Feishu-win32_x64-7[.]68[.]6-signed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Feishu-win32_x64-7.68.6-signed.exe
Size 352.6MB
Sample260629-e5kfysc14y
SHA256 23a5fd5ea49a60d6470c00f4cae9ddb459d5cdbc49a786486654e952b69254b5
MD5 672a8732636343cc8afcddb4b766b091
SHA1 cf57311c3eeda62802136b28ffd4cf699dcc0ac5
SHA512 a0c2946acbf147477570b2e761239ed672c7addd1cf13163200e49647d39cc9208af0ba86114ac275ff916cd4dca2297febbdc8e395ce4c76d91290f98bb6c2d
SSDEEP 6291456:ikjJ6aTCwHNx5SEqwqNtluggkHSCNgNKhxHZ9mYOHp4oaESqDhZ0:i3eCwtvlMu4Swggx5xOHOlESqdZ0
TLSH
T16F09332BB7A480F5D1ABC138C5568A86E6B17C064A30D75F13A4736E2F337B18D7A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Feishu-win32_x64-7.68.6-signed.exe

.exe 352.6MB

Feishu-win32_x64-7.68.6-signed.exe

IMPHASH 0bbcd0f2263d603906cdf113b9084828
SHA256 23a5fd5ea49a60d6470c00f4cae9ddb459d5cdbc49a786486654e952b69254b5
MD5 672a8732636343cc8afcddb4b766b091
SHA1 cf57311c3eeda62802136b28ffd4cf699dcc0ac5
SHA512 a0c2946acbf147477570b2e761239ed672c7addd1cf13163200e49647d39cc9208af0ba86114ac275ff916cd4dca2297febbdc8e395ce4c76d91290f98bb6c2d
SSDEEP 6291456:ikjJ6aTCwHNx5SEqwqNtluggkHSCNgNKhxHZ9mYOHp4oaESqDhZ0:i3eCwtvlMu4Swggx5xOHOlESqdZ0
TLSH
T16F09332BB7A480F5D1ABC138C5568A86E6B17C064A30D75F13A4736E2F337B18D7A361
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

de:17:69:ba:bf:d3:72:fb:5f:e6:43:58:31:33:c8:56:47:94:af:05:dd:04:16:54:c8:08:ba:40:75:e7:bc:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91110106MA0065EG39,CN=Beijing Feishu Technology Co.\,Ltd.,O=Beijing Feishu Technology Co.\,Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b5b7e6b780e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

May 13, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:2e:79:e0:e7:f4:0d:32:e9:54:fd:11:2e:df:a3:d4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 17, 2023 - Oct 17, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

931236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\ws\image_pkh_pvilo_alebb\6524\desktop\packages\builder\apollo-setup\Windows\Packet\LarkInstaller\bin\UnicodeRelease\LarkInstaller.pdb

kernel32

TerminateProcess CreateMutexW MoveFileExW MoveFileW TerminateThread GetCurrentProcessId RtlCaptureStackBackTrace WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx RaiseException CloseHandle DecodePointer SetFilePointer LoadLibraryExA VirtualQuery GetSystemInfo Sleep RemoveDirectoryW ReadFile GetFileSize DeleteFileW CreateFileW CreateDirectoryW CopyFileW GetModuleHandleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCurrentProcess CreateEventW SetEvent GetLastError GetTimeFormatW GetDateFormatW HeapFree GetTimeZoneInformation GetFileType SetStdHandle GetProcAddress MultiByteToWideChar WideCharToMultiByte FreeLibrary GetModuleFileNameW LoadLibraryExW LoadLibraryW CompareFileTime SetEndOfFile SetFileTime WriteFile SetLastError SetCurrentDirectoryW GetCurrentDirectoryW SetFileAttributesW GetTempPathW GetCurrentThreadId GetTickCount GetSystemDirectoryW GetWindowsDirectoryW FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetLogicalDriveStringsW GetModuleHandleA GetStdHandle GetACP OpenProcess MulDiv GlobalUnlock GlobalLock lstrlenW ExitProcess LocalFileTimeToFileTime SystemTimeToFileTime LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount FreeResource LoadResource LockResource SizeofResource FindResourceW CreateFileA GlobalAlloc GlobalFree GetLocalTime lstrcpynW lstrcmpiW lstrcpyW VerSetConditionMask GetEnvironmentVariableW ExpandEnvironmentStringsW FlushFileBuffers GetDiskFreeSpaceExW GetFinalPathNameByHandleW QueryDosDeviceW GetVersionExW QueryFullProcessImageNameW VerifyVersionInfoW AllocConsole K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForMultipleObjects GetExitCodeProcess SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlPcToFileHeader RtlUnwindEx ExitThread ResumeThread GetModuleHandleExW GetCommandLineA GetCommandLineW RtlUnwind

