c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

Sharing

Copy URL Twitter E-mail

General

Target
c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd
Size 7.9MB
Sample260803-ldcelatblh
SHA256 c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd
MD5 a4445e2576ff3f0a92875e46e79f2cac
SHA1 ee8b82d3c4d432397bb91eef24af6240a6f88c56
SHA512 5416e23371e79d3384b6ee2dc0fedbd90505ad22739c9cb7d2e375edaface7f68d2679c56393941ca8d7a5677966e51eae9d0b102f2c53f2266bd5dece9d0140
SSDEEP 98304:ooRAzZrEEEXeky8UjyWwViP9cOcLby7uh50GsVUoi4CFKTNBDJqdA4DBfVr:iYEe68Uprcfy7uh50jCaWxBfVr
TLSH
T1F886D0117A82C035C753127049BCBBAB44FDEA940F3956CBA39C162DAF715D31A32AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

File Explorer

c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

.exe 7.9MB

c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

IMPHASH 25ec4534745f69dec1a1d82fc31b5d77
SHA256 c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd
MD5 a4445e2576ff3f0a92875e46e79f2cac
SHA1 ee8b82d3c4d432397bb91eef24af6240a6f88c56
SHA512 5416e23371e79d3384b6ee2dc0fedbd90505ad22739c9cb7d2e375edaface7f68d2679c56393941ca8d7a5677966e51eae9d0b102f2c53f2266bd5dece9d0140
SSDEEP 98304:ooRAzZrEEEXeky8UjyWwViP9cOcLby7uh50GsVUoi4CFKTNBDJqdA4DBfVr:iYEe68Uprcfy7uh50jCaWxBfVr
TLSH
T1F886D0117A82C035C753127049BCBBAB44FDEA940F3956CBA39C162DAF715D31A32AB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a2:17:7d:4c:49:cc:d2:b6:9e:0f:56:3c:3b:a6:cb:95:f4:81:ee:ca:5b:2c:3d:d7:92:65:40:38:91:03:0d:df

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91110105767514680Y,CN=Beijing AoLanDe Information Technology Co.\, Ltd.,O=Beijing AoLanDe Information Technology Co.\, Ltd.,ST=北京市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e69c9de998b3e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e58c97e4baace5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jun 9, 2026

Subject

Serial Number

0d:99:c6:82:3e:5d:de:4b:a9:56:07:75:db:42:84:14

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Aug 17, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

8347648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WorkSpace\7ZipPro\Output\Release_x86\ZipMaster.pdb

kernel32

LoadLibraryA GetLocalTime FindResourceW SizeofResource LoadResource LockResource FreeResource MulDiv HeapCreate FlushInstructionCache WaitForSingleObjectEx GetCurrentProcessId WaitForMultipleObjects CreateFileMappingW UnmapViewOfFile MapViewOfFile InterlockedCompareExchange RtlCaptureStackBackTrace PeekNamedPipe ReadFile GetFileType GetStdHandle VerifyVersionInfoW IsBadReadPtr GetModuleHandleA VerSetConditionMask MoveFileExW Sleep SetLastError GetTickCount QueryPerformanceCounter WriteConsoleW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetConsoleCtrlHandler SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW CompareFileTime IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode GetACP WriteFile GetEnvironmentVariableA ExitProcess GetModuleHandleExW ResumeThread ExitThread SetFilePointerEx GetFullPathNameA SystemTimeToTzSpecificLocalTime GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc CreateHardLinkW CopyFileW CreateDirectoryExW GetSystemDirectoryW QueryPerformanceFrequency InitializeCriticalSectionEx SleepEx GetFullPathNameW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId TerminateProcess OpenProcess GetVersionExA IsBadWritePtr DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc GlobalAlloc SetFileAttributesW SetFileTime ResetEvent GetVersionExW FormatMessageW SystemTimeToFileTime GetSystemTime GetWindowsDirectoryW LocalFree DeleteFileW FindNextFileW GetTempPathW lstrcatW GetFileAttributesExW FileTimeToSystemTime FileTimeToLocalFileTime OutputDebugStringW GetModuleHandleW GetFileSizeEx CreateFileW GetLastError FindClose FindFirstFileW GetFileAttributesW GlobalUnlock GlobalLock lstrlenA GetCurrentProcess IsWow64Process SetEvent CloseHandle WaitForSingleObject CreateEventW LeaveCriticalSection DeviceIoControl GetModuleFileNameA AreFileApisANSI RemoveDirectoryW GetFileInformationByHandle GetDiskFreeSpaceExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetStringTypeW GetNativeSystemInfo GetExitCodeThread GetCurrentThread SwitchToThread DuplicateHandle EncodePointer TryEnterCriticalSection HeapDestroy EnterCriticalSection DeleteCriticalSection InitializeCriticalSection OutputDebugStringA SetCurrentDirectoryW GetModuleFileNameW FreeLibrary lstrcpynW lstrlenW WideCharToMultiByte MultiByteToWideChar GetProcAddress LoadLibraryW InterlockedIncrement GetUserDefaultLCID InterlockedDecrement

