34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8

Sharing

Copy URL Twitter E-mail

General

Target
34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8
Size 10.0MB
Sample260508-mwpcjsbs3j
SHA256 34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8
MD5 d1af55e73b098da25ff300afe0add6cb
SHA1 26685c7ee324f229a27c932ab69f83ebf7d46427
SHA512 4335683e81d84a903b001f6dd011895a905e34c500c3550d28bbf7cf0585a3e635e3f08cc725dc1d916857ffe0128834079e7805da605b053d21f00cd012cda8
SSDEEP 98304:eR0mFmw0MGZJIdOgQlyuXk+huEmFmw0MGZJIdOgQlyuXk+hbsdxnRyaEYTY+:u5pbGbIilychIpbGbIilychgFB
TLSH
T187B6E1E16DEBC03AF0739FB24AD471FADA6EB6221706687F10E0C3060952582DDB557B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8

File Explorer

34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8

.exe 10.0MB

34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8

IMPHASH 61c685b242c2e37a9aca37da9e400c25
SHA256 34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8
MD5 d1af55e73b098da25ff300afe0add6cb
SHA1 26685c7ee324f229a27c932ab69f83ebf7d46427
SHA512 4335683e81d84a903b001f6dd011895a905e34c500c3550d28bbf7cf0585a3e635e3f08cc725dc1d916857ffe0128834079e7805da605b053d21f00cd012cda8
SSDEEP 98304:eR0mFmw0MGZJIdOgQlyuXk+huEmFmw0MGZJIdOgQlyuXk+hbsdxnRyaEYTY+:u5pbGbIilychIpbGbIilychgFB
TLSH
T187B6E1E16DEBC03AF0739FB24AD471FADA6EB6221706687F10E0C3060952582DDB557B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

20:44:25:88:31:66:6b:fa:6d:1f:b2:c8:76:0d:67:0a:d6:d0:68:bd:f3:49:a3:c6:80:4d:d8:fc:a5:7b:31:73

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91460000MAD2AQD357,CN=海南聚火科技有限公司,O=海南聚火科技有限公司,L=海口市,ST=海南省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b5b7e58fa3e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b5b7e58d97e79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 25, 2025

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2025,O=Asseco Data Systems S.A.,C=PL

Serial Number

9e:9c:04:f6:55:a8:b4:a7:02:6d:49:8c:6c:78:8d:aa

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 7, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

4e:ba:61:42:ea:81:cf:3d:2e:f2:c4:28:91:a7:db:6b

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 20, 2025 - Jan 20, 2028

Minor OS version

Major OS version

Entry point

108083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource FindResourceW GetTickCount LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess FindClose MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW WideCharToMultiByte VirtualQuery SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime lstrcmpiW LoadLibraryExW InitializeCriticalSection WriteConsoleW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetStdHandle GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc TryEnterCriticalSection GetProcessHandleCount TerminateProcess OpenProcess GetCurrentProcessId HeapFree WriteFile EnterCriticalSection LeaveCriticalSection RaiseException GetCurrentThreadId GetModuleHandleW IsDebuggerPresent CreateEventW GetModuleFileNameW Sleep CloseHandle CreateFileW ExitProcess FreeResource GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount

user32

GetMessageW TranslateMessage DispatchMessageW ReleaseDC DestroyWindow MessageBoxW PeekMessageW DefWindowProcW CharNextW MonitorFromWindow GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW SendMessageW GetWindowLongW WaitForInputIdle

gdi32

GetDeviceCaps DeleteDC GetObjectW DeleteObject CreateCompatibleDC SetDIBColorTable CreateDIBSection SelectObject

advapi32

RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VarUI4FromStr

comctl32

ImageList_Create ImageList_Destroy InitCommonControlsEx ImageList_AddMasked

ws2_32

WSACleanup

gdiplus

GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdiplusShutdown GdipFree GdipGetImageWidth

Sharing

General

Malware Config

Signatures

File Explorer

34874978f167421e1480c85afa3bdfe3edb970c643ec396b5fc7176cf53f63d8

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic