d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
- SHA256 d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
shaxiang/UxEnhance64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
shaxiang/UxEnhance64.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
shaxiang/p5ALWJ.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
shaxiang/p5ALWJ.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
- Size 7.9MB
- Sample260703-mg9pyact8l
- SHA256 d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
- MD5 40e4232991b71373757ea2afecafd6b5
- SHA1 6141105d187c98f095aafd875f0aa48ecf3c6a97
- SHA512 007fa1fdc7b576c9bdff008412dacb602e4ec3613056bde157e610449767366f39ace2c700961a8eba2fa5ef665c052fad5c688a50e55b6531be46b17676342d
- SSDEEP 196608:N6PXhgjlXIdrCm5oVPEyyxz9CE3inKRnfnp2Sbn:ghgjlYx5oV/6BJfpT7
- TLSH T10286332243AFA851ECC7B0F499BE625AF7591E40F7F2941975AC94833023BFBE156B04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/shaxiang/UxEnhance64.dll
File Explorer
-
d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a.zip 7.9MB
-
shaxiang/SiPolicy.p7b24KB
-
shaxiang/UxEnhance64.dll.dll 3.1MB
-
shaxiang/adoresd.dat.png 4.8MB
-
shaxiang/msadox.tb8KB
-
shaxiang/p5ALWJ.exe.exe 135KB
shaxiang/SiPolicy.p7b
- SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
- MD5 c99441a9b83d3866d88abfdf45894d3d
- SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
- SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
- SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
- TLSH T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
- MD5 SHA1 SHA512 SSDEEP TLSH
shaxiang/UxEnhance64.dll
- IMPHASH 58e683abec29a387daf56221678b4318
- SHA256 abfa2767761a1cb6f10ea40aea491a505f7cb44aa3f91168896b3e5daba7cd86
- MD5 110850adc7efd5ecc89df4054c98b7ab
- SHA1 f51c9f69bba9a7ee19add382c939fab3fe434c39
- SHA512 227b590e20b29b86f9c3b37540da0f1b6858ee20e206daca59993e0f0ad40f513601e64be6bb6dad51aed1fc589be067b38a3250f20ae8828fe20ed659d1ec85
- SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdT:KmVLh6Kl975jywfnI8vdT
- TLSH T1EEE523A1B6D739B6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4991748
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
?DisableUxEnhance@@YA_NXZ
?EnableUxEnhance@@YA_NXZ
Name
.text
Size
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Ias
Size
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.LUx
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.\OF
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
shaxiang/adoresd.dat
- SHA256 a98529417571625b9f4bbca59ae72ddde58a4ca8c92abf9c54955300b01736a7
- MD5 5cc3f1dc5a6e06090103ee23217bf7b6
- SHA1 b81f281697b504211e7928458a50b783457ae96c
- SHA512 830147f647769da3f8ae19dfa5aae5da725d89aab782e2a6d57b56a369d3fe37a2730ac17064216b3ca745250522b34030667ec0715bf0b2ced505b9beec7de4
- SSDEEP 98304:GuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:LQDPnORb7AdPEm7Y7ltlVgxs
- TLSH T136363339536D9C62DDC7A0F8A49E4596FF683D60FAE2A006B47C1D213015DFB986FE08
- MD5 SHA1 SHA512 SSDEEP TLSH
shaxiang/msadox.tb
- SHA256 1fec09576ac32464a5d0a9eb7b30450e47a0a9b8a652b57f688747eca61e3fbc
- MD5 96eba7badcd0b513e48577515c2c5660
- SHA1 179f17a685d805e549b3b71be861dccd1f42f2fc
- SHA512 a8101f78275a87773c1e743244fe2614da61031028e335754a30cfc0272af040416749f7c7be3c694b95db820edef2748074f8eeb070017009ef2f2184e3819b
- SSDEEP 192:VqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:VsZqZOXQ3uqvR2Kfzp
- TLSH T167029E05D7A20DC3D3016C71CD9EB2F5AB13A1DADA3926719C67D4C1670B2DD2CE620D
- MD5 SHA1 SHA512 SSDEEP TLSH
shaxiang/p5ALWJ.exe
- IMPHASH c79e73eafa46ab4b3f81c361fe54c70d
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
84:82:61:e4:18:7b:b8:af:1f:b0:5d:6e:9a:d6:fb:24:a6:8b:0e:a5:4e:2c:e6:7b:d8:08:ca:79:2e:fe:22:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
Jun 7, 2024
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Minor OS version
0
Major OS version
6
Entry point
8876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\qci_workspace\root-workspaces\__qci-pipeline-237585-1\output\platforms_output\Windows\bin\Release\UxEnhanceHost.pdb
uxenhance64
?DisableUxEnhance@@YA_NXZ
?EnableUxEnhance@@YA_NXZ
kernel32
TlsGetValue
WriteConsoleW
FlushFileBuffers
OutputDebugStringA
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
CreateEventA
GetCurrentProcessId
OpenProcess
LocalFree
WaitForMultipleObjects
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
CreateFileW
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
GetStringTypeW
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
shell32
CommandLineToArgvW
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
196B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=121, id=243, version=40116,
count=13, id=242, version=40116,
count=8, id=259, version=24123,
count=35, id=261, version=24123,
count=18, id=260, version=24123,
count=2, id=261, version=23013,
count=6, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=101, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,