eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69

Sharing

Copy URL Twitter E-mail

General

Target
eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69
Size 170KB
Sample260706-e4e5vahx9s
SHA256 eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69
MD5 f1b8946e1ca25545fccd30360ee26d41
SHA1 a5c7f5707d4585a6cc0ef1632e3ceea3186ac047
SHA512 eb83f3ec5088e67c8d838e9cd236ffaaa9ded7257af390c3c119454bd6f41fcc8ecea349cd0b1f2bee57a96bec81ab6c2e405b23ed7b9c9845cba740c63cb57e
SSDEEP 3072:LEFTqrH/maft9iGznzp8jHW/rGeMI7/b2lQBV+UdE+rECWp7hK4:BTrviG6EGeMS3BV+UdvrEFp7hK4
TLSH
T18B048E423685C3F8E6641170346D7F7682E5A93D8FB601C7B3930E198A3C6D36D76A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69

File Explorer

eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69

.dll 170KB

eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69

IMPHASH e59236405816160206bb3609724eb4a9
SHA256 eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69
MD5 f1b8946e1ca25545fccd30360ee26d41
SHA1 a5c7f5707d4585a6cc0ef1632e3ceea3186ac047
SHA512 eb83f3ec5088e67c8d838e9cd236ffaaa9ded7257af390c3c119454bd6f41fcc8ecea349cd0b1f2bee57a96bec81ab6c2e405b23ed7b9c9845cba740c63cb57e
SSDEEP 3072:LEFTqrH/maft9iGznzp8jHW/rGeMI7/b2lQBV+UdE+rECWp7hK4:BTrviG6EGeMS3BV+UdvrEFp7hK4
TLSH
T18B048E423685C3F8E6641170346D7F7682E5A93D8FB601C7B3930E198A3C6D36D76A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

33:d1:0b:49:41:23:02:25:bb:18:1c:a2:54:d3:4e:ea:07:51:bc:52:fc:e1:2a:0d:84:ac:28:71:57:56:b1:f7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=OP BG-MB BU-SYS SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Nov 24, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:e1:d6:69:bc:6c:5b:ca:5d:9c:d2:64:47:77:6b:07

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2024 - Sep 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

55295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Jenkins\workspace\MB_CPUThermal\Release\MB_CPUThermal.pdb

kernel32

ResetEvent GetFileSize InitializeCriticalSectionEx OpenEventW GetLastError SetEvent GetFileAttributesW LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId CreateFileA OutputDebugStringW CreateEventW OutputDebugStringA CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetModuleHandleA GetProcAddress LoadLibraryW GetSystemDirectoryW DeleteCriticalSection GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW InitializeCriticalSectionAndSpinCount

user32

MessageBoxA

advapi32

GetAce EqualSid AllocateAndInitializeSid SetNamedSecurityInfoW GetNamedSecurityInfoW DeleteAce FreeSid BuildTrusteeWithSidW RegNotifyChangeKeyValue RegCloseKey RegQueryValueExA RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHCreateDirectoryExW

ole32

CLSIDFromProgID CoInitializeEx CoCreateInstance

msvcp140

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z _Unlink _Remove_dir _Close_dir _Open_dir _Lstat _Stat ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ?_Winerror_message@std@@YAKKPADK@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Winerror_map@std@@YAHH@Z ?_Throw_C_error@std@@YAXH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Syserror_map@std@@YAPBDH@Z _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Xtime_get_ticks _Mtx_unlock ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ

shlwapi

PathIsDirectoryW

vcruntime140

__std_type_info_destroy_list memchr _except_handler4_common memset _CxxThrowException __std_type_info_compare __std_exception_copy __std_exception_destroy _purecall __std_terminate __CxxFrameHandler3 memmove memcpy

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex _configure_narrow_argv _wassert _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

fgetpos fread fsetpos fwrite ungetc _get_stream_buffer_pointers fgetc setvbuf _fseeki64 fclose fflush fputc

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

toupper

Sharing

General

Malware Config

Signatures

File Explorer

eb7835080248f8701cbe532b96534e9e729570a4289dbea3c7bd1914a0f74f69

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

msvcp140

shlwapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

generic