e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6

General

Target
e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6
Size 2.5MB
Sample260707-lc7jcaew9w
SHA256 e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6
MD5 32217089bd90375b8e325cc819c5b3ae
SHA1 9c0d7b2f4f6c126ea3641d207c125e3f76c722a2
SHA512 448fb667d1850feb4de6c4cba91911056ffc4485b9f0c19ea1ad8d7e1889038a1a3bd95c54836b53ff739f1d5cebabcfd2635af001a280159e5aba2e11525bf7
SSDEEP 49152:T3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm+:c8x+woYy0xp6nN0tzVR
TLSH
T10FC5E1B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6

File Explorer

e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6

.exe 2.5MB

e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6

IMPHASH 5dbb7bcda197e66e5aa007adb6d32b7a
SHA256 e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6
MD5 32217089bd90375b8e325cc819c5b3ae
SHA1 9c0d7b2f4f6c126ea3641d207c125e3f76c722a2
SHA512 448fb667d1850feb4de6c4cba91911056ffc4485b9f0c19ea1ad8d7e1889038a1a3bd95c54836b53ff739f1d5cebabcfd2635af001a280159e5aba2e11525bf7
SSDEEP 49152:T3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm+:c8x+woYy0xp6nN0tzVR
TLSH
T10FC5E1B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

92:92:52:2f:9f:0e:25:be:08:74:7f:14:65:bd:08:43:c5:7d:d4:46:8b:47:2f:fc:61:91:80:0d:47:f0:f0:a1

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

PE Signature issue

Digest

2b:52:49:0b:35:fb:8d:af:d7:f5:b6:a4:df:d0:bc:6d:e8:bc:46:c0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

07:aa:52:5b:f1:73:f0:e5:e3:68:d8:ae:77:0f:8a:af

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2019 - Oct 12, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

10807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA Sleep GetTickCount HeapFree HeapAlloc GetCommandLineA HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer HeapCreate GetModuleHandleW GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FindFirstFileA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetStdHandle WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers CreateFileW FindNextFileA FindClose GetModuleHandleA GetProcAddress GetSystemDirectoryA DeleteFileA CreateEventA CreateThread lstrcatA CreateProcessA WaitForMultipleObjects TerminateProcess GetCurrentDirectoryA GetLastError WaitForSingleObject GetExitCodeProcess ExitProcess GetVersionExA GetCurrentProcess SetEvent GetLocalTime CreateFileA SetFilePointer WriteFile CloseHandle FreeEnvironmentStringsW GetModuleFileNameA

shell32

ShellExecuteExA

advapi32

RegCreateKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA SetServiceStatus RegisterEventSourceA RegisterServiceCtrlHandlerExA StartServiceCtrlDispatcherA ControlService DeleteService CreateServiceA OpenSCManagerA OpenServiceA QueryServiceConfigA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus StartServiceA CloseServiceHandle OpenProcessToken GetTokenInformation RegSetValueExA

shlwapi

PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

e5b5f6a8b77ed9f5d5332b3becfa91daf964f2d393646bb9d1966c14e5b1a7b6

PE Signature issue

PE Signature issue

kernel32

shell32

advapi32

shlwapi

generic