imyfone-anyto_setup-com_anytoen[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
imyfone-anyto_setup-com_anytoen.exe
Size 2.9MB
Sample260721-3k2rhagd64
SHA256 721d9eb9f8c5779147fc1436e80b34ec38eb803469cefa2f5c5be0b610b343df
MD5 67404211c5e74e0d14e28d81c55b20d7
SHA1 f21830569c3abd7864113b47a8388ee1979e98d7
SHA512 9c5da55e56ce1c50be5d1de8a4f78633dea1747d7d8724850ca46f38153428947e1d34e10f2a7929df8ae141f21b687a8124f9aaf932b3070aeed60e71fb36ce
SSDEEP 49152:+8GXEc+eSEznma6PPhMwY3B58DyBpPsGYPVtV6CFbdfPvWk:+8EEjeSEzn96nhMwY3BlF6VP
TLSH
T134E5BF12F791C176E69302B1993A677E843DEA20173595C3E3C81E2D5D706C36B3A3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

imyfone-anyto_setup-com_anytoen.exe

.exe 2.9MB

imyfone-anyto_setup-com_anytoen.exe

IMPHASH 217f66f9c3f2cdf7065e3f96133a614a
SHA256 721d9eb9f8c5779147fc1436e80b34ec38eb803469cefa2f5c5be0b610b343df
MD5 67404211c5e74e0d14e28d81c55b20d7
SHA1 f21830569c3abd7864113b47a8388ee1979e98d7
SHA512 9c5da55e56ce1c50be5d1de8a4f78633dea1747d7d8724850ca46f38153428947e1d34e10f2a7929df8ae141f21b687a8124f9aaf932b3070aeed60e71fb36ce
SSDEEP 49152:+8GXEc+eSEznma6PPhMwY3B58DyBpPsGYPVtV6CFbdfPvWk:+8EEjeSEzn96nhMwY3BlF6VP
TLSH
T134E5BF12F791C176E69302B1993A677E843DEA20173595C3E3C81E2D5D706C36B3A3AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

3b:4e:cb:7c:ab:b7:b8:2f:43:61:43:70:06:09:cc:0e:79:9e:92:86:94:4b:3a:1b:5d:60:7a:45:2e:d6:e0:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2959060,CN=Cleverguard Technology Co.\, Limited,O=Cleverguard Technology Co.\, Limited,L=YAU TSIM MONG,ST=KOWLOON,C=HK,1.3.6.1.4.1.311.60.2.1.3=#1302484b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 12, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

06:0f:df:ef:f7:3b:5c:e4:69:e4:9a:78

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2023 - Oct 31, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1826068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins_154\workspace\CG_Downloader\output\Release\MFDownloader.pdb

kernel32

LocalFree PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent FormatMessageW TlsAlloc TlsFree CreateEventA VerSetConditionMask InterlockedCompareExchange TerminateThread GetOverlappedResult CreateIoCompletionPort GetQueuedCompletionStatus QueueUserAPC ReleaseSemaphore WaitForMultipleObjects DeviceIoControl SetEndOfFile SetFilePointerEx GetSystemTimeAsFileTime GetSystemInfo lstrcmpiA TlsGetValue TlsSetValue SleepEx WaitForSingleObjectEx ReadFileScatter WriteFileGather CreateEventW CreateWaitableTimerW SetWaitableTimer VerifyVersionInfoW InitializeCriticalSection OutputDebugStringA GetModuleFileNameA GetModuleHandleExA OutputDebugStringW GetSystemTime GetStdHandle FindClose QueryPerformanceCounter GetCurrentProcessId FreeLibrary GlobalMemoryStatus FlushConsoleInputBuffer GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW RemoveDirectoryW MoveFileExW AreFileApisANSI PeekNamedPipe FileTimeToLocalFileTime SetEnvironmentVariableA WriteConsoleW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW InterlockedExchangeAdd SetStdHandle FlushFileBuffers UnregisterWaitEx InitializeSListHead FreeLibraryAndExitThread GetThreadTimes VirtualProtect VirtualFree VirtualAlloc GetVersionExW FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP ReadConsoleW GetOEMCP IsValidCodePage HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue CreateSemaphoreW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo SetConsoleMode ReadConsoleInputA GetConsoleMode GetModuleHandleExW GetTimeZoneInformation LoadLibraryExW ExitThread SetConsoleCtrlHandler IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW HeapReAlloc RtlUnwind RaiseException DecodePointer EncodePointer GetCurrentThread GetStringTypeW InterlockedExchange FormatMessageA GetCurrentThreadId GlobalUnlock GetModuleHandleA GlobalLock GlobalAlloc InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement GetLocalTime DosDateTimeToFileTime SystemTimeToFileTime DuplicateHandle SetFileTime SetFilePointer GetFileType GetCurrentProcess MulDiv GetFileSize WriteFile ExitProcess GetCurrentDirectoryW LoadLibraryW GetTickCount GetACP CreateMutexW DeleteFileW GetFileAttributesW CreateFileW CreateDirectoryW ReadFile Sleep SetLastError CreateThread GetProcessHeap HeapFree HeapAlloc WideCharToMultiByte MultiByteToWideChar FreeResource Process32NextW Process32FirstW CreateToolhelp32Snapshot GetUserDefaultUILanguage GetDiskFreeSpaceExW GetPrivateProfileSectionW GetPrivateProfileStringW CreateProcessW GetModuleFileNameW LoadLibraryA lstrcpyW lstrcmpW CloseHandle WaitForSingleObject ResumeThread GetLastError TerminateProcess OpenProcess GetProcAddress FindResourceW GetModuleHandleW SizeofResource LoadResource LockResource FindFirstFileExW

