voicewave_installer_20260714[.]17840894148733b5550674[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
voicewave_installer_20260714.17840894148733b5550674.exe
Size 3.6MB
Sample260715-e1bm9abw3n
SHA256 2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5
MD5 2e192fbc97db5f2644cb74624550bb1b
SHA1 af0331038b1d263941b1602cd726807b4522a4d1
SHA512 453c2a77007b2d9052acf42817c25443a6ad2126e956e18c1025132213f45cb5fa439a819135d812bc117159690de833e9620b9889e7f3f9bc0d086730d099a2
SSDEEP 98304:TA4HXq5Y68xio+Q3Wf8q6rVfV9WxSKFG8ZCv4:XHxiQ3s8qUxV9WxAmCA
TLSH
T1E406231AAE63DC8FCF626C34B5520C1D1A3D5ABFD0124AD317BE1E384C693827AA7553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

voicewave_installer_20260714.17840894148733b5550674.exe

.exe 3.6MB
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe

.exe 3.4MB
$TEMP/evw_setup/1.0.0/46free/InitConfigure.ini

279B
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunConfig.ini

1KB
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll

.dll 482KB
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe

.exe 107KB
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe

.exe 65KB
$TEMP/evw_setup/1.0.0/46free/cacert.pem

232KB
$TEMP/evw_setup/1.0.0/46free/libcurl.dll

.dll 359KB
$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll

.dll 78KB
$TEMP/evw_setup/1.0.0/46free/zlib1.dll

.dll 84KB

voicewave_installer_20260714.17840894148733b5550674.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 2ec319eeabd3ec839cc82f28dcb6e86e6f2d5c6e09a4ac1b444e80fe4413aca5
MD5 2e192fbc97db5f2644cb74624550bb1b
SHA1 af0331038b1d263941b1602cd726807b4522a4d1
SHA512 453c2a77007b2d9052acf42817c25443a6ad2126e956e18c1025132213f45cb5fa439a819135d812bc117159690de833e9620b9889e7f3f9bc0d086730d099a2
SSDEEP 98304:TA4HXq5Y68xio+Q3Wf8q6rVfV9WxSKFG8ZCv4:XHxiQ3s8qUxV9WxAmCA
TLSH
T1E406231AAE63DC8FCF626C34B5520C1D1A3D5ABFD0124AD317BE1E384C693827AA7553
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

78:eb:8e:4f:ea:4c:4d:eb:aa:61:45:11:e7:e5:c7:ec:82:3a:59:12:f0:5e:a0:41:0e:5d:c1:5f:5f:6e:99:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/evw_setup/1.0.0/46free/EDownloader.exe

IMPHASH 4d3b1e6f1bf1964d64358ebe37d9ac64
SHA256 09fc252661481ea65e23c90babdb7801be6b77dc5db3095cf726372d0d80ff0a
MD5 83aaf734d620f4a1b4aab6d5f0cf6819
SHA1 e6e2d128d260c9a52e0ee3cb32023ddb9d1b9d66
SHA512 22c34ed55fa0149f72bf2ad4751eef52897bb5dd4f300cc5d0cbadc566c33b7907114cca567ad12edd58c1aef811014bbbe81599ccb9e28a2af8007347e92df1
SSDEEP 98304:H+gzEdPtI8TzKPrqSUiyk++U3AfqkQHLtrBUnKR:eVbNSokU3Oqko5rBU4
TLSH
T108F5E12176A28037F5B304B59D7F6B6ED46CBE32072494D7A3C40E2D0A71AD27A32767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

72:13:d0:d1:24:96:5b:7d:3d:8d:d8:78:4a:60:09:42:57:01:d6:11:fe:38:6a:77:47:a3:a3:e9:20:3d:4a:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

793547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\_work\voicewave\downloader\EDownloader\Release\EDownloader.pdb

libcurl

curl_easy_getinfo curl_easy_init curl_easy_cleanup curl_easy_setopt curl_global_init curl_easy_escape curl_slist_append curl_free curl_slist_free_all curl_easy_strerror curl_easy_reset curl_easy_perform

