d467c224d72b058838c37179a782bc3c8585be33ae67c8bf39850a1ba489e52c
- SHA256 d467c224d72b058838c37179a782bc3c8585be33ae67c8bf39850a1ba489e52c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dpf26422000001257905011_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
dpf26422000001257905011_setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target d467c224d72b058838c37179a782bc3c8585be33ae67c8bf39850a1ba489e52c
- Size 66KB
- Sample260527-pg9faads9j
- SHA256 d467c224d72b058838c37179a782bc3c8585be33ae67c8bf39850a1ba489e52c
- MD5 389aa5fefbcead4621991e6be335d2cc
- SHA1 9eeeff287cfd9625c4fc1f79eea93c24f4707868
- SHA512 b0dc4f767f998be1ff232c2ad3aeab96b9ab0f2ddc64d9f3a439c5df1e9e5969d1867e1f464e44fc7e1b2df24f3862442ea582450cb11444d5538509306a043f
- SSDEEP 1536:kNOlR99oNSMRcWu/TF7AUL9Osxqihqh7/FxW5IOvpOGggtR2ezAI6:BqxRnsF7AUL9OsxFhqJWpOGtaI6
- TLSH T149630204DA40F6737F2CA8AC21481719647EA38E91E7BE07D4FA745BA3B17463D80E59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/dpf26422000001257905011_setup.exe
File Explorer
-
d467c224d72b058838c37179a782bc3c8585be33ae67c8bf39850a1ba489e52c.zip 66KB
-
dpf26422000001257905011_setup.exe.exe 129KB
dpf26422000001257905011_setup.exe
- IMPHASH 40a7ea0846241a5a253a04efbccd5968
- SHA256 f23e0d2a4cf44cd0d1c5b710fb666872ddcb436406ae000b6eeba803acf7ee26
- MD5 c3c49f827801032281b6a22d0bd5807b
- SHA1 6a674b2b6c199ab7e9764405be4bd06ff392dce0
- SHA512 14d7bc8ae047458679a9588ce387c87417df279dae5e01544ac1e67f24f5233585ded06503f84265bb075c519c1ae028f147c7b28b6297b9be4125037a6cafb7
- SSDEEP 3072:oo80AtOVfRD6sLOYB+9U86p5BtWWUkVECj3NzV0:p8Xsf/OYs9y5B5lvZV0
- TLSH T1A7D34D87B6A172ECD077827484531646A772BC7107289BEF4BA046761F132D2EF3BB51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
07:1e:eb:8b:84:1f:9d:f4:1a:cc:16:a0:82:91:b5:b6:b1:83:ef:07:b1:6a:38:cc:9f:ad:9f:21:8c:85:df:40
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN
Chains
Dec 15, 2025
CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN
Serial Number
08:2a:ff:1b:38:9a:02:07:e1:90:f4:92:d0:52:2a:17
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 11, 2024 - Nov 11, 2026
Subject
CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB
Serial Number
a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2025 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
18168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\新的e盘\yy\修改小马\x64\Release\250818.pdb
kernel32
LoadLibraryW
GetProcAddress
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapReAlloc
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
HeapSize
FlushFileBuffers
GetConsoleOutputCP
rpcrt4
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcExceptionFilter
RpcBindingFree
NdrClientCall3
ole32
StringFromGUID2
CoCreateGuid
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=18, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33145,
count=101, id=1, productName=Unmarked objects,
count=3, id=265, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,