80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc

Sharing

Copy URL Twitter E-mail

General

Target
80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc
Size 2.3MB
Sample260706-pt2afaa19m
SHA256 80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc
MD5 c3a4f47350af439513ebdd7556de2931
SHA1 1bae5e1f1d5f9ab5cbd246da0d31b235d36960ca
SHA512 4f7f35c88140c89975676b86a5c75f2aeab4aec1bd940eb44a5d65b4b0101961ff01e00a2f3bd4a4c795a31f7a06f0cf82882d18bc1e35494483d5199e04eb50
SSDEEP 49152:01OOKgkBsWqUXpv4k6rKRz3ZVCCIo2GvclyuhxEnpxwGy1t9qH:01ZNxe54k6ab7C5o3vclfhxEzyPAH
TLSH
T158B5E04363D03FE6CBFD16F990F599F4C248AFB353DA98AAD680B5D792B33801506816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc

.exe 2.3MB

80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc

SHA256 80ba7b664f77ec3f33260209981774bf8c7200508c799ad2bf2797cc7b36eadc
MD5 c3a4f47350af439513ebdd7556de2931
SHA1 1bae5e1f1d5f9ab5cbd246da0d31b235d36960ca
SHA512 4f7f35c88140c89975676b86a5c75f2aeab4aec1bd940eb44a5d65b4b0101961ff01e00a2f3bd4a4c795a31f7a06f0cf82882d18bc1e35494483d5199e04eb50
SSDEEP 49152:01OOKgkBsWqUXpv4k6rKRz3ZVCCIo2GvclyuhxEnpxwGy1t9qH:01ZNxe54k6ab7C5o3vclfhxEzyPAH
TLSH
T158B5E04363D03FE6CBFD16F990F599F4C248AFB353DA98AAD680B5D792B33801506816
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

79:f0:99:58:7f:d9:2c:86:3c:08:fc:81:67:0e:e8:a2:57:f1:0e:1b:ac:d3:b9:d2:72:92:e1:92:b3:08:4a:38

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

Chains

Jun 16, 2023

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

b4:71:62:ff:e7:aa:2c:39:2f:2b:90:53:c0:60:56:f7:c5:e9:0f:70

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

Chains

Jun 16, 2023

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

Serial Number

01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Nov 10, 2023

Timespan

Jul 7, 2021 - Jul 11, 2024

Minor OS version

Major OS version

Entry point

4313728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=24, id=241, version=40116,

count=204, id=243, version=40116,

count=31, id=242, version=40116,

count=9, id=199, version=41118,

count=27, id=259, version=24123,

count=5, id=261, version=24234,

count=20, productName=Unmarked objects (old),

count=479, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=260, version=25019,

count=34, id=261, version=25019,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=126, id=261, version=24123,

count=39, id=260, version=24123,

count=112, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=498, id=1, productName=Unmarked objects,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=22, id=265, version=24234,

count=1, id=256, version=24234,

count=1, id=255, version=24234,

count=1, id=151,

count=1, id=258, version=24234,