zlib1

deflateInit2_ deflateEnd deflate

kernel32

GlobalLock GlobalUnlock GetLocalTime GetCurrentThreadId SetEndOfFile SetFilePointerEx WaitForSingleObject WaitForMultipleObjects RaiseException DecodePointer DeleteCriticalSection OutputDebugStringW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetStdHandle GetModuleHandleExW ExitThread MoveFileExW RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect WriteFile DosDateTimeToFileTime FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SetEvent GetCPInfo LCMapStringW CompareStringW QueryPerformanceCounter TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW SetLastError GetExitCodeThread GetCurrentThread SwitchToThread WaitForSingleObjectEx TryEnterCriticalSection EncodePointer GetStringTypeW FormatMessageW MulDiv InitializeCriticalSectionAndSpinCount GlobalAlloc GetFileType SystemTimeToFileTime DuplicateHandle LoadLibraryExW ExitProcess GetACP LockResource SizeofResource FreeResource LoadResource FindResourceW GetTickCount GetCurrentDirectoryW LoadLibraryW GetModuleHandleW Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess ReleaseMutex CreateMutexW GetUserDefaultUILanguage TerminateProcess GetEnvironmentVariableW SetCurrentDirectoryW GetLocaleInfoW GetPrivateProfileStringW DeleteFileW Sleep GetFileAttributesW GetTempPathW SetFilePointer GetExitCodeProcess FreeLibrary CreateProcessW GetFileSize GetProcAddress CreateThread GetSystemInfo CloseHandle LoadLibraryA GetLastError GetTimeZoneInformation GetModuleHandleA GetVersionExW CreateFileW GetCurrentProcess ReadFile WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW VirtualAlloc

user32

SetRect CharPrevW SetWindowTextW GetWindowTextLengthW GetWindowTextW IsIconic LoadImageW GetParent GetClientRect SetWindowLongW TranslateMessage PeekMessageW ExitWindowsEx InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo AdjustWindowRectEx DispatchMessageW MsgWaitForMultipleObjects GetSystemMetrics SendMessageW ScreenToClient SetWindowRgn DestroyWindow GetWindowRect GetWindowLongW PtInRect KillTimer IsZoomed ClientToScreen SetTimer PostQuitMessage ReleaseDC GetWindowDC MoveWindow SetForegroundWindow FindWindowW SetFocus IsWindow GetDC GetKeyState SetWindowPos GetActiveWindow GetWindow BeginPaint EndPaint IsRectEmpty GetUpdateRect IsWindowVisible IntersectRect MapWindowPoints CreateWindowExW GetCursorPos GetFocus InvalidateRect UnionRect GetMessageW SetCapture ReleaseCapture DrawTextW FillRect GetCaretBlinkTime GetSysColor SetCaretPos GetCaretPos HideCaret ShowCaret PostMessageW CharNextW OffsetRect wvsprintfW CreateCaret MessageBoxW GetMenu LoadCursorW GetPropW SetPropW CallWindowProcW RegisterClassExW GetClassInfoExW RegisterClassW MonitorFromWindow GetMonitorInfoW EnableWindow ShowWindow DefWindowProcW SetCursor

gdi32

SetStretchBltMode StretchBlt CreateDIBSection CombineRgn CreateRectRgnIndirect GetClipBox SelectClipRgn SetBkColor GetObjectA GetTextMetricsW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreatePen CreateFontIndirectW GetStockObject GetObjectW CreateFontW GetTextExtentPoint32W SelectObject GetTextExtentPointW CreateRoundRectRgn DeleteObject ExtTextOutW CreateSolidBrush CreatePenIndirect MoveToEx LineTo RoundRect SetBkMode SetTextColor GetCharABCWidthsW TextOutW GdiFlush CreatePatternBrush GetDeviceCaps ExtSelectClipRgn

advapi32

CryptCreateHash CryptHashData IsValidSid RegSetValueExA CryptDestroyHash OpenProcessToken RegOpenKeyExW CryptGetHashParam GetUserNameW RegQueryValueExW LookupAccountNameW CryptReleaseContext GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount CryptAcquireContextW RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegCreateKeyExA

shell32

SHBrowseForFolderW SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW

ole32

CLSIDFromProgID CoCreateInstance CoUninitialize CoCreateGuid OleLockRunning CoInitialize CLSIDFromString CreateStreamOnHGlobal

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

gdiplus

GdiplusStartup GdipLoadImageFromStream GdipImageSelectActiveFrame GdipGetImageHeight GdipGetImageWidth GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDrawImage GdipGraphicsClear GdipDrawImageRectI GdipDrawString GdipGetFamily GdipDeleteFontFamily GdipSetPixelOffsetMode GdipSetInterpolationMode GdipSetCompositingQuality GdipSetSmoothingMode GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipAlloc GdipFree GdipDeleteBrush GdipCreateLineBrushI GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipDeleteStringFormat GdipCreateStringFormat GdipSetTextRenderingHint GdipDeleteGraphics GdipCreateFromHDC GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdiplusShutdown

