5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9.bin
Size 3.3MB
Sample260608-tzlt6ab17x
SHA256 5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9
MD5 31058b2f10d9d0ea0a095085f7f48419
SHA1 b30fc6a47f9ad18f9051ce9b2db195465239a7ce
SHA512 b9f76a25302f4e2be18d0b42e6e40446c6de5de726d39d35290c280bf63c5eb3279eaf113498c58a9063a39bf2c8e7c2e543f0954a6149eba73742408b4470cd
SSDEEP 49152:DIU6iTGtlqufVwASO711w8ShREFa6YbqKsf6qB+birSqho4fo+Acz+P+wwOrd7:M+iDKgM6JmbIo64Gw5d7
TLSH
T103F58D69B7A800E8D8AAC138C957462BD7B1BC1617B097CF1765A6790F33BD2523E70C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9.bin

.dll 3.3MB

5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9.bin

IMPHASH 373272abe64c96d4b1561fd2fa800ec0
SHA256 5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9
MD5 31058b2f10d9d0ea0a095085f7f48419
SHA1 b30fc6a47f9ad18f9051ce9b2db195465239a7ce
SHA512 b9f76a25302f4e2be18d0b42e6e40446c6de5de726d39d35290c280bf63c5eb3279eaf113498c58a9063a39bf2c8e7c2e543f0954a6149eba73742408b4470cd
SSDEEP 49152:DIU6iTGtlqufVwASO711w8ShREFa6YbqKsf6qB+birSqho4fo+Acz+P+wwOrd7:M+iDKgM6JmbIo64Gw5d7
TLSH
T103F58D69B7A800E8D8AAC138C957462BD7B1BC1617B097CF1765A6790F33BD2523E70C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1a:09:bb:f2:9d:4d:e3:6f:9e:bb:00:a5:c9:fd:d1:22:f7:e0:64:c6:b2:cd:ec:00:12:90:f0:e3:a2:dc:62:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91420100MA49NX8T6M,CN=Wuhan Yichuang Technology Co.\, Ltd.,O=Wuhan Yichuang Technology Co.\, Ltd.,L=Wuhan,ST=Hubei,C=CN,1.3.6.1.4.1.311.60.2.1.1=#1305577568616e,1.3.6.1.4.1.311.60.2.1.2=#13054875626569,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 7, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

31:32:dc:9f:e2:9b:88:e0:bc:37:dc:1b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 31, 2025 - Apr 1, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1970824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

SetThreadLocale GetThreadLocale DecodePointer EncodePointer MultiByteToWideChar lstrcmpiW VirtualAlloc SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLastError RaiseException OutputDebugStringW SetEndOfFile WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetCurrentDirectoryW SetStdHandle GetFileSizeEx SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW WideCharToMultiByte HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InitializeCriticalSection GetLocalTime LoadLibraryW CloseHandle GetFullPathNameW GetCurrentProcessId GetCurrentThreadId SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA LoadLibraryA FormatMessageA GetCurrentProcess VirtualFree GetEnvironmentVariableW GetStdHandle GetFileType WriteFile GetACP QueryPerformanceCounter GetSystemTimeAsFileTime RtlVirtualUnwind GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW IsDebuggerPresent GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount CreateEventW GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx InterlockedFlushSList GetModuleHandleExW ReadFile ExitProcess SetConsoleCtrlHandler CreateFileW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind

user32

CharNextW MessageBoxW GetUserObjectInformationW GetProcessWindowStation

advapi32

RegQueryInfoKeyW ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegFlushKey RegQueryValueExW RegSetValueExW

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc

oleaut32

SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysFreeString

ws2_32

send closesocket connect inet_ntoa inet_addr htons htonl shutdown WSACleanup WSAStartup gethostbyname select ntohs getsockopt ioctlsocket setsockopt socket recv WSASetLastError getservbyport WSAGetLastError getservbyname gethostbyaddr

