0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977

Sharing

Copy URL Twitter E-mail

General

Target
0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977
Size 1.5MB
Sample260711-cyfhbacy21
SHA256 0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977
MD5 ff98ec848b7aa3aaf36900677e7afd77
SHA1 fee5c589b3f47f8df849fd18d1dfbc57873ce7ef
SHA512 3f5a361d2f103fe600f6782e6ad2970655148948508032312b142dcb5f339a21923f2647f143fb49a0f632f9f1f411294c1816e9c8372a9d78b665ad258d2f7b
SSDEEP 24576:OB1FeILB76o/Z3rtl+X66JYycBcqzYYbbfa3cBVVUzYvoDFWfWrEH7Az:Ktx3Cq6GVBcqzYCbfasBVCz4KWfa
TLSH
T1BC65D0227556D272D12202B2193DFFE9D57CAC390FB524CB63D02ABE59381C26B36F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977

File Explorer

0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977

.exe 1.5MB

0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977

IMPHASH 1f2ce106469a029595b15a97443d92ad
SHA256 0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977
MD5 ff98ec848b7aa3aaf36900677e7afd77
SHA1 fee5c589b3f47f8df849fd18d1dfbc57873ce7ef
SHA512 3f5a361d2f103fe600f6782e6ad2970655148948508032312b142dcb5f339a21923f2647f143fb49a0f632f9f1f411294c1816e9c8372a9d78b665ad258d2f7b
SSDEEP 24576:OB1FeILB76o/Z3rtl+X66JYycBcqzYYbbfa3cBVVUzYvoDFWfWrEH7Az:Ktx3Cq6GVBcqzYCbfasBVCz4KWfa
TLSH
T1BC65D0227556D272D12202B2193DFFE9D57CAC390FB524CB63D02ABE59381C26B36F16
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0e:0b:e8:b6:b3:c1:3a:5b:28:7e:b7:c8:b7:59:97:61:99:dd:6b:50:82:4a:80:0e:7b:49:a3:0f:94:bc:a3:97

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=91510100MAK1EUYW0G,CN=Chengdu Lightspeed Gravity Technology Co.\, Ltd,O=Chengdu Lightspeed Gravity Technology Co.\, Ltd,L=Chengdu,ST=Sichuan,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#132d4368656e67647520486967682d7465636820496e647573747269616c20446576656c6f706d656e74205a6f6e65,1.3.6.1.4.1.311.60.2.1.2=#13075369636875616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 12, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:72:f8:b3:23:b7:4e:52:ad:40:54:4a:53:dc:11:73

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 16, 2026 - Mar 15, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

474341

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\swdownloader\output\Release\cleaner-win_installer.pdb

version

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

Netbios

ws2_32

send socket gethostbyname setsockopt recv inet_addr htons connect closesocket

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

comctl32

ord17 _TrackMouseEvent

user32

SendMessageW UnregisterClassW TranslateMessage DispatchMessageW PeekMessageW WaitMessage DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow CallMsgFilterW GetQueueStatus MsgWaitForMultipleObjectsEx GetDC ReleaseDC MonitorFromPoint CallWindowProcW RegisterClassW GetClassInfoExW IsWindow ShowWindow UpdateLayeredWindow MoveWindow SetWindowPos IsIconic SetFocus GetFocus GetKeyState SetTimer ReleaseCapture EnableWindow GetSystemMetrics BeginPaint EndPaint GetUpdateRect wsprintfW SetPropW GetPropW SetWindowTextW GetClientRect GetWindowRect GetCursorPos ScreenToClient IntersectRect IsRectEmpty PtInRect GetWindowLongW ClientToScreen GetWindow LoadCursorW LoadImageW MonitorFromWindow GetMonitorInfoW OffsetRect CharNextW SetCursor UnionRect IsWindowVisible IsZoomed SetForegroundWindow PostQuitMessage SetWindowRgn MapWindowPoints GetParent OpenClipboard CloseClipboard SetClipboardData GetClipboardData PostMessageW EmptyClipboard IsClipboardFormatAvailable GetWindowThreadProcessId FindWindowW MessageBoxW InvalidateRect KillTimer GetAsyncKeyState GetDesktopWindow GetSysColor SetCapture SetWindowLongW