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext ImmGetContext

comctl32

_TrackMouseEvent ord17

$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll

IMPHASH ed4c83405351a76f7208f9ddabcbf1d8
SHA256 544b2bf4ccdaeaf6ce8f3e0d4faa98281ad17f65fc2defaec915d16d320dbda6
MD5 90a1760397db7be8a7a82b82cfb72d2c
SHA1 774f0a6c25a61b0e3c2c80fc4bc5830d4c77db55
SHA512 29439377953068d75902c205f2db5f40b0bc9925e6761082dcd0da722ed1301df8d1dbe93f8f0e301322a4e6c680139f0c21e0974387d3c20a00c6ca947b9ec4
SSDEEP 12288:laK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Pas:39DeuBc/IPu8WMAF0Pas
TLSH
T1FEB4BF53AA80C1B3D18A017516B6B77B2E39A7355364D8C3F3D81D785E207E27A3938E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f6:2a:58:86:60:d0:93:a1:62:8f:cd:16:cd:57:d7:a0:e2:02:45:c9:4a:cc:4f:37:93:ba:fd:fa:86:32:c2:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

306217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrap.pdb

advapi32

CryptDestroyKey CryptEncrypt CryptReleaseContext CryptImportKey CryptAcquireContextA CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash InitializeSecurityDescriptor CreateProcessAsUserW OpenProcessToken SetSecurityDescriptorDacl

ws2_32

freeaddrinfo gethostname WSAGetLastError getaddrinfo ioctlsocket listen accept recvfrom sendto connect closesocket getpeername getsockopt htons bind ntohs getsockname setsockopt WSAIoctl WSAStartup WSACleanup socket select __WSAFDIsSet WSASetLastError send recv

wldap32

ord30 ord22 ord211 ord217 ord143 ord50 ord26 ord60 ord200 ord32 ord35 ord79 ord33 ord301 ord27 ord41 ord46

kernel32

SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount FlushFileBuffers SetStdHandle GetCurrentDirectoryA GetFullPathNameA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP VirtualAlloc VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo GetTimeZoneInformation WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CopyFileW SetLastError GetLastError FormatMessageA Sleep VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA LoadLibraryA GetProcAddress GetModuleHandleA QueryPerformanceFrequency SleepEx ReadFile PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle FreeLibrary GetTickCount QueryPerformanceCounter ExpandEnvironmentStringsA CloseHandle WaitForSingleObject RaiseException RtlUnwind ExitProcess HeapSize InterlockedDecrement SetEndOfFile GetProcessHeap ReleaseMutex GetModuleFileNameA SetEvent GetCurrentProcess CreateProcessW OpenEventW CreateEventW CreateMutexW MultiByteToWideChar GetModuleFileNameW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW CreateFileW WriteFile GetFileAttributesW GetPrivateProfileIntW GetLocalTime GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeFormatA GetDateFormatA GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc HeapReAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetCurrentProcessId GetFileInformationByHandle SetFilePointer ExitThread CreateThread GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetFileAttributesA

shlwapi

StrRChrA

rpcrt4

UuidCreate

$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe

IMPHASH 6dfe916348428b8a9dd67e44f02285d1
SHA256 2cc207dd14110192c642536432166a1ec77ee4aae071d206707425b7fc969cd3
MD5 f9a22315670147c91e2e044403f8e791
SHA1 a0407ef0c23fc82c831b2e2fef48048e98c17e56
SHA512 865f71d0ddc09506fea34aaf481f79469c7fbcb523dcf4f6967a4f55ad4d17907e1294c21f5e7dae96844d54a5e16174579b11256c8836ab3c17403f9a259d7f
SSDEEP 1536:M554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAU+/I0:vswTbD6LLraInhEdlg5BJU+/I0
TLSH
T107B37D217980C032E8A714738DFCDA699A6CF9311B5598C7B3C84A6E0F617E1BF35267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

d9:79:84:73:5b:da:da:a8:af:71:7d:3b:ca:ba:bd:1f:d9:62:3b:ad:2e:17:53:45:b6:89:7c:9c:1f:f8:20:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

