658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

Sharing

Copy URL Twitter E-mail

General

Target
658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c
Size 7.3MB
Sample260730-mrpgraga67
SHA256 658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c
MD5 a394ea6b9705c1ec1de81ce6ebfb8220
SHA1 e85235732e2c4711fd691062a1fa2df7cfaea495
SHA512 e3e4da49095a33a54072cb5eb8eaf8a2e291b22ee0c3f90f5e4333708fb92386b068ab4a4614e527982c2ad9d78c17f6989b947aebc5bba2f17a35ff4c5d5a32
SSDEEP 98304:lzknz/NQTrHcsTDB1aEoK4/ulTO9rLZIzetd:l+LNHs/nHd4yyB1IKH
TLSH
T144767D07EC6914E9D1AED13189769163BB717C881B2123D72B50F6387FB6BE0ADB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

File Explorer

658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

.exe 7.3MB

658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c
MD5 a394ea6b9705c1ec1de81ce6ebfb8220
SHA1 e85235732e2c4711fd691062a1fa2df7cfaea495
SHA512 e3e4da49095a33a54072cb5eb8eaf8a2e291b22ee0c3f90f5e4333708fb92386b068ab4a4614e527982c2ad9d78c17f6989b947aebc5bba2f17a35ff4c5d5a32
SSDEEP 98304:lzknz/NQTrHcsTDB1aEoK4/ulTO9rLZIzetd:l+LNHs/nHd4yyB1IKH
TLSH
T144767D07EC6914E9D1AED13189769163BB717C881B2123D72B50F6387FB6BE0ADB9340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d2:f6:55:4a:0b:d3:8a:7c:c1:39:30:73:9d:60:98:2b:fa:e4:7a:f9:50:7b:2e:a0:72:af:52:a0:9a:c5:a6:d5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 19, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

29:5b:f8:6e:85:26:53:40:33:13:83:7b

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2023 - Apr 26, 2026

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

548064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

308KB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

658fd67e2b15cab3f8875dd164bfd7f8174717eee9bac902f302e03a8d878e5c

PE Signature issue

kernel32

generic