gdiplus

GdipSetWorldTransform GdipDrawArc GdipDrawImageRect GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetImagePalette GdipGetImagePaletteSize GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCloneImage GdipFree GdipCreateHBITMAPFromBitmap GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipDrawLineI GdipDrawBezierI GdipDrawRectangleI GdipDrawEllipseI GdipDrawPath GdipFillRectangle GdipFillEllipseI GdipFillPath GdipAlloc GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipStringFormatGetGenericTypographic GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipClonePen GdipSetPenWidth GdipGetPenWidth GdipSetPenStartCap GdipSetPenEndCap GdipSetPenDashCap197819 GdipGetPenStartCap GdipGetPenEndCap GdipGetPenDashCap197819 GdipSetPenLineJoin GdipGetPenLineJoin GdipSetPenColor GdipGetPenDashStyle GdipSetPenDashStyle GdipCreateTexture GdipCreateBitmapFromHBITMAP GdipTranslateMatrix GdipScaleMatrix GdipRotateMatrix GdipClonePath GdipResetPath GdipGetPathFillMode GdipSetPathFillMode GdipStartPathFigure GdipAddPathLine2I GdipAddPathBezierI GdipAddPathCurveI GdipAddPathRectangleI GdipAddPathEllipseI GdipAddPathPieI GdipAddPathPolygonI GdipTransformPath GdipGetPathWorldBoundsI GdipIsVisiblePathPointI GdipIsOutlineVisiblePathPointI GdipCreateLineBrushFromRect GdipSetLineBlend GdipCreatePen2 GdipLoadImageFromFile GdipImageRotateFlip GdipCreateMatrix GdiplusShutdown GdipCreateFontFromDC GdiplusStartup GdipDeleteMatrix

msimg32

AlphaBlend

shlwapi

PathIsRelativeW PathFileExistsW

winmm

timeSetEvent timeKillEvent timeGetTime

kernel32

HeapAlloc GetFileType HeapFree ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW FlsGetValue LCMapStringEx EncodePointer WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx FlsAlloc FlsSetValue FlsFree VirtualProtect HeapReAlloc FlushFileBuffers FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WaitForMultipleObjects GetEnvironmentVariableW GetModuleHandleA GetCurrentProcessId SetFileTime GetFileSize GetTickCount MulDiv VerifyVersionInfoW GlobalAlloc VerSetConditionMask PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateThread SetThreadPriority GetCurrentThreadId RaiseException FindResourceW SizeofResource LoadResource VirtualQuery GetStdHandle FileTimeToSystemTime GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter LocalFileTimeToFileTime FileTimeToLocalFileTime InitializeCriticalSectionAndSpinCount FindClose GetCurrentDirectoryW GetModuleFileNameW lstrcmpA FreeLibrary InitializeCriticalSectionEx DecodePointer DeviceIoControl CreateDirectoryW WideCharToMultiByte SetFilePointer CreateThread Sleep DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WriteFile SetFilePointerEx SetEndOfFile GetFileAttributesW DeleteFileW CreateFileW WriteConsoleW CreateEventW SetEvent GetStartupInfoW OutputDebugStringW MultiByteToWideChar SystemTimeToFileTime LoadLibraryW GetSystemTime OpenProcess CreateProcessW WaitForSingleObject CreatePipe SetLastError ReadFile GlobalFree GlobalSize GlobalUnlock GlobalLock CloseHandle GetLastError CreateMutexW ExpandEnvironmentStringsW GetCurrentProcess GetVersionExW GetModuleHandleW GetProcAddress GetDiskFreeSpaceW

gdi32

SetWindowOrgEx SaveDC ExtSelectClipRgn GetObjectA GetWindowOrgEx DeleteDC CreateCompatibleDC SetStretchBltMode StretchBlt RestoreDC CreateDIBSection CreateRoundRectRgn BitBlt GetDeviceCaps GetObjectW SelectObject GetStockObject CreateRectRgnIndirect CreateFontIndirectW DeleteObject

shell32

ShellExecuteW ord165 ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoInitialize CoUninitialize CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance

advapi32

RegEnumKeyExW RegQueryValueExW RegOpenKeyExW DuplicateTokenEx OpenProcessToken RegQueryValueExA RegOpenKeyExA RegCloseKey

wininet

InternetReadFile InternetConnectW InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA HttpOpenRequestW HttpSendRequestA InternetCloseHandle InternetOpenW HttpSendRequestW HttpQueryInfoA HttpQueryInfoW

winhttp

WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReadData WinHttpConnect WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpen

Name

.text

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

594KB

Virtual Size

593KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0c0f26622628a69f492f085ca34366116010f4a1e777b6200ab34e0debf4d977

PE Signature issue

version

netapi32

ws2_32

imm32

comctl32

user32

gdiplus

msimg32

shlwapi

winmm

kernel32

gdi32

shell32

ole32

advapi32

wininet

winhttp

generic