db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c

Sharing

Copy URL Twitter E-mail

General

Target
db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c
Size 12.0MB
Sample260709-pfl9csa16s
SHA256 db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c
MD5 5c2fc27d606804af1c92bfde2f5d13bb
SHA1 0cc1e253c6c1ab3c26d1da1c25a086ec6c2027c4
SHA512 6dae107d4c05cbc94ca798c64a587f834db857fc1bfe66cf3647ba2bdb280d8c34c2961eae2517c56d13d19f0d53d38d9bd94a9ea0ac73ef2e46345af07b4153
SSDEEP 196608:A46KLt7htFq0m17BdlV4oZberOvIiPi4iXu++9oVCtG/+t0nTtxwEf/T/3df:/6KLt1Xq0mlBjYkIp4iXY4Xwk7fdf
TLSH
T17DC62201E483C423D72E1A31E5A4D98CF40422798FB661F377798A35DC53EFA94B998E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c

File Explorer

db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c

.exe 12.0MB

db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c

IMPHASH 8ecd9f4f0beac69338a642a236d24bb6
SHA256 db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c
MD5 5c2fc27d606804af1c92bfde2f5d13bb
SHA1 0cc1e253c6c1ab3c26d1da1c25a086ec6c2027c4
SHA512 6dae107d4c05cbc94ca798c64a587f834db857fc1bfe66cf3647ba2bdb280d8c34c2961eae2517c56d13d19f0d53d38d9bd94a9ea0ac73ef2e46345af07b4153
SSDEEP 196608:A46KLt7htFq0m17BdlV4oZberOvIiPi4iXu++9oVCtG/+t0nTtxwEf/T/3df:/6KLt1Xq0mlBjYkIp4iXY4Xwk7fdf
TLSH
T17DC62201E483C423D72E1A31E5A4D98CF40422798FB661F377798A35DC53EFA94B998E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

84:c9:40:c7:90:f0:16:58:9a:24:fa:28:1f:0d:35:2f:8e:b7:00:84:bc:d5:fa:22:1b:6a:99:d0:de:43:15:09

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Mar 17, 2025

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2022 - Oct 17, 2025

Minor OS version

Major OS version

Entry point

109107

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource FindResourceW GetTickCount LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle FindClose MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW WideCharToMultiByte VirtualQuery SetEvent CreateThread ResetEvent GetLocalTime InitializeCriticalSection lstrcmpiW LoadLibraryExW lstrcpynW WriteConsoleW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx OutputDebugStringW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc TryEnterCriticalSection GetProcessHandleCount TerminateProcess OpenProcess GetCurrentProcessId WriteFile EnterCriticalSection HeapFree LeaveCriticalSection GetCurrentThreadId GetModuleHandleW IsDebuggerPresent CreateEventW GetModuleFileNameW Sleep CloseHandle CreateFileW ExitProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException FreeResource HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime

user32

DispatchMessageW DefWindowProcW DestroyWindow MessageBoxW TranslateMessage GetMessageW PeekMessageW ReleaseDC MonitorFromWindow CharNextW WaitForInputIdle GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW SendMessageW GetWindowLongW

gdi32

GetDeviceCaps DeleteDC GetObjectW DeleteObject CreateCompatibleDC SetDIBColorTable CreateDIBSection SelectObject

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VarUI4FromStr

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked InitCommonControlsEx

ws2_32

WSACleanup

gdiplus

GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdiplusStartup GdipFree GdipBitmapLockBits GdipGetImageGraphicsContext GdipGetImagePalette GdipSetCompositingMode GdipDeleteGraphics GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdiplusShutdown GdipGetImagePixelFormat GdipGetImageWidth

Sharing

General

Malware Config

Signatures

File Explorer

db9c74904da954dd23b592a910d750d67a9bbabb42d16cd24fb91d41abe8531c

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic