Personal_Office_i18n_Free[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Personal_Office_i18n_Free.exe
Size 353.9MB
Sample260728-cl72sshp21
SHA256 06c3c00b57f3127929a03d9aa564d11e649a35b6b34317f4ca48244c03060330
MD5 5e93d58b367e474788ea23e8be59b197
SHA1 a43b5cd922e6cd25efe0a63a10538b6ad4cbec98
SHA512 e04310a31eb2e2d6c333042fb63a631525562f0cdcdab4b6cca9578b5b053bd0c1d32c3707c30a40fdbba3a6e735d556ae7f3d3e694aa0e24937d485219d1b43
SSDEEP 6291456:cQaJnQMYIzekp40QF7QELg2rVeBdsQNyHGb0OWEDmLZuje0F6E8x:cQtIz/p4MEE2h4dBvYtYKE8x
TLSH
T13909333A737C42E8D0A6D07DD9124A06EA71BC41D3318ADB05901A670F3FBE5DE7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Personal_Office_i18n_Free.exe

.exe 353.9MB

Personal_Office_i18n_Free.exe

IMPHASH 5620e45fe4b656069ef62eb92d1c558a
SHA256 06c3c00b57f3127929a03d9aa564d11e649a35b6b34317f4ca48244c03060330
MD5 5e93d58b367e474788ea23e8be59b197
SHA1 a43b5cd922e6cd25efe0a63a10538b6ad4cbec98
SHA512 e04310a31eb2e2d6c333042fb63a631525562f0cdcdab4b6cca9578b5b053bd0c1d32c3707c30a40fdbba3a6e735d556ae7f3d3e694aa0e24937d485219d1b43
SSDEEP 6291456:cQaJnQMYIzekp40QF7QELg2rVeBdsQNyHGb0OWEDmLZuje0F6E8x:cQtIz/p4MEE2h4dBvYtYKE8x
TLSH
T13909333A737C42E8D0A6D07DD9124A06EA71BC41D3318ADB05901A670F3FBE5DE7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

80:55:4b:47:0d:86:22:de:80:5e:e3:71:81:97:7a:e3:01:ef:76:2d:82:7a:1d:e0:c2:75:f6:c3:12:ba:e3:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

Jul 14, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

21:60:05:52:17:34:f7:6a:4d:61:08:f3:60:f3:22:b3:f6:26:98:bb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

Jul 14, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Serial Number

0e:0f:26:60:45:de:0b:3c:da:1a:3d:c2:7b:78:27:91

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Oct 14, 2028

Minor OS version

Major OS version

Entry point

3695308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_1h8po\rc_con_WAI_kso_v1\Build\Release_x64\WPSOffice\office6\KPacket.pdb

msi

ord90

kernel32

FileTimeToSystemTime HeapCreate VirtualAlloc VirtualFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount lstrlenW GetFileSize FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW DeleteFileW SetEndOfFile SetFilePointer SetFilePointerEx WriteFile Sleep GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileExW GetStdHandle ReadFile MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetModuleHandleW GetProcAddress MoveFileW GetLogicalDriveStringsW GetModuleHandleA GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetProcessAffinityMask VerSetConditionMask GetCurrentThread FreeLibrary LoadLibraryW LocalFree VerifyVersionInfoW GetDateFormatW GetTimeFormatW OpenProcess ReadProcessMemory GetPrivateProfileStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW ExpandEnvironmentStringsW GetDiskFreeSpaceExW GetFileAttributesExW TerminateProcess lstrcmpW WritePrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW CreateThread GetLocalTime ReleaseMutex OpenEventW OpenFileMappingW GetCommandLineW GetModuleFileNameW GetPrivateProfileIntW SetDllDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW FindFirstFileExW GetFileSizeEx GetLongPathNameW GetTempFileNameW QueryDosDeviceW OutputDebugStringW SetErrorMode SetPriorityClass ProcessIdToSessionId LocalAlloc WTSGetActiveConsoleSessionId GetVersionExW GetDriveTypeW WaitForMultipleObjects GetNativeSystemInfo SetProcessWorkingSetSizeEx RtlUnwind GetLocaleInfoW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemWow64DirectoryW SetUnhandledExceptionFilter MapViewOfFileEx lstrcmpiW WriteConsoleW GetProcessId GetSystemTime GetModuleHandleExW DeviceIoControl GetFullPathNameW CreateFileA TerminateThread SystemTimeToTzSpecificLocalTime VirtualQuery GetVolumePathNameW SystemTimeToFileTime GetDiskFreeSpaceW VirtualProtect LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter WaitForSingleObjectEx InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockShared AcquireSRWLockShared GetLocaleInfoEx EncodePointer LCMapStringEx CompareStringEx GetCPInfo InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA DuplicateHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW SetStdHandle CreatePipe IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW LockFileEx UnlockFile HeapCompact DeleteFileA LoadLibraryA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Personal_Office_i18n_Free.exe

msi

kernel32

generic