user32

TranslateMessage DispatchMessageW PostMessageW CreateWindowExW IsWindow DestroyWindow SetWindowPos IsWindowVisible IsIconic IsZoomed CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos ScreenToClient MapWindowPoints GetSysColor IntersectRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow LoadImageW GetMessageW wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW ShowWindow EnableWindow RegisterWindowMessageW GetMenu SetPropW GetPropW AdjustWindowRectEx GetWindowLongPtrW SetWindowLongPtrW MoveWindow SetWindowRgn MessageBoxW UpdateLayeredWindow GetWindowRgn CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen IsWindowEnabled UpdateWindow EqualRect GetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW GetShellWindow GetWindowThreadProcessId PostQuitMessage EnumChildWindows EnumWindows MonitorFromWindow MonitorFromPoint ReleaseDC GetDC LoadCursorW OffsetRect UnionRect InflateRect SetCursor CharUpperW SetWindowTextW GetWindowRect GetSystemMetrics SetForegroundWindow SendMessageW UnregisterClassW GetMonitorInfoW

advapi32

AllocateAndInitializeSid RegSetValueExW RegQueryValueExW OpenProcessToken CheckTokenMembership AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RegEnumKeyExW DuplicateTokenEx EqualSid FreeSid GetTokenInformation RegDeleteKeyExW RegLoadKeyW RegQueryInfoKeyW RegOpenKeyExW GetUserNameW

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHBrowseForFolderW SHChangeNotify SHGetSpecialFolderPathW ShellExecuteW DragQueryFileW SHGetSpecialFolderLocation

comctl32

InitCommonControlsEx ord17 _TrackMouseEvent

gdiplus

GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipSetInterpolationMode GdipAddPathLine GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawRectangleI GdipDrawImageRectI GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawPath GdipFillRectangleI GdipFillPath GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipGetImageWidth GdipGetImageHeight GdipAddPathArc GdipImageGetFrameDimensionsCount

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

shlwapi

SHGetValueW PathIsNetworkPathW PathIsRelativeW PathFileExistsW StrStrIW PathIsDirectoryW StrChrW PathFindExtensionW PathFindFileNameW SHDeleteKeyW SHDeleteValueW SHSetValueW

ws2_32

gethostbyname gethostname WSAStartup

wintrust

CryptCATCatalogInfoFromContext WinVerifyTrust WTHelperProvDataFromStateData CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle

crypt32

CryptStringToBinaryA CryptDecodeObjectEx CertGetNameStringW

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptImportKeyPair BCryptEncrypt

gdi32

CreateRoundRectRgn CreateRectRgn PtInRegion GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps SetWindowOrgEx CreateDIBSection SetBitmapBits GetBitmapBits GetTextExtentPointA CreatePatternBrush EnumFontFamiliesExW GdiFlush TextOutW MoveToEx GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor SelectPalette ExtSelectClipRgn SelectClipRgn RealizePalette LineTo GetTextExtentPoint32W GetDIBits GetCurrentObject GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CreateDCA CombineRgn

ole32

CoInitialize CoTaskMemFree CoTaskMemAlloc CoUninitialize OleLockRunning CLSIDFromProgID CoInitializeSecurity CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop RegisterDragDrop CoCreateInstance CLSIDFromString

oleaut32

SysAllocString SysStringLen SysAllocStringLen VariantClear CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo VariantInit SysFreeString VariantCopy

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Sharing

General

Malware Config

Signatures

File Explorer

Feishu-win32_x64-7.68.6-signed.exe

kernel32

user32

advapi32

shell32

comctl32

gdiplus

imm32

shlwapi

ws2_32

wintrust

crypt32

bcrypt

gdi32

ole32

oleaut32

generic