99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6

Sharing

Copy URL Twitter E-mail

General

Target
99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6
Size 4.9MB
Sample260716-dwt4cscs2m
SHA256 99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6
MD5 ccf2c4f9c0f283e3e2b8e82d891465c6
SHA1 6e5bd78c609e980e2bba9d8a8db2a251b3c04cac
SHA512 136aa5ab3e2bf2701a423f3ff46485540b75be5220f2a4a03f45ce8e879f9341aee1e49b4a5e1a38046fd0277a2a3492742a6b2b23a9e93c9c11c2641cf44391
SSDEEP 49152:aJRium6dRt3VzRFu2bz6mpSVOZmDMaNIDt+5n21RF/YUS1ROEYUN1yf6jjV:sium6dRWtD7Ns1RtYV1RJY21yf6jjV
TLSH
T1E8363891B3E9489AE977833889B783313739FE818670DB5B9604D63D2C73BC16E94712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6

File Explorer

99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6

.dll 4.9MB

99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6

IMPHASH d55e91a932f5c193b35d37e48b236d9d
SHA256 99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6
MD5 ccf2c4f9c0f283e3e2b8e82d891465c6
SHA1 6e5bd78c609e980e2bba9d8a8db2a251b3c04cac
SHA512 136aa5ab3e2bf2701a423f3ff46485540b75be5220f2a4a03f45ce8e879f9341aee1e49b4a5e1a38046fd0277a2a3492742a6b2b23a9e93c9c11c2641cf44391
SSDEEP 49152:aJRium6dRt3VzRFu2bz6mpSVOZmDMaNIDt+5n21RF/YUS1ROEYUN1yf6jjV:sium6dRWtD7Ns1RtYV1RJY21yf6jjV
TLSH
T1E8363891B3E9489AE977833889B783313739FE818670DB5B9604D63D2C73BC16E94712
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ef:08:60:e9:e5:04:18:22:46:66:bd:62:99:5f:e3:36:91:20:3b:bc

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Chains

May 26, 2026

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Subject

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Serial Number

10:07

Issuer

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2026 - Jun 4, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

27328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CompareFileTime CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateSemaphoreW CreateThread DelayLoadFailureHook DeleteCriticalSection DeleteFileW DosDateTimeToFileTime EnterCriticalSection FileTimeToDosDateTime FileTimeToSystemTime FreeLibrary FreeLibraryAndExitThread GetComputerNameExA GetDateFormatA GetDiskFreeSpaceExA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetLocalTime GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetShortPathNameW GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetTimeFormatA GlobalAlloc HeapAlloc HeapReAlloc IdnToAscii IdnToUnicode InitOnceExecuteOnce InitializeCriticalSectionEx IsBadReadPtr IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingW QueueUserWorkItem RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResolveDelayLoadedAPI RtlUnwind SetEndOfFile SetEvent SetFilePointer SetFilePointerEx SetThreadDescription Sleep SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile WaitForSingleObject WideCharToMultiByte WriteFile

mpr

WNetCachePassword WNetGetCachedPassword

ntdll

NtQuerySystemTime _vsnprintf

shell32

SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCreateFromUrlW PathMatchSpecW StrStrIA StrToInt64ExW UrlCanonicalizeA UrlCanonicalizeW UrlCombineA UrlCombineW UrlEscapeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _errno _ltow _strdup _stricmp _time64 _wcsdup _wcsicmp _wcsnicmp _wgetenv atoi atol calloc free fwrite getenv iswalnum iswalpha iswspace malloc memchr memcmp memcpy memmove memset qsort rand realloc strchr strcmp strcpy strcspn strlen strncmp strnlen strrchr strtok system towlower wcschr wcscmp wcscspn wcslen wcsncmp wcsnlen wcsrchr wcsspn wcsstr wcstol wcstoul

user32

CharLowerW DialogBoxParamW EndDialog GetDlgItem GetWindowLongPtrW GetWindowTextW LoadStringA LoadStringW SendMessageW SetWindowLongPtrW SetWindowTextW wsprintfW

ws2_32

accept bind closesocket connect getsockname getsockopt htons ioctlsocket listen recv select send setsockopt socket WSAGetLastError WSAStartup WSACleanup FreeAddrInfoW GetAddrInfoW freeaddrinfo getaddrinfo getnameinfo inet_ntop

CommitUrlCacheEntryA CommitUrlCacheEntryW CreateMD5SSOHash CreateUrlCacheContainerA CreateUrlCacheContainerW CreateUrlCacheEntryA CreateUrlCacheEntryW CreateUrlCacheGroup DeleteIE3Cache DeleteUrlCacheContainerA DeleteUrlCacheContainerW DeleteUrlCacheEntry DeleteUrlCacheEntryA DeleteUrlCacheEntryW DeleteUrlCacheGroup DeleteWpadCacheForNetworks DetectAutoProxyUrl DllInstall FindCloseUrlCache FindFirstUrlCacheContainerA FindFirstUrlCacheContainerW FindFirstUrlCacheEntryA FindFirstUrlCacheEntryExA FindFirstUrlCacheEntryExW FindFirstUrlCacheEntryW FindFirstUrlCacheGroup FindNextUrlCacheContainerA FindNextUrlCacheContainerW FindNextUrlCacheEntryA FindNextUrlCacheEntryExA FindNextUrlCacheEntryExW FindNextUrlCacheEntryW FindNextUrlCacheGroup ForceNexusLookup ForceNexusLookupExW FreeUrlCacheSpaceA FreeUrlCacheSpaceW FtpCommandA FtpCommandW FtpCreateDirectoryA FtpCreateDirectoryW FtpDeleteFileA FtpDeleteFileW FtpFindFirstFileA FtpFindFirstFileW FtpGetCurrentDirectoryA FtpGetCurrentDirectoryW FtpGetFileA FtpGetFileEx FtpGetFileSize FtpGetFileW FtpOpenFileA FtpOpenFileW FtpPutFileA FtpPutFileEx FtpPutFileW FtpRemoveDirectoryA FtpRemoveDirectoryW FtpRenameFileA FtpRenameFileW FtpSetCurrentDirectoryA FtpSetCurrentDirectoryW GetUrlCacheConfigInfoA GetUrlCacheConfigInfoW GetUrlCacheEntryInfoA GetUrlCacheEntryInfoExA GetUrlCacheEntryInfoExW GetUrlCacheEntryInfoW GetUrlCacheGroupAttributeA GetUrlCacheGroupAttributeW GetUrlCacheHeaderData GopherCreateLocatorA GopherCreateLocatorW GopherFindFirstFileA GopherFindFirstFileW GopherGetAttributeA GopherGetAttributeW GopherGetLocatorTypeA GopherGetLocatorTypeW GopherOpenFileA GopherOpenFileW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpCheckDavCompliance HttpEndRequestA HttpEndRequestW HttpOpenRequestA HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestA HttpSendRequestExA HttpSendRequestExW HttpSendRequestW IncrementUrlCacheHeaderData InternetAlgIdToStringA InternetAlgIdToStringW InternetAttemptConnect InternetAutodial InternetAutodialCallback InternetAutodialHangup InternetCanonicalizeUrlA InternetCanonicalizeUrlW InternetCheckConnectionA InternetCheckConnectionW InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetCombineUrlA InternetCombineUrlW InternetConfirmZoneCrossing InternetConfirmZoneCrossingA InternetConfirmZoneCrossingW InternetConnectA InternetConnectW InternetCrackUrlA InternetCrackUrlW InternetCreateUrlA InternetCreateUrlW InternetDebugGetLocalTime InternetDial InternetDialA InternetDialW InternetEnumPerSiteCookieDecisionA InternetEnumPerSiteCookieDecisionW InternetErrorDlg InternetFindNextFileA InternetFindNextFileW InternetFortezzaCommand InternetGetCertByURL InternetGetCertByURLA InternetGetConnectedState InternetGetConnectedStateEx InternetGetConnectedStateExA InternetGetConnectedStateExW InternetGetCookieA InternetGetCookieExA InternetGetCookieExW InternetGetCookieW InternetGetLastResponseInfoA InternetGetLastResponseInfoW InternetGetPerSiteCookieDecisionA InternetGetPerSiteCookieDecisionW InternetGetSecurityInfoByURL InternetGetSecurityInfoByURLA InternetGetSecurityInfoByURLW InternetGoOnline InternetGoOnlineA InternetGoOnlineW InternetHangUp InternetInitializeAutoProxyDll InternetLockRequestFile InternetOpenA InternetOpenServerPushParse InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryFortezzaStatus InternetQueryOptionA InternetQueryOptionW InternetReadFile InternetReadFileExA InternetReadFileExW InternetSecurityProtocolToStringA InternetSecurityProtocolToStringW InternetServerPushParse InternetSetCookieA InternetSetCookieExA InternetSetCookieExW InternetSetCookieW InternetSetDialState InternetSetDialStateA InternetSetDialStateW InternetSetFilePointer InternetSetOptionA InternetSetOptionExA InternetSetOptionExW InternetSetOptionW InternetSetPerSiteCookieDecisionA InternetSetPerSiteCookieDecisionW InternetSetStatusCallback InternetSetStatusCallbackA InternetSetStatusCallbackW InternetShowSecurityInfoByURL InternetShowSecurityInfoByURLA InternetShowSecurityInfoByURLW InternetTimeFromSystemTime InternetTimeFromSystemTimeA InternetTimeFromSystemTimeW InternetTimeToSystemTime InternetTimeToSystemTimeA InternetTimeToSystemTimeW InternetUnlockRequestFile InternetWriteFile InternetWriteFileExA InternetWriteFileExW IsHostInProxyBypassList IsUrlCacheEntryExpiredA IsUrlCacheEntryExpiredW LoadUrlCacheContent ParseX509EncodedCertificateForListBoxEntry PrivacyGetZonePreferenceW PrivacySetZonePreferenceW ReadUrlCacheEntryStream RegisterUrlCacheNotification ResumeSuspendedDownload RetrieveUrlCacheEntryFileA RetrieveUrlCacheEntryFileW RetrieveUrlCacheEntryStreamA RetrieveUrlCacheEntryStreamW RunOnceUrlCache SetUrlCacheConfigInfoA SetUrlCacheConfigInfoW SetUrlCacheEntryGroup SetUrlCacheEntryGroupA SetUrlCacheEntryGroupW SetUrlCacheEntryInfoA SetUrlCacheEntryInfoW SetUrlCacheGroupAttributeA SetUrlCacheGroupAttributeW SetUrlCacheHeaderData ShowCertificate ShowClientAuthCerts ShowSecurityInfo ShowX509EncodedCertificate UnlockUrlCacheEntryFile UnlockUrlCacheEntryFileA UnlockUrlCacheEntryFileW UnlockUrlCacheEntryStream UpdateUrlCacheContentPath UrlZonesDetach

Name

.text

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

132KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

99d56031d36fc03e042e0b34ac620c85c91d4e25963b2a5b3bd8176fdb3f9ce6

PE Signature issue

advapi32

kernel32

mpr

ntdll

shell32

shlwapi

ucrtbase

user32

ws2_32

generic