662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c

Sharing

Copy URL Twitter E-mail

General

Target
662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c
Size 1.6MB
Sample260716-e6dd2ac18n
SHA256 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c
MD5 6915bdcb7e9c215e7fdbc50fcf4a3b5d
SHA1 a75dbc2873993352559a061133258a4acbdc6ee4
SHA512 990e98ee5c6e51d3c86b987630ada4db87e1c09230c39a0cd813f70f1101a5e78d275605b391db5a0ae1088292f10345af48afae250f4c9185e73be3ff1cb5ad
SSDEEP 12288:2LhhlC2lrPLhhlC2lrsF/ZewYtImfQ2hVN:uI2lrbI2lriryDQ2hVN
TLSH
T1F775759033E49993F672833958F6D2213B39BA515776CB0B8200692D1D37BC36ED6B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c

File Explorer

662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c

.exe 1.6MB

662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c

IMPHASH d02a02c8ecedb70823a9d0178cd7b7fc
SHA256 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c
MD5 6915bdcb7e9c215e7fdbc50fcf4a3b5d
SHA1 a75dbc2873993352559a061133258a4acbdc6ee4
SHA512 990e98ee5c6e51d3c86b987630ada4db87e1c09230c39a0cd813f70f1101a5e78d275605b391db5a0ae1088292f10345af48afae250f4c9185e73be3ff1cb5ad
SSDEEP 12288:2LhhlC2lrPLhhlC2lrsF/ZewYtImfQ2hVN:uI2lrbI2lriryDQ2hVN
TLSH
T1F775759033E49993F672833958F6D2213B39BA515776CB0B8200692D1D37BC36ED6B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

09:0d:59:2c:d5:38:cf:26:6d:f0:ef:8f:76:c8:16:e3:bb:91:59:ee

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Chains

May 26, 2026

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Subject

CN=Yaagl,O=Yaagl,ST=Seoul,C=KR

Serial Number

10:07

Issuer

CN=Dawn Winery CA1,OU=Dawn Winery Certificate Authority,O=The Dawn Winery,ST=Ontario,C=CA

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2026 - Jun 4, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

13632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memcmp memmove memset qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsstr

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c

PE Signature issue

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic