4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965

General

Target
4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965
Size 5.7MB
Sample260724-ftgrcssfnh
SHA256 4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965
MD5 9a459e013ed2b728134eac177238be23
SHA1 054dc01b34c2aa5e88516f5286aa2aae107c7f02
SHA512 9ebd97df67e4733c9dfe4758a62c8ef8386d4e21ce147b0feefc855d898669fea6eb8dc61aae218901c1d5487f228effff2f8ef737defe2b76467eb78a859e5a
SSDEEP 98304:Pjr5OY9nsEhDpjHmo4rnoRcioTjbf0g/+aB8SFQcSf79bnMsKPM5D1Im:PjrPSEhl7m1rhbcg/+aBhFrST9zxd1Im
TLSH
T17856334A0D88DA3C0599BF8B5262316E34CA650966BD3373F18461543F6CFBC8A7D8E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DingTalkD_Setup.exe

File Explorer

4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965

.zip 5.7MB
DingTalkD_Setup.exe

.exe 5.8MB

4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965

SHA256 4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965
MD5 9a459e013ed2b728134eac177238be23
SHA1 054dc01b34c2aa5e88516f5286aa2aae107c7f02
SHA512 9ebd97df67e4733c9dfe4758a62c8ef8386d4e21ce147b0feefc855d898669fea6eb8dc61aae218901c1d5487f228effff2f8ef737defe2b76467eb78a859e5a
SSDEEP 98304:Pjr5OY9nsEhDpjHmo4rnoRcioTjbf0g/+aB8SFQcSf79bnMsKPM5D1Im:PjrPSEhl7m1rhbcg/+aBhFrST9zxd1Im
TLSH
T17856334A0D88DA3C0599BF8B5262316E34CA650966BD3373F18461543F6CFBC8A7D8E7
MD5 SHA1 SHA512 SSDEEP TLSH

DingTalkD_Setup.exe

IMPHASH c947183695560cc59793fd7524f97c8f
SHA256 cb8e4d9dc39ecddc58f6eba2b60ffda80fad7119aad0ea2d7f2501573471ad4f
MD5 c60770cfcdfb538b3b3eea24666fb92f
SHA1 83e70b8d7ff57509790eddc4510aadd9fbd3a8c1
SHA512 2544459f22e99fb84e2f3e9105f7883309c503907285331883ae37cdd625788a2973fbf3e4f26fdee0e8cb3f0d1f8eec7544d7e78f41f4778da5873283eb3254
SSDEEP 98304:WzclJ5CYn/KCjhRzHeeMzngRmKa5jjN00DE6BuYHeaQ77hbrgkUtMfzfIIo2X:WkJriCjzrevzpjO0DE6BVHpQX5PNbfIe
TLSH
T14F5633474D88C538CAB4BF7B516334BA348B5D2CD2A93223F5C472983979A7C963B493
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6652554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965

DingTalkD_Setup.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965

DingTalkD_Setup.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic