8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130

Sharing

Copy URL Twitter E-mail

General

Target
8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130
Size 747KB
Sample260716-dwtgtscs2j
SHA256 8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130
MD5 0f89aebf8cff6ef92bd7a3c4c4bcd3c1
SHA1 48a2626a5e67a37829cf902cc319765b5709c651
SHA512 bebeeedbe9d8a2c16360d363f8f6173373f8c96b71961e193ce5eca8a702deaad609cca997d2734844e89fae5a232e6ac7258eee16a470fec6037b21ebaa5f3c
SSDEEP 6144:B4rKnVcJpznuVo/FXRrCv7e3lrh8G8xcGTdAEyjHZ4:2LhhlC2lrhpyBuE2HZ4
TLSH
T1CBF4D79072E458D7E626833858E7E2313739B6514763DB1B8100E93D1E37BD32EDAB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130

File Explorer

8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130

.exe 747KB

8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130

IMPHASH d02a02c8ecedb70823a9d0178cd7b7fc
SHA256 8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130
MD5 0f89aebf8cff6ef92bd7a3c4c4bcd3c1
SHA1 48a2626a5e67a37829cf902cc319765b5709c651
SHA512 bebeeedbe9d8a2c16360d363f8f6173373f8c96b71961e193ce5eca8a702deaad609cca997d2734844e89fae5a232e6ac7258eee16a470fec6037b21ebaa5f3c
SSDEEP 6144:B4rKnVcJpznuVo/FXRrCv7e3lrh8G8xcGTdAEyjHZ4:2LhhlC2lrhpyBuE2HZ4
TLSH
T1CBF4D79072E458D7E626833858E7E2313739B6514763DB1B8100E93D1E37BD32EDAB1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

23:f4:06:81:d3:f1:40:a4:92:24:49:de:2e:57:d0:79:21:fd:3d:89

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Chains

May 26, 2026

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Subject

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Serial Number

10:07

Issuer

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2026 - Jun 4, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

13632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memcmp memmove memset qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsstr

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8b683bd80d7b34f1d16b3a7e9adc4f8f83e3df0eaedb5f1e6f2078ac02ea1130

PE Signature issue

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic