29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88

Sharing

Copy URL Twitter E-mail

General

Target
29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88
Size 508KB
Sample260727-vwrrnsxeqa
SHA256 29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88
MD5 5b45a788b26e228f2c3cc89f3ef55e5a
SHA1 f42cddffa42d163af0678bac4e3e5c2cdc43c399
SHA512 9641c26515d30b5d30833587941ca99daf2774dae8aadc59ec1f92939760d456c1306cdb2f3b9a793fc5b2786dc3dc53f563a1aa43017e41bf77850def155a10
SSDEEP 6144:fsqEFVpd2I/FjIyU8CM1BCgFZrTmzHASzA9JSohtT5DeT56:fsqKd3/5Iy+MGcryUJSof5CT56
TLSH
T19EB4E607E6DC3CE9D0769238AB7797C1E37DFC4903A1C69F12E402569E2E1927D2A790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88

.exe 508KB

29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88

IMPHASH 60b1ecb26d0718f8b9cf390fce3a4d61
SHA256 29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88
MD5 5b45a788b26e228f2c3cc89f3ef55e5a
SHA1 f42cddffa42d163af0678bac4e3e5c2cdc43c399
SHA512 9641c26515d30b5d30833587941ca99daf2774dae8aadc59ec1f92939760d456c1306cdb2f3b9a793fc5b2786dc3dc53f563a1aa43017e41bf77850def155a10
SSDEEP 6144:fsqEFVpd2I/FjIyU8CM1BCgFZrTmzHASzA9JSohtT5DeT56:fsqKd3/5Iy+MGcryUJSof5CT56
TLSH
T19EB4E607E6DC3CE9D0769238AB7797C1E37DFC4903A1C69F12E402569E2E1927D2A790
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fe:75:6d:56:ab:2b:9a:94:e0:e5:59:a0:92:39:24:41:9b:22:d1:7f:f5:56:80:26:c9:76:ab:9b:e0:a1:4a:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=vivo Mobile Communication Co.\, Ltd,O=vivo Mobile Communication Co.\, Ltd,L=东莞市,ST=广东省,C=CN

Chains

Jul 21, 2026

CN=vivo Mobile Communication Co.\, Ltd,O=vivo Mobile Communication Co.\, Ltd,L=东莞市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=vivo Mobile Communication Co.\, Ltd,O=vivo Mobile Communication Co.\, Ltd,L=东莞市,ST=广东省,C=CN

Serial Number

0a:b9:3f:9b:b0:29:40:47:35:6f:cd:e6:08:be:15:3f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 20, 2024 - Nov 24, 2026

Minor OS version

Major OS version

Entry point

111016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\remote-control-audio-vedio-sdk-oversea\privacy_screen\x64\Release\privacy_screen.pdb

kernel32

GlobalAlloc LoadResource GetProcAddress GlobalLock FreeLibrary GlobalUnlock SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW DeleteFileA GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryA GetLastError MultiByteToWideChar GlobalAddAtomW FreeResource GetCurrentThreadId FindResourceA SizeofResource GetCommandLineW GetModuleFileNameA CompareStringW HeapAlloc CloseHandle HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle GetModuleFileNameW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW RtlUnwind

user32

EndPaint BeginPaint InvalidateRect UpdateWindow DialogBoxParamW PostQuitMessage GetClientRect SetWindowLongW LoadCursorW TranslateMessage TranslateAcceleratorW RegisterHotKey SetWindowDisplayAffinity LockWorkStation DispatchMessageW ShowWindow GetMessageW DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW EndDialog GetSystemMetrics RegisterClassExW LoadAcceleratorsW

gdi32

SelectObject CreateFontW TextOutW GetTextExtentPoint32W SetTextColor SetBkMode DeleteObject CreateSolidBrush

ole32

CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipAlloc GdipDrawImageRectI GdipLoadImageFromStream GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage

Name

.text

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

29b5c6810c0baf6061576321c9e2e36c79397f0a5051d1b9ace9fb12c3b7ef88

kernel32

user32

gdi32

ole32

gdiplus

generic