5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e.7z
- SHA256 0e1429414528b545634abd068f91ff5cf977fc793fbc9a04dd4426b1050b06f9
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
General
- Target 5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e.7z
- Size 110KB
- Sample260720-wtyymscv8x
- SHA256 0e1429414528b545634abd068f91ff5cf977fc793fbc9a04dd4426b1050b06f9
- MD5 e79e306b9de15b29087fced917c3aafd
- SHA1 32dde6664747dba990195a05d314a7c9889d2fe7
- SHA512 4f5c77d348286808fa948b35adbf14e8eaca560768da2d92f6f6ec5b90949d2f1bced113b1e5510a8826c19d5b78a6db8b7b2ad47348856b805d71711ca5460d
- SSDEEP 1536:ZXumMeaRc6oKshIvxCRVNzctETgKWrZSoIlhwaZK/SyLcWFKMHRabMKq7uSdz:ZXBMeaIph4CRV2qT4ZSoI7NK/FzB7Tdz
- TLSH T1EFB302668E1DBD16EBADEDC9C5FD8168C3C489811E2324B7DF8B5D343610C84789D3AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e.7z.7z 110KB
-
5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e.exe 264KB
5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e
- IMPHASH 17de35bd7cf43148433d7f0082ed6b61
- SHA256 5723102102ab74c3679d1cffcf96a4e96cc482488e3f306c6b07da4acb1c467e
- MD5 8ac79925a4cb66d72c0eff86f3666321
- SHA1 26504206d2baefca810442540f8d65f5c499873d
- SHA512 24fb32bebb65485baa6e449fd125acf09b677dfa4336b80a1e3d8ef0d63bf23feaf4db7f5659850b7cc52474e18882b7f278c316bbe0a65db35db552a58add28
- SSDEEP 3072:phZPOgLpukuN+UcN9Ck4m9NTBfXEV3Mxhtoi0S2YA:/ZLL8kowN9CsNTBfE1Mx3gJt
- TLSH T1B4446A1132C084F2D86642B15CE7B725492FF92F4F619DCB3F8A2A190D713D0AA3669F
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
f9:4c:a9:0a:d0:eb:66:6a:62:b3:a4:27:da:32:fa:7f:07:f0:07:f0:64:35:dc:e3:35:37:a2:74:be:68:06:ee
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Chains
Feb 21, 2024
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN
Serial Number
0d:da:f2:fe:51:f3:b2:e9:4c:bb:69:5a:4a:51:74:fc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2022 - Oct 17, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
5
Entry point
38052
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\MicroMsg\trunk\MicroMsgWindows\tools\WeChatExt\Release\WeChatExt.pdb
kernel32
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
CloseHandle
WaitForSingleObject
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
CreateDirectoryW
GetVersionExW
GetModuleFileNameW
GetTimeZoneInformation
GetSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
DeleteFileW
FindNextFileW
CreateMutexW
CreateProcessW
OpenMutexW
GetProcessId
ReleaseMutex
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
WriteConsoleW
GetLocalTime
FindClose
EnterCriticalSection
GetLastError
FlushFileBuffers
CreateFileW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
SetFilePointer
FindFirstFileW
SetStdHandle
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointerEx
GetFileType
GetConsoleMode
GetConsoleCP
GetProcessHeap
GetStdHandle
GetOEMCP
GetACP
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
GetStringTypeW
GetSystemTimeAsFileTime
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
HeapAlloc
GetCommandLineW
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage
user32
GetSystemMetrics
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
shlwapi
PathFileExistsW
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=205, version=50929,
count=74, id=207, version=50929,
count=220, id=206, version=50929,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=153, id=1, productName=Unmarked objects,
count=31, id=211, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=3, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,