GT600_GTX3_GTX4_GTX9_GTX1_Version20220812[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe
Size 6.4MB
Sample260803-qfs8caaa67
SHA256 83532c917061b7c215240c80f23d27f8ba43d1d396c175e3853fdadcf764e070
MD5 ed09263905a615e20af027828efeae55
SHA1 1a2c3c1b8a4612d5e9c051d0a32d5f897c2dc2d5
SHA512 a6bc8d78162601d7fb819ad4a35720e7d37562f3f9713cf07e428de7454536dd2da493845f68b01df457f1a8c211b20329bf31d9a0aca670ca1422d7c1917baa
SSDEEP 196608:Ulq+1NHsR86QSgFaz9Skl6ab0hRXg3PX1cormY4Ei+:gHsR86UFug7ab03g3PlCYe+
TLSH
T1096602137A41943FD2B202328C6FAE6042A97E7759314657B7A8FF2D2EF0481B917F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe

File Explorer

GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe

.exe 6.4MB

GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe

IMPHASH d4fe8eec31ba44b37546499596e74621
SHA256 83532c917061b7c215240c80f23d27f8ba43d1d396c175e3853fdadcf764e070
MD5 ed09263905a615e20af027828efeae55
SHA1 1a2c3c1b8a4612d5e9c051d0a32d5f897c2dc2d5
SHA512 a6bc8d78162601d7fb819ad4a35720e7d37562f3f9713cf07e428de7454536dd2da493845f68b01df457f1a8c211b20329bf31d9a0aca670ca1422d7c1917baa
SSDEEP 196608:Ulq+1NHsR86QSgFaz9Skl6ab0hRXg3PX1cormY4Ei+:gHsR86UFug7ab03g3PlCYe+
TLSH
T1096602137A41943FD2B202328C6FAE6042A97E7759314657B7A8FF2D2EF0481B917F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0d:9b:5e:5d:5c:aa:c0:73:c5:31:4b:09:74:df:90:e2:eb:af:c8:34:24:75:0c:0e:46:4d:0c:7d:c9:28:80:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91320214069484293T,CN=Wuxi Instant Microelectronics Co.\, Ltd.,O=Wuxi Instant Microelectronics Co.\, Ltd.,L=无锡市,ST=江苏省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e696b0e590b4e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b19fe88b8fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 12, 2022

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:6a:53:45:5c:c7:00:12:fa:23:ce:7a:80:f8:5e:47

Issuer

CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2013 - Oct 22, 2023

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0d:9d:72:f1:dd:a9:ed:4e:39:f8:8f:ca:66:08:1e:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jul 1, 2022

Timespan

Jul 1, 2022 - Jul 2, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

489420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

ord17

kernel32

LoadLibraryW GetModuleHandleW lstrcmpW lstrcmpiW GetSystemDefaultLangID GetUserDefaultLangID VerLanguageNameW CompareFileTime CreateDirectoryW FindClose FindFirstFileW FindNextFileW SetFileAttributesW GetSystemTimeAsFileTime GetPrivateProfileStringW MoveFileW LocalFree FormatMessageW GetSystemInfo MulDiv RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW GetVersion GetLocalTime IsValidLocale GetCommandLineW GetFileAttributesW FlushFileBuffers SetEndOfFile VirtualQuery lstrcpyA IsBadReadPtr GetDiskFreeSpaceW GetDriveTypeW GetExitCodeProcess GetCurrentThread GetLocaleInfoW InterlockedExchange LoadLibraryExA GetProcAddress FreeLibrary CompareStringA CompareStringW lstrcatW GetVersionExW InterlockedDecrement InterlockedIncrement CreateEventW QueryPerformanceFrequency ReadConsoleW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetTempFileNameW SetConsoleCtrlHandler OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID FatalAppExitA FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType HeapReAlloc CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP IsValidCodePage GetCurrentThreadId HeapSize AreFileApisANSI GetModuleHandleExW GetStdHandle GetACP IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind lstrcpynA LocalAlloc QueryPerformanceCounter SearchPathW lstrcmpA SystemTimeToFileTime ResetEvent SetEvent VirtualProtect GetCurrentProcessId Process32NextW Process32FirstW CreateToolhelp32Snapshot GetDateFormatW GetTimeFormatW GetCurrentDirectoryW FindResourceExW GetLastError CopyFileW GetTickCount GetExitCodeThread CreateThread FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc SizeofResource LockResource LoadResource lstrcpyW GetWindowsDirectoryW SetErrorMode GetTempPathW ExpandEnvironmentStringsW MoveFileExW WriteProcessMemory VirtualProtectEx GetSystemDirectoryW FlushInstructionCache SetThreadContext GetThreadContext CreateProcessW ResumeThread TerminateProcess ExitProcess GetCurrentProcess Sleep WaitForSingleObject DuplicateHandle RemoveDirectoryW DeleteFileW SetCurrentDirectoryW lstrlenW lstrcpynW GetModuleFileNameW GetProcessHeap HeapFree HeapAlloc WriteFile SetFilePointer ReadFile WideCharToMultiByte GetEnvironmentVariableW SetFileTime GetFileTime OpenProcess GetProcessTimes LCMapStringW DecodePointer EncodePointer MultiByteToWideChar lstrlenA UnmapViewOfFile MapViewOfFile CreateFileMappingW CloseHandle GetFileSize CreateFileW SetLastError GetConsoleCP