shlwapi

PathFindFileNameA

bcrypt

BCryptGenRandom

GetHandleVerifier IsSandboxedProcess RelaunchChromeBrowserWithNewCommandLineIfNeeded cef_add_cross_origin_whitelist_entry cef_api_hash cef_base64decode cef_base64encode cef_begin_tracing cef_binary_value_create cef_browser_host_create_browser cef_browser_host_create_browser_sync cef_browser_view_create cef_browser_view_get_for_browser cef_clear_cross_origin_whitelist cef_clear_scheme_handler_factories cef_command_line_create cef_command_line_get_global cef_cookie_manager_create_manager cef_cookie_manager_get_blocking_manager cef_cookie_manager_get_global_manager cef_crash_reporting_enabled cef_create_context_shared cef_create_directory cef_create_new_temp_directory cef_create_temp_directory_in_directory cef_create_url cef_currently_on cef_delete_file cef_dictionary_value_create cef_directory_exists cef_display_get_alls cef_display_get_count cef_display_get_matching_bounds cef_display_get_nearest_point cef_display_get_primary cef_do_message_loop_work cef_drag_data_create cef_enable_highdpi_support cef_end_tracing cef_execute_java_script_with_user_gesture_for_tests cef_execute_process cef_format_url_for_security_display cef_get_current_platform_thread_handle cef_get_current_platform_thread_id cef_get_extensions_for_mime_type cef_get_mime_type cef_get_min_log_level cef_get_path cef_get_temp_directory cef_get_vlog_level cef_image_create cef_initialize cef_is_cert_status_error cef_is_cert_status_minor_error cef_is_web_plugin_unstable cef_label_button_create cef_launch_process cef_list_value_create cef_load_crlsets_file cef_log cef_menu_button_create cef_menu_model_create cef_now_from_system_trace_time cef_panel_create cef_parse_json cef_parse_jsonand_return_error cef_parse_url cef_post_data_create cef_post_data_element_create cef_post_delayed_task cef_post_task cef_print_settings_create cef_process_message_create cef_quit_message_loop cef_refresh_web_plugins cef_register_extension cef_register_scheme_handler_factory cef_register_web_plugin_crash cef_register_widevine_cdm cef_remove_cross_origin_whitelist_entry cef_request_context_create_context cef_request_context_get_global_context cef_request_create cef_resource_bundle_get_global cef_response_create cef_run_message_loop cef_scroll_view_create cef_server_create cef_set_crash_key_value cef_set_osmodal_loop cef_shutdown cef_stream_reader_create_for_data cef_stream_reader_create_for_file cef_stream_reader_create_for_handler cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_string_ascii_to_utf16 cef_string_ascii_to_wide cef_string_list_alloc cef_string_list_append cef_string_list_clear cef_string_list_copy cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_clear cef_string_map_find cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_clear cef_string_multimap_enumerate cef_string_multimap_find_count cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf16_alloc cef_string_userfree_utf16_free cef_string_userfree_utf8_alloc cef_string_userfree_utf8_free cef_string_userfree_wide_alloc cef_string_userfree_wide_free cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf16_set cef_string_utf16_to_lower cef_string_utf16_to_upper cef_string_utf16_to_utf8 cef_string_utf16_to_wide cef_string_utf8_clear cef_string_utf8_cmp cef_string_utf8_set cef_string_utf8_to_utf16 cef_string_utf8_to_wide cef_string_wide_clear cef_string_wide_cmp cef_string_wide_set cef_string_wide_to_utf16 cef_string_wide_to_utf8 cef_task_runner_get_for_current_thread cef_task_runner_get_for_thread cef_textfield_create cef_thread_create cef_time_delta cef_time_from_doublet cef_time_from_timet cef_time_now cef_time_to_doublet cef_time_to_timet cef_trace_counter cef_trace_counter_id cef_trace_event_async_begin cef_trace_event_async_end cef_trace_event_async_step_into cef_trace_event_async_step_past cef_trace_event_begin cef_trace_event_end cef_trace_event_instant cef_translator_test_create cef_translator_test_ref_ptr_library_child_child_create cef_translator_test_ref_ptr_library_child_create cef_translator_test_ref_ptr_library_create cef_translator_test_scoped_library_child_child_create cef_translator_test_scoped_library_child_create cef_translator_test_scoped_library_create cef_unregister_internal_web_plugin cef_uridecode cef_uriencode cef_urlrequest_create cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_v8stack_trace_get_current cef_v8value_create_array cef_v8value_create_array_buffer cef_v8value_create_bool cef_v8value_create_date cef_v8value_create_double cef_v8value_create_function cef_v8value_create_int cef_v8value_create_null cef_v8value_create_object cef_v8value_create_string cef_v8value_create_uint cef_v8value_create_undefined cef_value_create cef_version_info cef_visit_web_plugin_info cef_waitable_event_create cef_window_create_top_level cef_write_json cef_xml_reader_create cef_zip_directory cef_zip_reader_create

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/ge9

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5f84809a778841f1dc64bc43d6bb1a822d6aa04a3ae65c5f9ad31a7fcb2cbca9.bin

kernel32

user32

advapi32

ole32

oleaut32

ws2_32

shlwapi

bcrypt

generic