4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053

Sharing

Copy URL Twitter E-mail

General

Target
4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053
Size 2.2MB
Sample260507-ll38aaev7m
SHA256 4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053
MD5 6616a72b35e3af40e22f8064ad85d7b5
SHA1 4fcd559740391c93855a9751884506ecbd3706b4
SHA512 e30782bb44f8e831d0bf2219e0731ecaedb3b44521ac32e7a78c0f68fc9bd90b39bab21ca8b4c0a519bded0a5ffa821479ddcfee3aaaffefaede68a52b600271
SSDEEP 49152:J37ouggggMCwEVKE089Phy9kMqzZZrKP/hN3toB:JL4EVKww9kfrghw
TLSH
T1B3B5BE12FB818573E483053595BB5BBF4C3EAA200329D4D39BD019799D706D2BA3F3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053

File Explorer

4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053

.exe 2.2MB

4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053

IMPHASH 8b698036ada0e26fc0728f8f08071389
SHA256 4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053
MD5 6616a72b35e3af40e22f8064ad85d7b5
SHA1 4fcd559740391c93855a9751884506ecbd3706b4
SHA512 e30782bb44f8e831d0bf2219e0731ecaedb3b44521ac32e7a78c0f68fc9bd90b39bab21ca8b4c0a519bded0a5ffa821479ddcfee3aaaffefaede68a52b600271
SSDEEP 49152:J37ouggggMCwEVKE089Phy9kMqzZZrKP/hN3toB:JL4EVKww9kfrghw
TLSH
T1B3B5BE12FB818573E483053595BB5BBF4C3EAA200329D4D39BD019799D706D2BA3F3A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c0:24:50:29:dc:3b:35:ee:9b:03:66:df:11:a3:97:8f:8f:75:07:4c:8e:79:44:a1:c0:be:1c:87:a0:8e:f8:d2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,O=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 15, 2023

CN=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,O=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

PE Signature issue

Digest

d4:49:bf:19:ab:a6:4d:eb:2b:c1:2b:1f:8d:0c:fb:72:75:8e:56:34

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,O=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 15, 2023

CN=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,O=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,O=Fashion Cloud Culture Media (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

52:42:27:c2:88:b2:c8:f0:a9:e6:2d:17:9b:f8:3d:35

Issuer

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2023 - Mar 23, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=WoTrus Code Signing 2021 CA,O=WoTrus CA Limited,C=CN

Serial Number

38:9c:d2:9d:8f:db:c7:39:f5:49:33:be:ce:98:93:b4

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 26, 2021 - May 18, 2027

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

223904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW MultiByteToWideChar VerSetConditionMask FindClose GetSystemTime GetNativeSystemInfo GetSystemDirectoryW FindFirstFileW FindNextFileW MoveFileExW VerifyVersionInfoW CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId WaitForMultipleObjects Sleep DeleteFileW FreeLibrary LocalFree LoadLibraryW GetVersionExW GetDriveTypeW CreateDirectoryW GetFileSize WriteFile ReadFile FileTimeToSystemTime CreateFileA CreateFileW GetFileAttributesExW MoveFileW VirtualQuery InitializeCriticalSection ReleaseMutex CreateMutexW DeviceIoControl GetSystemDirectoryA WaitForSingleObject OpenProcess GetCurrentProcess LocalAlloc TerminateProcess SetEvent GetCommandLineW VirtualAlloc VirtualFree VirtualProtect LoadLibraryA IsBadReadPtr WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer LoadResource DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind GetTimeZoneInformation GetFileType GetConsoleCP GetConsoleMode SetFilePointerEx ExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW FlushFileBuffers ReadConsoleW SetStdHandle SetEndOfFile WriteConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler DeleteFiber SwitchToFiber SetConsoleMode ReadConsoleA WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW SetLastError QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThreadId TryEnterCriticalSection CreateFiber GlobalMemoryStatus ConvertFiberToThread ConvertThreadToFiber SystemTimeToFileTime SizeofResource ChangeTimerQueueTimer LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent GetModuleFileNameW GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize GetEnvironmentVariableW LockResource HeapFree HeapReAlloc HeapAlloc DecodePointer GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetEnvironmentVariableA CompareFileTime SleepEx

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW DefWindowProcW

advapi32

CryptGetProvParam RegCreateKeyExW RegQueryValueExW GetUserNameW SetEntriesInAclW FreeSid AllocateAndInitializeSid RegOpenKeyExW RegSetValueExW InitializeSecurityDescriptor CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey RegCloseKey CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegDeleteValueW RegisterEventSourceW DeregisterEventSource RegDeleteKeyW LookupAccountSidW GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl

ole32

CoUninitialize CoInitialize

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathStripToRootW PathCombineW PathFileExistsW

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

urlmon

ObtainUserAgentString

shell32

SHGetFolderPathW CommandLineToArgvW

crypt32

CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore

ws2_32

sendto recvfrom WSAEventSelect gethostname WSAIoctl WSAEnumNetworkEvents WSACreateEvent WSACloseEvent freeaddrinfo getaddrinfo getnameinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup shutdown WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind closesocket recv send WSAGetLastError

wldap32

ord301 ord147 ord133 ord79 ord142 ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167

Sharing

General

Malware Config

Signatures

File Explorer

4814db11263efa6afe5ca1ee0dfd5c85f4eb305de529c1bb00888e776eea7053

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

ole32

shlwapi

version

urlmon

shell32

crypt32

ws2_32

wldap32

generic