360anquanweishi[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
360anquanweishi.exe
Size 3.9MB
Sample260720-w31tlac191
SHA256 1eef30fd6f5da9d83d52a26be2a1ae71b47e7a45a6356c15aec011688debb700
MD5 5b333ea71ae2d4f60278c364d916a90e
SHA1 7f7d90fc6f52a96033ce6df9f13b0b0a363f109c
SHA512 03f350b96dd499c485ba02e02cf1377933f6a28f2b990acf807e8b990caa5cd8382dde56a1e3b07db79b26412de0ff3784565571abdbf21524084d56b33e4b44
SSDEEP 98304:4VbTVFfe6U4FL8VtL0hviDfHraEY1qhJonrnYtcW:cT3fq4yVBDfLawkk
TLSH
T1171601113BD1C075C1B31932DB78E65A4EF5AD314B314BCBA6983A2E5F34EC1AA39316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

360anquanweishi.exe

.exe 3.9MB

360anquanweishi.exe

IMPHASH e2bf465b5ff473c3cbc86d5677bbfc4b
SHA256 1eef30fd6f5da9d83d52a26be2a1ae71b47e7a45a6356c15aec011688debb700
MD5 5b333ea71ae2d4f60278c364d916a90e
SHA1 7f7d90fc6f52a96033ce6df9f13b0b0a363f109c
SHA512 03f350b96dd499c485ba02e02cf1377933f6a28f2b990acf807e8b990caa5cd8382dde56a1e3b07db79b26412de0ff3784565571abdbf21524084d56b33e4b44
SSDEEP 98304:4VbTVFfe6U4FL8VtL0hviDfHraEY1qhJonrnYtcW:cT3fq4yVBDfLawkk
TLSH
T1171601113BD1C075C1B31932DB78E65A4EF5AD314B314BCBA6983A2E5F34EC1AA39316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

73:5b:d9:11:76:51:a5:b7:9c:36:b1:4f:2e:21:0d:3b:05:84:c1:15:f8:b7:09:0a:55:ac:f0:ac:99:93:d0:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 20, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

587969

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\823780\out\Release\360Installer.pdb

kernel32

GetWindowsDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetFileSizeEx GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW LocalFree GetCommandLineW OpenProcess GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeW QueryDosDeviceW FindFirstVolumeW MulDiv GetPrivateProfileIntW GetPrivateProfileStringW InterlockedCompareExchange InterlockedExchange TerminateThread WaitForSingleObject CreateThread CopyFileW WritePrivateProfileStringW TlsAlloc TerminateProcess MoveFileExW FindNextFileW FindClose FindFirstFileW GetFullPathNameW RemoveDirectoryW lstrlenA GetLocalTime CreateMutexW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetExitCodeThread IsBadReadPtr SetEvent CreateEventW OpenMutexW FreeResource HeapFree HeapAlloc GetProcessHeap GetVolumeNameForVolumeMountPointW CreateFileA PeekConsoleInputA SetConsoleMode ReadConsoleInputA FileTimeToDosDateTime GetTempFileNameW FormatMessageW CreateDirectoryW GetStdHandle SetConsoleTextAttribute CompareStringW WriteFile GetLocaleInfoW GetTimeZoneInformation QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStartupInfoA GetFileType SetHandleCount GetModuleHandleA InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetModuleFileNameA GetCurrentThread IsValidCodePage GetOEMCP GetACP FatalAppExitA HeapCreate GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetConsoleMode GetConsoleCP ExitProcess RtlUnwind GetSystemWindowsDirectoryW lstrcmpiA lstrcmpA FlushFileBuffers TlsFree ReleaseMutex HeapWalk HeapLock OpenThread HeapUnlock OutputDebugStringW SetFilePointerEx SetEndOfFile GetSystemTimeAsFileTime SystemTimeToFileTime HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetFileInformationByHandle CompareStringA FileTimeToLocalFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesW GetTickCount TlsSetValue TlsGetValue DeleteFileW GetFileSize GetFileAttributesW WideCharToMultiByte CreateProcessW SetCurrentDirectoryW GetLongPathNameW ReadFile SetFilePointer CreateFileW DeviceIoControl CloseHandle GetCurrentProcessId Sleep GetTempPathW LoadLibraryExW MultiByteToWideChar FreeLibrary GetModuleFileNameW SetLastError lstrcmpiW InterlockedDecrement InterlockedIncrement GetLastError lstrlenW GetCurrentThreadId SetEnvironmentVariableW GetModuleHandleW GetSystemDirectoryW GetProcAddress LoadLibraryW GetCurrentProcess FlushInstructionCache FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExW RaiseException SetEnvironmentVariableA GetNumberOfConsoleInputEvents