user32

AttachThreadInput GetWindowThreadProcessId SetForegroundWindow SystemParametersInfoW BringWindowToTop SwitchToThisWindow GetParent KillTimer CopyRect InflateRect UnionRect IsRectEmpty EqualRect GetForegroundWindow UnregisterClassW ClientToScreen SetCursor IntersectRect MessageBoxA SetTimer CharNextW DestroyIcon GetIconInfo IsWindow LoadCursorW DestroyCursor ShowWindow DefWindowProcW CallWindowProcW CharUpperW DrawIconEx RegisterClassExW CreateWindowExW SendMessageW GetClientRect GetWindowRect MapWindowPoints GetWindowLongW SetWindowLongW GetWindow MonitorFromWindow GetMonitorInfoW TrackMouseEvent PostMessageW PostQuitMessage AnimateWindow SetLayeredWindowAttributes IsWindowVisible IsIconic IsZoomed SetFocus GetCapture SetCapture ReleaseCapture UpdateWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetWindowTextW ScreenToClient GetClassNameW GetFocus GetKeyState LoadBitmapW CreateIconFromResource LoadImageW PeekMessageW WaitMessage CallMsgFilterW IsWindowEnabled EnableWindow SetActiveWindow GetDesktopWindow wsprintfW GetActiveWindow DestroyWindow SetWindowPos PtInRect GetCursorPos OffsetRect GetDlgItem CharLowerBuffW SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu DeleteMenu AppendMenuW InsertMenuW GetMenuItemCount CheckMenuItem DestroyMenu CreatePopupMenu IsMenu UpdateLayeredWindow SetCaretPos HideCaret CreateCaret SystemParametersInfoA DrawTextW GetWindowPlacement MonitorFromRect LoadIconW MessageBoxW GetSystemMetrics CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetSysColor EnableMenuItem SetRect PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW MapVirtualKeyA

gdi32

GdiFlush SetViewportOrgEx CreateCompatibleBitmap StretchBlt GetDCOrgEx GetObjectW SetBkMode Rectangle GetStockObject GetClipBox CreateSolidBrush CreateFontIndirectW EnumFontsW SetGraphicsMode GetDeviceCaps SelectObject DeleteDC CreateCompatibleDC CreateBitmap BitBlt DeleteObject ExtTextOutW ExtCreateRegion IntersectClipRect SelectClipRgn SetWorldTransform CreateDIBSection GetCurrentObject GetViewportOrgEx GetTextMetricsW SetTextAlign SetTextColor RemoveFontMemResourceEx AddFontMemResourceEx EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI GetTextFaceW

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegUnLoadKeyW RegQueryInfoKeyW RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyExW RegQueryValueExW LookupAccountNameW ConvertSidToStringSidW RegFlushKey RegSetValueExW RegDeleteValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegEnumValueW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegConnectRegistryW RegLoadKeyW

shell32

DragFinish SHGetSpecialFolderPathA ShellExecuteW SHBrowseForFolderW SHGetPathFromIDListW SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW

ole32

OleLockRunning CLSIDFromString CoTaskMemFree CoInitializeEx RegisterDragDrop CreateStreamOnHGlobal CoCreateGuid CoCreateInstance CoUninitialize OleUninitialize OleInitialize CreateBindCtx CLSIDFromProgID

oleaut32

SysAllocString SysAllocStringByteLen VariantClear SysFreeString VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysStringLen VariantCopy GetErrorInfo

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

PathRemoveFileSpecW StrCpyW SHCreateStreamOnFileEx StrToIntExW

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

imm32

ImmSetCandidateWindow ImmGetContext ImmCreateContext ImmSetCompositionWindow ImmReleaseContext ImmAssociateContext ImmDestroyContext

msimg32

AlphaBlend

bcrypt

BCryptGenRandom

gdiplus

GdipCreateBitmapFromStream GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipGetImageWidth GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetImageHeight

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCertificateChain CertAddCertificateContextToStore CertOpenStore CryptDecodeObjectEx

ws2_32

WSAGetLastError gethostname htonl freeaddrinfo getaddrinfo listen sendto recvfrom select __WSAFDIsSet ioctlsocket WSACleanup WSAStartup inet_ntop WSAWaitForMultipleEvents WSASetEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSASetLastError socket setsockopt send recv ntohs htons getsockopt getsockname getpeername connect closesocket bind accept inet_pton

usp10

ScriptFreeCache ScriptShape ScriptItemize

opengl32

wglGetCurrentContext wglGetProcAddress

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

908KB

Virtual Size

907KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

98KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.load7z

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

shlwapi

secur32

iphlpapi

imm32

msimg32

bcrypt

gdiplus

crypt32

ws2_32

usp10

opengl32

generic