user32

FindWindowW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow SetWindowPos IsIconic SetFocus EnableWindow GetSystemMetrics GetMenu SetPropW GetPropW GetClientRect GetWindowRect AdjustWindowRectEx GetWindowLongW SetWindowLongW GetParent GetWindow LoadCursorW LoadImageW MonitorFromWindow GetMonitorInfoW wvsprintfW SetCursor UnionRect SetForegroundWindow DestroyWindow CharNextW GetActiveWindow GetFocus BeginPaint EndPaint GetUpdateRect InvalidateRect ShowWindow MessageBoxW KillTimer MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW MoveWindow GetCursorPos ScreenToClient MapWindowPoints IntersectRect IsRectEmpty PtInRect IsZoomed SetWindowRgn SetWindowTextW GetWindowTextW GetWindowTextLengthW GetCaretBlinkTime GetCaretPos ReleaseDC CharPrevW DrawTextW FillRect SetRect CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor ReleaseCapture SetCapture SetTimer CharLowerA IsWindowVisible PostQuitMessage wsprintfW OffsetRect GetDC GetKeyState

gdi32

GetDeviceCaps GdiFlush ExtTextOutW TextOutW MoveToEx SetStretchBltMode StretchBlt SetBkColor ExtSelectClipRgn SelectClipRgn GetObjectA LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn SetTextColor SetBkMode CreateSolidBrush CreatePatternBrush CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt RoundRect CreateDIBSection

shell32

ShellExecuteExW SHGetSpecialFolderLocation SHCreateDirectoryExW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW ord165

ole32

CoInitialize CoCreateInstance CoCreateGuid CoTaskMemFree CoUninitialize CLSIDFromString CLSIDFromProgID OleLockRunning CreateStreamOnHGlobal

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash DeregisterEventSource RegisterEventSourceA ReportEventA

gdiplus

GdipAlloc GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipGetFamily GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDeleteFontFamily GdipDrawImageRectI GdipDrawImage GdipGraphicsClear GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipCreateLineBrushI GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comctl32

ImageList_Create _TrackMouseEvent ord17

imm32

ImmGetContext ImmSetCompositionFontW ImmSetCompositionWindow ImmReleaseContext

winhttp

WinHttpOpen WinHttpConnect WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpCloseHandle

ws2_32

ntohl ntohs htons htonl getsockopt getsockname ioctlsocket connect closesocket bind accept __WSAFDIsSet WSACleanup setsockopt WSASetLastError WSAGetLastError WSAIoctl listen shutdown recv gethostbyname inet_addr socket freeaddrinfo WSARecv getaddrinfo WSASocketW select WSASend WSAStartup send

wininet

HttpAddRequestHeadersA HttpSendRequestA InternetReadFile InternetConnectW HttpOpenRequestW HttpSendRequestW HttpQueryInfoA HttpQueryInfoW InternetCloseHandle InternetQueryOptionW InternetSetOptionW InternetOpenW InternetConnectA HttpOpenRequestA InternetGetConnectedState

shlwapi

PathFileExistsW PathFindFileNameW PathFindFileNameA StrToIntW

Sharing

General

Malware Config

Signatures

File Explorer

imyfone-anyto_setup-com_anytoen.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

gdiplus

version

comctl32

imm32

winhttp

ws2_32

wininet

shlwapi

generic