wps_wid[.]cid-659623612[.]1780490993[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
wps_wid.cid-659623612.1780490993.exe
Size 7.3MB
Sample260802-pt5mvsab56
SHA256 4c0232139d3d8c45634e497de52c5cf2e558c16e66b7fe737051371e502d4a1e
MD5 811ad91ad95ea492d61c60ace0d620c8
SHA1 163ce9e48036b3328e701630f2687e0dcc49b1bb
SHA512 e904bbc783d4d383e02028863450680f0bb6980f546513f6d473b09f65573bed59302dfcc8248703a12f71e67ecc3e26fff5b0fcdab9995eaae5def47ca383ea
SSDEEP 98304:9F+FrNL4TlyNLjZ44tko0mdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/y:v2rN8TINLjZ+7aui5O8saAAEuy
TLSH
T17F769F47A3E801ECD0BBD13C89569613E7B2B85513709BCF16A1867A1F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

wps_wid.cid-659623612.1780490993.exe

.exe 7.3MB

wps_wid.cid-659623612.1780490993.exe

IMPHASH b1d3ffd985b3fc8710cf0afade8091f5
SHA256 4c0232139d3d8c45634e497de52c5cf2e558c16e66b7fe737051371e502d4a1e
MD5 811ad91ad95ea492d61c60ace0d620c8
SHA1 163ce9e48036b3328e701630f2687e0dcc49b1bb
SHA512 e904bbc783d4d383e02028863450680f0bb6980f546513f6d473b09f65573bed59302dfcc8248703a12f71e67ecc3e26fff5b0fcdab9995eaae5def47ca383ea
SSDEEP 98304:9F+FrNL4TlyNLjZ44tko0mdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/y:v2rN8TINLjZ+7aui5O8saAAEuy
TLSH
T17F769F47A3E801ECD0BBD13C89569613E7B2B85513709BCF16A1867A1F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

15:b9:e0:fd:27:62:20:03:da:ba:28:75:84:50:da:5e:6f:5c:19:90:cb:8c:32:24:5b:6c:1f:b8:d2:af:b3:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

May 22, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

1e:15:5f:32:d9:64:fb:ee:af:4f:f7:ab:34:1a:42:47:f2:d1:e1:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Chains

May 22, 2026

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=WPS SOFTWARE PTE. LTD.,O=WPS SOFTWARE PTE. LTD.,L=Singapore,C=SG

Serial Number

0e:0f:26:60:45:de:0b:3c:da:1a:3d:c2:7b:78:27:91

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Oct 14, 2028

Minor OS version

Major OS version

Entry point

3724256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\rc_v12_Off_i18_plu_260508\Build\Release_x64\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource SetDefaultDllDirectories FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount GetModuleHandleW VerSetConditionMask ExpandEnvironmentStringsA CreateDirectoryW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetShortPathNameW GetTempFileNameW GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetVersionExW ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetNativeSystemInfo GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree CreateFileW GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc ExitProcess FreeResource DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId GetEnvironmentVariableW CreateProcessW GetLongPathNameW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType RtlVirtualUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock SetFileTime DuplicateHandle DosDateTimeToFileTime HeapCreate GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW RtlUnwind

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

584KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

wps_wid.cid-659623612.1780490993.exe

kernel32

generic