user32

GetWindowDC InflateRect EnableWindow IsWindowEnabled GetWindowTextW UpdateWindow SetRect RegisterClassExW GetClassInfoExW GetSysColor SetCursor OffsetRect UpdateLayeredWindow GetDesktopWindow GetDlgCtrlID SetWindowLongW FindWindowW LoadCursorW DefWindowProcW DispatchMessageW UnregisterClassA TranslateMessage GetMessageW PeekMessageW CharNextW DestroyWindow CreateDialogParamW MessageBoxW PostMessageW IsWindow SendMessageW GetActiveWindow DialogBoxParamW LoadStringW GetWindowLongW MoveWindow GetWindowRect GetClientRect SetFocus GetDlgItem SetWindowPos GetCursorPos LoadBitmapW GetDC GetWindowTextLengthW GetFocus IsRectEmpty GetWindowThreadProcessId FindWindowExW AdjustWindowRectEx SetScrollInfo ShowScrollBar GetScrollRange ReleaseDC CreateWindowExW SetWindowRgn ShowWindow BeginPaint EndPaint IsWindowVisible wsprintfW PtInRect CopyRect SetForegroundWindow IsIconic SetWindowTextW BringWindowToTop ScreenToClient ClientToScreen SendMessageTimeoutW InvalidateRect RedrawWindow SetTimer KillTimer IsDialogMessageW GetScrollPos ReleaseCapture SetCapture GetScrollInfo SystemParametersInfoW SetScrollRange DrawTextW FillRect UnionRect IntersectRect CallWindowProcW SetScrollPos SetLayeredWindowAttributes EndDialog GetSystemMetrics LoadImageW GetClassNameW PostQuitMessage LoadIconW GetParent GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints

gdi32

CreatePatternBrush DeleteDC BitBlt SelectObject GetObjectW CreatePolygonRgn DeleteObject CreateFontW EnumFontFamiliesW CreateRectRgn GetTextMetricsW CreateCompatibleBitmap SaveDC RestoreDC OffsetViewportOrgEx SetViewportOrgEx GetClipBox SetBkMode SetTextColor GetStockObject SetStretchBltMode SetDIBColorTable CreateDIBSection CreateSolidBrush CreateCompatibleDC GetDeviceCaps CombineRgn GetTextMetricsA SetBkColor DPtoLP GetTextExtentPointA CreateFontIndirectW StretchBlt

advapi32

GetTokenInformation RegOpenKeyExA RegEnumKeyExA RegQueryValueExA OpenSCManagerW OpenServiceW QueryServiceStatusEx CloseServiceHandle GetUserNameW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegCloseKey RegOpenKeyExW RegSetValueExW OpenProcessToken

shell32

SHBrowseForFolderW SHCreateDirectoryExW ShellExecuteW SHFileOperationW ord165 CommandLineToArgvW SHAppBarMessage Shell_NotifyIconW ShellExecuteExW SHGetSpecialFolderPathW SHGetPathFromIDListW

ole32

CoInitialize CLSIDFromProgID CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoCreateGuid CreateStreamOnHGlobal CoTaskMemAlloc CoUninitialize CoTaskMemFree CoTaskMemRealloc CoCreateInstance

oleaut32

SysFreeString OleLoadPicture VariantInit GetErrorInfo SetErrorInfo VarUI4FromStr SysAllocString VariantClear VariantChangeType SafeArrayDestroy SafeArrayCreate VariantCopy SysStringByteLen SysAllocStringByteLen SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetVartype SafeArrayGetUBound SafeArrayGetLBound SysAllocStringLen DispCallFunc CreateErrorInfo

shlwapi

StrCmpW StrCmpIW StrStrIA StrCmpNIW StrTrimA StrToIntExW SHGetValueA SHSetValueA SHDeleteValueW SHSetValueW PathIsPrefixW PathIsDirectoryEmptyW PathIsSameRootW StrStrIW PathAppendW PathFileExistsW PathCombineW SHGetValueW StrCpyW PathIsDirectoryW wnsprintfW PathRemoveExtensionW PathFindFileNameW StrStrW PathIsRelativeW PathRemoveFileSpecW

comctl32

InitCommonControlsEx _TrackMouseEvent

msimg32

TransparentBlt AlphaBlend

gdiplus

GdipBitmapLockBits GdipGetGenericFontFamilySansSerif GdipDrawImageRectI GdipDrawImageRect GdipBitmapSetResolution GdipCreateBitmapFromScan0 GdipSetPropertyItem GdipGetAllPropertyItems GdipGetPropertySize GdipGetImageEncodersSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipSetImagePalette GdipGetImageVerticalResolution GdipGetImageHorizontalResolution GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipImageSelectActiveFrame GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageFlags GdipGetImageEncoders

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetProcessImageFileNameW GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

iphlpapi

GetIpAddrTable GetAdaptersInfo

wininet

InternetConnectW InternetGetConnectedState HttpQueryInfoW InternetSetOptionW InternetReadFile InternetQueryOptionW InternetOpenW InternetCrackUrlW InternetCloseHandle HttpOpenRequestW HttpSendRequestW

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

setupapi

SetupIterateCabinetW

ws2_32

WSACleanup gethostbyname WSAStartup inet_ntoa

Sharing

General

Malware Config

Signatures

File Explorer

360anquanweishi.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

psapi

iphlpapi

wininet

urlmon

setupapi

ws2_32

generic