979e015352803e1fae50d4daafc044a01a299ba515d8045c0e12858493064ee2c8f26beb98ee4492127cc1fd425ea66036c1d43ca
- SSDEEP 98304:UFvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:wVatVNxzgwhPGHboKtGo3ayjE
- TLSH T1703633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
- MD5 SHA1 SHA512 SSDEEP TLSH
V9se0A/msadox.tb
- SHA256 fc76cf5289a70e0dc82f8d0e1708539c1640d954937a5c70cbe048d4115807ea
- MD5 2e7cd5c0b6f4e712dc2d498379e0f3b9
- SHA1 c06c637391aadf61f0511958ce3dc72d0d490707
- SHA512 f0f7571d4ccc23973c4751401238e416ce8aba6804cc4ce88cee6742fb368a7ebe5532ddcd46ffb27c14abc1441347f08def1089a6d4853a303270d0c5fa9fc9
- SSDEEP 192:OqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:OsZqZOXQ3uqvR2Kfzp
- TLSH T13D029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH