e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538

Sharing

Copy URL Twitter E-mail

General

Target
e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538
Size 11.9MB
Sample260720-rn3mesey9t
SHA256 e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538
MD5 2867beee389b798f609415def1d62f81
SHA1 2cfb870515df40ee42b481804ffcd323ee0acdce
SHA512 8d1a337c3b28927b6eb502bf0b081199d72eb2fcbbcd2a9f21f4e961fe22ad9e71dd5439371cbdb88b34e78a20d99c1b51e891f102f10def829b99f22932c643
SSDEEP 196608:aG5QyS7S+UoXrVg0Yke5QyS7S+UoXrVgxR3Fszuhnv9FC3YaaRykLOyc:HA++hrVg0YkeA++hrVgxwzybCIaqyOQ
TLSH
T1C1C623127783C0B6E4D662B046651B396AB98B204FE4C9D3EFE8CD653C321F2577624E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538

File Explorer

e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538

.exe 11.9MB

e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538

IMPHASH 118c73183d26bf3734667a01632a14a9
SHA256 e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538
MD5 2867beee389b798f609415def1d62f81
SHA1 2cfb870515df40ee42b481804ffcd323ee0acdce
SHA512 8d1a337c3b28927b6eb502bf0b081199d72eb2fcbbcd2a9f21f4e961fe22ad9e71dd5439371cbdb88b34e78a20d99c1b51e891f102f10def829b99f22932c643
SSDEEP 196608:aG5QyS7S+UoXrVg0Yke5QyS7S+UoXrVgxR3Fszuhnv9FC3YaaRykLOyc:HA++hrVg0YkeA++hrVgxwzybCIaqyOQ
TLSH
T1C1C623127783C0B6E4D662B046651B396AB98B204FE4C9D3EFE8CD653C321F2577624E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

66:28:22:df:22:f8:1e:97:a3:74:99:67:e2:20:59:67:ec:82:61:de:3a:66:7f:62:04:49:24:57:59:1c:bf:ee

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

Chains

Jul 17, 2026

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

Serial Number

60:14:b5:6e:4f:ff:35:dc:4c:94:84:52:b7:7c:9a:a9

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2021 - Oct 25, 2022

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

02:7c:39:01:0c:a7:5a:c3:3a:b5:ee:0d:54:0e:f9:e5

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

839893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalLock GlobalAlloc SuspendThread ReleaseMutex CreateMutexA GetCurrentProcess TerminateThread SetFileTime LocalFileTimeToFileTime GetLocalTime SystemTimeToFileTime UnmapViewOfFile GetFileSize SetFilePointer SetStdHandle GlobalUnlock IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess RaiseException GetSystemTime GetTimeZoneInformation RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc FileTimeToLocalFileTime FileTimeToSystemTime CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA SetLastError LocalFree InterlockedDecrement InterlockedIncrement FindFirstFileA FindClose GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress CloseHandle MulDiv GetCommandLineA GetTickCount WaitForSingleObject

user32

wsprintfA CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetForegroundWindow GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA LoadStringA GetSysColorBrush SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor UnregisterClassA

gdi32

SetROP2 SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart midiStreamRestart

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

Shell_NotifyIconA ShellExecuteA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

RegisterTypeLi LoadTypeLi UnRegisterTypeLi SystemTimeToVariantTime

comctl32

ord17 ImageList_Destroy

ws2_32

WSAAsyncSelect closesocket recvfrom ioctlsocket recv WSACleanup getpeername accept ntohl inet_ntoa

comdlg32

ChooseColorA GetOpenFileNameA GetSaveFileNameA GetFileTitleA

Sharing

General

Malware Config

Signatures

File Explorer

e16a49bf92013759b41d3fa36464aaef6e81f01355f6e8d1466263af6f896538

PE Signature issue

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic