dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f

Sharing

Copy URL Twitter E-mail

General

Target
dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f
Size 3.6MB
Sample260710-qm4mnact4v
SHA256 dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f
MD5 895e8f52499b73cb8a3b68c651625ba9
SHA1 16839a616fe904d0d2d45d40df65974791b81be4
SHA512 01f6aedffe28e19060ee7390bf80b949b03039930fb035bff10dd2609745ecf020ada2a7fca76db0d1873ea9e84883e19e5ba14b2f3e831e0bff4d40de7324f5
SSDEEP 49152:+GbuZJ5svQkw6XIFviq6pAI33dy6YCdrPtDnO5:3uj5zkntAawCdq
TLSH
T1CB06AE2632A810DED0B7D07CCA528616DB7278A6077186CB6098417A5F6BBF46F7FF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f

File Explorer

dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f

.exe 3.6MB

dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f

IMPHASH a0850dba4cfd7595733b41889725dc73
SHA256 dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f
MD5 895e8f52499b73cb8a3b68c651625ba9
SHA1 16839a616fe904d0d2d45d40df65974791b81be4
SHA512 01f6aedffe28e19060ee7390bf80b949b03039930fb035bff10dd2609745ecf020ada2a7fca76db0d1873ea9e84883e19e5ba14b2f3e831e0bff4d40de7324f5
SSDEEP 49152:+GbuZJ5svQkw6XIFviq6pAI33dy6YCdrPtDnO5:3uj5zkntAawCdq
TLSH
T1CB06AE2632A810DED0B7D07CCA528616DB7278A6077186CB6098417A5F6BBF46F7FF10
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

39:8c:60:8e:24:d7:52:fc:f8:d2:2d:e1:9c:03:0d:ad:c1:ce:d8:ad:63:97:12:1a:7a:7a:8c:f1:c3:64:ad:94

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 4, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0a:7d:c0:32:ca:30:8f:7f:f2:d5:94:1a:85:b6:29:8a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 26, 2024 - Aug 28, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

27426

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\conan\data\glslang\20200305\G92\stable\build\55a5a3ace178751749494ac3201a61a66116a6c9\bin\glslangValidator.pdb

kernel32

ReleaseMutex WaitForSingleObject CreateMutexA TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection FormatMessageA WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW LocalFree EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetTempPathW IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW SetConsoleCtrlHandler HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle CreateFileW HeapSize SetEndOfFile RtlUnwind

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

806KB

Virtual Size

806KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dced8f485b376c06cd0e257744306a452ebf5ff9776ca59bea4f2c388bf4931f

PE Signature issue

kernel32

generic