7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016

General

Target
7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016
Size 2.5MB
Sample260716-k38nnahs4l
SHA256 7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016
MD5 685bfca426736a02b4874bb93060a48a
SHA1 36213ad9716872d0ff451a1fef397eaf86573ce2
SHA512 23438dcb9d0e01738df856ccb5b940a369b4dff631fd35de156ecd8a6f2c71de35db3f5809cde2a163c623427eca0a35ea92e36def51597c7219cd38d80145ff
SSDEEP 49152:P3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm7:g8x+woYy0xp6nN0tzV4
TLSH
T135C5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016

File Explorer

7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016

.exe 2.5MB

7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016

IMPHASH 5dbb7bcda197e66e5aa007adb6d32b7a
SHA256 7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016
MD5 685bfca426736a02b4874bb93060a48a
SHA1 36213ad9716872d0ff451a1fef397eaf86573ce2
SHA512 23438dcb9d0e01738df856ccb5b940a369b4dff631fd35de156ecd8a6f2c71de35db3f5809cde2a163c623427eca0a35ea92e36def51597c7219cd38d80145ff
SSDEEP 49152:P3o6Y8xllqwo8qWUdkdxWu6nos0t7XVm7:g8x+woYy0xp6nN0tzV4
TLSH
T135C5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D769C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

74:54:fb:1d:c0:a3:cc:04:35:2b:4b:40:69:ad:41:ab:2b:27:f6:bd:52:eb:4b:07:f5:ad:0a:09:ba:a9:6d:17

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

PE Signature issue

Digest

ac:b6:44:8f:ab:4c:63:12:01:3b:82:ae:d3:be:45:b7:2f:3e:d1:b9

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

07:aa:52:5b:f1:73:f0:e5:e3:68:d8:ae:77:0f:8a:af

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2019 - Oct 12, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

10807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA Sleep GetTickCount HeapFree HeapAlloc GetCommandLineA HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer HeapCreate GetModuleHandleW GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FindFirstFileA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetStdHandle WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers CreateFileW FindNextFileA FindClose GetModuleHandleA GetProcAddress GetSystemDirectoryA DeleteFileA CreateEventA CreateThread lstrcatA CreateProcessA WaitForMultipleObjects TerminateProcess GetCurrentDirectoryA GetLastError WaitForSingleObject GetExitCodeProcess ExitProcess GetVersionExA GetCurrentProcess SetEvent GetLocalTime CreateFileA SetFilePointer WriteFile CloseHandle FreeEnvironmentStringsW GetModuleFileNameA

shell32

ShellExecuteExA

advapi32

RegCreateKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA SetServiceStatus RegisterEventSourceA RegisterServiceCtrlHandlerExA StartServiceCtrlDispatcherA ControlService DeleteService CreateServiceA OpenSCManagerA OpenServiceA QueryServiceConfigA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus StartServiceA CloseServiceHandle OpenProcessToken GetTokenInformation RegSetValueExA

shlwapi

PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

7ea0669432557c7693ac20877f156c9b06989afffd3d901821697ee626341016

PE Signature issue

PE Signature issue

kernel32

shell32

advapi32

shlwapi

generic