31388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrapExe.pdb

kernel32

CreateFileA FlushFileBuffers WaitForMultipleObjects CloseHandle GetFileAttributesW GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW GetLocalTime WaitForSingleObject GetCurrentProcess CreateEventW GetLastError CreateMutexW GetModuleFileNameW DeleteFileW CreateFileW ReadFile WriteFile ReleaseMutex TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

aliyunwrap

?SendLogToCloud@@YA_NABV?$vector@U?$pair@PA_WPA_W@std@@V?$allocator@U?$pair@PA_WPA_W@std@@@2@@std@@@Z

rpcrt4

UuidCreate

urlmon

URLDownloadToFileW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe

IMPHASH 3cfb1b6d152c2acd854e77143308228d
SHA256 b7e0bb05d2b6673dae04d3a008b516e3c2803e6d388dcae3405b94e7f7ddcf3f
MD5 f20f89694c7ff9e0c84d8b55ddabcb5b
SHA1 1ac86fa7877c09e9132958171260c12ef289fbfb
SHA512 3d27047339e6c70876778a90bdde84dd758be397dcc1453f26d4dffc4d6eec378b58eb88ef88c0eba24fb8c43099e8d50d8dbeb26dada81f1a3216d27d039ca8
SSDEEP 768:AVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbVTkK/Ws5ALH:AECwXShvLYIE3nnInie2khc50H/a
TLSH
T12F638E127890C033CC5A88B55868D7A09F6FAA6217E494C77FDD16BD4FA13C06F3936A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

f6:ab:5b:a3:20:57:c1:33:81:8f:83:7a:f5:27:f5:41:bd:0a:f9:8f:cf:44:c5:fd:2f:f9:32:4f:5e:4c:97:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

10061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\testProject\AliyunLog\Code\UserInfoCollect\Release\InfoForSetup.pdb

$TEMP/evw_setup/1.0.0/46free/libcurl.dll

IMPHASH 128aea186981a7c85c405025021f50e9
SHA256 683bb7b131576fe7bc8efbd3c5b00b9ca5fd91b763774f51f4fb71a746cd896a
MD5 2fc4f35490fa25908c2963a0fa586cb7
SHA1 ba80bfe3ef6eb07f060100f231491de63001d35e
SHA512 fb23525ac35f66cad45dc505f40553b1a1556752b18ff2259f11515a33546b5d6f2c44d9a2e7dc3f2d7336e656ade9ec9291434c5e038bbddb696c055d89dc7d
SSDEEP 6144:lj9yPDdfoOVjXiNATUHtpt71vYSriO77CjZh9mXoSsXzimTt0V9nFEzl+/y:lj92GTLRrii7Cth0AXd0V9FEhCy
TLSH
T13C745BA2FC018032F6D21175E6FA9FB76C6C5125271AD0D3EAD044A49D749E3B23EB47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

c4:b6:43:04:7b:c3:9c:7a:5e:31:80:ac:aa:04:9a:86:47:c1:e3:8f:e2:7d:8d:fc:ad:ec:5e:4b:ac:01:34:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

285201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\libcurl 7.61.0\curl-7.61.0\build\Win32\VC15\DLL Release - DLL Windows SSPI - DLL WinIDN\libcurl.pdb

ws2_32

accept WSACleanup WSAStartup gethostname freeaddrinfo getaddrinfo listen __WSAFDIsSet select send recvfrom htonl ntohl bind ioctlsocket sendto closesocket connect getpeername getsockname getsockopt htons ntohs recv setsockopt socket WSASetLastError WSAIoctl WSAGetLastError

wldap32

ord41 ord50 ord45 ord60 ord211 ord46 ord143 ord301 ord200 ord30 ord22 ord79 ord26 ord35 ord33 ord32 ord27

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertCloseStore CertFindCertificateInStore CryptStringToBinaryA CertAddCertificateContextToStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertOpenStore

normaliz

IdnToAscii IdnToUnicode

kernel32

GetModuleHandleW GetFileSizeEx CreateFileA GetTickCount64 WaitForMultipleObjects PeekNamedPipe UnhandledExceptionFilter GetFileType GetStdHandle VerifyVersionInfoA LoadLibraryA GetModuleHandleA GetSystemDirectoryA VerSetConditionMask FormatMessageA SetLastError GetLastError Sleep ExpandEnvironmentStringsA WaitForSingleObjectEx CloseHandle GetProcAddress FreeLibrary WideCharToMultiByte SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead IsDebuggerPresent GetStartupInfoW ReadFile MultiByteToWideChar SleepEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx

advapi32

CryptHashData CryptDestroyKey CryptGetHashParam CryptImportKey CryptEncrypt CryptCreateHash CryptAcquireContextA CryptDestroyHash CryptGenRandom CryptReleaseContext

vcruntime140

__std_type_info_destroy_list memchr _except_handler4_common memmove strrchr strchr memcpy memset strstr

api-ms-win-crt-runtime-l1-1-0

_getpid _beginthreadex _errno strerror __sys_nerr _register_onexit_function terminate _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _cexit _execute_onexit_table _crt_atexit _crt_at_quick_exit

api-ms-win-crt-string-l1-1-0

isupper strspn tolower _strdup strncpy strncmp strpbrk

api-ms-win-crt-stdio-l1-1-0

fwrite __acrt_iob_func _close _open fputc _read ftell __stdio_common_vsprintf fclose fgets fopen fputs fflush __stdio_common_vsscanf _lseeki64 fseek fread _write

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbschr _mbspbrk _mbsncmp _mbsnbcpy

api-ms-win-crt-heap-l1-1-0

malloc calloc free realloc

api-ms-win-crt-convert-l1-1-0

strtoul atoi strtol strtoll

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _access _stat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_except1

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_init curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_version curl_version_info

$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll

IMPHASH 4cbe94576279d6d8408886f6ac74d611
SHA256 44aca93d4a046252c60f0cbbe5259d9509b912aa07e5379b2cdbe842700c7e9c
MD5 b8f25e1833429fd8f529c5fdd2a4f3b4
SHA1 7ae7ca5e695e6cdb590022a0602879bc2f56a65a
SHA512 077007237e7ddfd280dd08f145a0f3c775c461bbf61574cbefc4f7c29ba6308c16b52da94dc8f78345fec1cdac25f5e604b890669124a7e38e205e54a68729e7
SSDEEP 1536:JbiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL+/o8:liyLyt/xcRjWazaecbGCu/o8
TLSH
T1A9737D4335E082B5D9AF05F4D8BAA70A9A7DF8500FF26EE76B944949DF60AC09770307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

79:76:9b:f3:7b:ee:50:fe:78:f3:f2:aa:0c:a3:69:eb:91:02:76:d3:4d:33:3b:6c:0d:3d:1f:b2:26:33:22:c8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

55648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

$TEMP/evw_setup/1.0.0/46free/zlib1.dll

IMPHASH cc8456b68696fc64b47f2455cb93c8b8
SHA256 b4ad7ba65fededaa11befbfcbd688a1da96031c88e2324075b42e5057f04c6b8
MD5 089c6e80c5d506ca980f4fe2f6747dde
SHA1 f59e5441c43b008ff49a67cdc9960d33be5425f7
SHA512 dec10d21a229557624b47e9d2e3e011dba592bf9e31d67cd25b6237ba23cf6661ec4475559d06be6a0447260d142856bafbc57cc3cabb96654762dc03feec4f8
SSDEEP 1536:F2lVj7uRxDXVJ3DD7fGcg/hiOrN/GyrZlIOsIOI/QxVDIJ/D:FQVjSHTXbg/hjdZviI/QxVDIJ/D
TLSH
T19783AE82FAD053A2D9F6007490F7877D9A3670214B97ECDBE38DB66849113D1AB362CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e2:db:16:7b:a8:28:94:3f:62:7c:9a:df:f2:75:4b:61:78:75:1b:0c:23:23:83:09:b1:b4:5e:8d:9f:ef:fa:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Chains

Jun 16, 2026

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Chengdu Yiwo Tech Development Co.\, Ltd.,O=Chengdu Yiwo Tech Development Co.\, Ltd.,L=Chengdu,ST=Sichuan,C=CN

Serial Number

78:6e:35:78:7b:7d:ab:79:1d:04:72:62

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 20, 2026 - May 21, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

49638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\vcpkg\vcpkg\buildtrees\zlib\x86-windows-rel\zlib.pdb

Sharing

General

Malware Config

Signatures

File Explorer

voicewave_installer_20260714.17840894148733b5550674.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$TEMP/evw_setup/1.0.0/46free/EDownloader.exe

libcurl

zlib1

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

imm32

comctl32

generic

$TEMP/evw_setup/1.0.0/46free/InitConfigure.ini

$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunConfig.ini

$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll

advapi32

ws2_32

wldap32

kernel32

shlwapi

rpcrt4

generic

$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe

kernel32

aliyunwrap

rpcrt4

urlmon

advapi32

generic

$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe

kernel32

shell32

generic

$TEMP/evw_setup/1.0.0/46free/cacert.pem

$TEMP/evw_setup/1.0.0/46free/libcurl.dll

ws2_32

wldap32

crypt32

normaliz

kernel32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

kernel32

generic

$TEMP/evw_setup/1.0.0/46free/zlib1.dll

vcruntime140