user32

DefWindowProcW PostMessageW DispatchMessageW PostQuitMessage RegisterClassW TranslateMessage GetMessageW CharUpperW KillTimer SetTimer GetDC CharPrevW SendDlgItemMessageW wvsprintfW LoadImageW CreateDialogParamW MoveWindow SetCursor GetWindow GetDlgItemTextW SetFocus EnableWindow SetForegroundWindow SetActiveWindow SetDlgItemTextW IsDialogMessageW FindWindowW SubtractRect IntersectRect SetRect FillRect GetSysColorBrush GetSysColor GetWindowRect ExitWindowsEx GetSystemMetrics GetDlgCtrlID CreateDialogIndirectParamW DestroyWindow IsWindow SendMessageW MessageBoxW CharNextW WaitForInputIdle SetWindowLongW GetWindowLongW GetClientRect EndPaint BeginPaint ReleaseDC GetWindowDC SetWindowPos SetWindowTextW GetDlgItem EndDialog DialogBoxIndirectParamW ShowWindow GetDesktopWindow MsgWaitForMultipleObjects PeekMessageW wsprintfW LoadIconW LoadCursorW CreateWindowExW

gdi32

GetObjectW SetTextColor SetBkMode GetDeviceCaps CreateFontW CreateFontIndirectW SetStretchBltMode StretchBlt SelectObject DeleteDC CreateDIBitmap CreateCompatibleDC BitBlt DeleteObject GetStockObject CreatePalette GetSystemPaletteEntries RealizePalette SelectPalette GetDIBColorTable CreateHalftonePalette UnrealizeObject TranslateCharsetInfo CreateSolidBrush

advapi32

RegCloseKey CryptSignHashW CryptHashData CryptCreateHash CryptAcquireContextW RegOpenKeyW RegEnumKeyW RegCreateKeyW LookupPrivilegeValueW AdjustTokenPrivileges CryptVerifySignatureW RegOpenKeyExW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegEnumValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW

shell32

SHGetSpecialFolderLocation ShellExecuteW SHBrowseForFolderW SHGetPathFromIDListW CommandLineToArgvW ShellExecuteExW SHGetMalloc

ole32

CoCreateInstance StringFromGUID2 CoCreateGuid CreateItemMoniker GetRunningObjectTable CLSIDFromProgID CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree ProgIDFromCLSID CoUninitialize CoInitializeSecurity CoInitialize

oleaut32

LoadTypeLi SysAllocStringLen SysFreeString SysReAllocStringLen SysStringLen SysAllocString SysStringByteLen SysAllocStringByteLen VarBstrCat VarBstrFromDate VariantClear VariantChangeType GetErrorInfo VarUI4FromStr SystemTimeToVariantTime RegisterTypeLi SetErrorInfo CreateErrorInfo

crypt32

CryptAcquireCertificatePrivateKey CryptImportPublicKeyInfo PFXImportCertStore CertSaveStore CertOpenStore CertFindCertificateInStore CertCompareCertificate CertOpenSystemStoreW CertGetIssuerCertificateFromStore CertSetCertificateContextProperty CertGetCertificateContextProperty CertAddCertificateContextToStore CertEnumCertificatesInStore

rpcrt4

UuidCreate UuidToStringW UuidFromStringW RpcStringFreeW

Sharing

General

Malware Config

Signatures

File Explorer

GT600_GTX3_GTX4_GTX9_GTX1_Version20220812.exe

PE Signature issue

version

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

generic