ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a

Sharing

Copy URL Twitter E-mail

General

Target
ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a
Size 248KB
Sample260804-d3hc5svvbz
SHA256 ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a
MD5 7d952f74ce1db9125ab51f9a11b046ab
SHA1 97b56a2faf2b27d2e435c6c311c6d274f175a848
SHA512 df7a7ed1877d5054bc7d51891bce7d242fc985f0d3eeb510a5343c2db75eb404484a9c4e25fed0db25e69a02e537b9463f054106980857cc887f0a1afa07f671
SSDEEP 3072:2HHpFJHBkREhR3LbVLd49DJCGg1b0EFqIyFEz+vtW2SU5Ir:4pFjkMbVLd4PjFQ+lWxr
TLSH
T18E443B72B5EF9471D16303365EAA7E30A5ADBE302CA0E657538C8E293C72781D507363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a

File Explorer

ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a

.exe 248KB

ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a

IMPHASH 2e3aeedc08bab6fe7bf3bf190d20dde4
SHA256 ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a
MD5 7d952f74ce1db9125ab51f9a11b046ab
SHA1 97b56a2faf2b27d2e435c6c311c6d274f175a848
SHA512 df7a7ed1877d5054bc7d51891bce7d242fc985f0d3eeb510a5343c2db75eb404484a9c4e25fed0db25e69a02e537b9463f054106980857cc887f0a1afa07f671
SSDEEP 3072:2HHpFJHBkREhR3LbVLd49DJCGg1b0EFqIyFEz+vtW2SU5Ir:4pFjkMbVLd4PjFQ+lWxr
TLSH
T18E443B72B5EF9471D16303365EAA7E30A5ADBE302CA0E657538C8E293C72781D507363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:6a:0b:84:60:2e:f1:b3:d8:c8:43:c8:95:b0:14:1b:60:07:f5:b0:4f:87:20:04:17:90:7f:15:1b:c0:9a:aa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 12, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

03:fc:f4:11:ad:56:f1:ab:47:e8:c2:50:2c:e8:a8:32

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 28, 2024 - Jun 5, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

264539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\devops\workspace\p-37d34ce895ed4865ac95061b653d796f\Output\BinFinal\maUpdat.pdb

comctl32

InitCommonControlsEx

common

?Left@CTXStringW@@QBE?AV1@H@Z ?AppendFormat@CTXStringW@@QAAXPB_WZZ ?Tokenize@CTXStringW@@QBE?AV1@PB_WAAH@Z ?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z ??0CTXHttpDownloadSink@@IAE@XZ ??1CTXHttpDownloadSink@@UAE@XZ ??0CHttpClient@@QAE@XZ ??1CHttpClient@@QAE@XZ ?SetUIInterface@CHttpClient@@QAEXPAVCTXHttpDownloadSink@@@Z ?Download@CHttpClient@@QAEHPB_WPAU_SYSTEMTIME@@0HPA_J@Z ?GetDownloadedFilePath@CHttpClient@@QAEHAAVCTXStringW@@@Z ?CancelDownload@CHttpClient@@QAEXXZ ?EnableQQNetworkSettings@CHttpClient@@QAEHH@Z ?SetEventMask@CHttpClient@@QAEXK@Z ?OnConnected@CTXHttpDownloadSink@@UAEXPAVCHttpClient@@@Z ?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCHttpClient@@PB_W@Z ?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCHttpClient@@KK@Z ?OnError@CTXHttpDownloadSink@@UAEXPAVCHttpClient@@K@Z ?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCHttpClient@@PB_W@Z ??0CTXStringA@@QAE@XZ ??M@YA_NABVCTXStringA@@0@Z ?Format@CTXStringA@@QAAXPBDZZ ?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z ??0CTXBSTR@@QAE@PB_W@Z ??0CTXBSTR@@QAE@ABVCTXStringW@@@Z ??1CTXBSTR@@QAE@XZ ??BCTXBSTR@@QBEPA_WXZ ?GetMainThreadLoop@Misc@Util@@YAPAVMessageLoopForUI@AsyncTask@@XZ ?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ ?LogTaskStart@Misc@Util@@YAKPB_W@Z ?LogTaskEnd@Misc@Util@@YAXK@Z ?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z ?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z ?PropertyDWord@CFmtString@@QAEHPB_WK0@Z ??0CFmtString@@QAE@XZ ??1CFmtString@@QAE@XZ ?DoFormat@CFmtString@@QAEPB_WPB_W@Z ?UnZipFile@CUnZipFile@@QAE_NABVCTXStringW@@0@Z ??0CUnZipFile@@QAE@XZ ??1CUnZipFile@@QAE@XZ ??H@YA?AVCTXStringW@@ABV0@PB_W@Z ?ReverseFind@CTXStringW@@QBEH_W@Z ?OnUninitCom@Misc@Util@@YAXXZ ?OnExitWinMain@Misc@Util@@YAXXZ ?OnExitCoreCenter@Misc@Util@@YAXXZ ?ClearDeadQueue@Misc@Util@@YAXXZ ?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ ?InitPlatform@CoreCenter@Util@@YAHPA_W@Z ?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z ?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z ?InitPlatformFileSystem@Boot@Util@@YAHXZ ?InitPlatformCoreConfig@Boot@Util@@YAHXZ ?InitPlatformI18NConfig@Boot@Util@@YAHXZ ?InitPlatformGFConfig@Boot@Util@@YAHXZ ??YCTXStringW@@QAEAAV0@ABV0@@Z ?GetBuffer@CTXStringW@@QAEPA_WXZ ?MakeUpper@CTXStringW@@QAEAAV1@XZ ?Empty@CTXStringW@@QAEXXZ ?Right@CTXStringW@@QBE?AV1@H@Z ??1CTXStringW@@QAE@XZ ??0CTXStringW@@QAE@XZ ??0CTXStringW@@QAE@PB_W@Z ??0CTXStringW@@QAE@ABV0@@Z ?IsEmpty@CTXStringW@@QBE_NXZ ?ReleaseBuffer@CTXStringW@@QAEXH@Z ?GetBuffer@CTXStringW@@QAEPA_WH@Z ?GetLength@CTXStringW@@QBEHXZ ?Format@CTXStringW@@QAAXPB_WZZ ??4CTXStringW@@QAEAAV0@PA_W@Z ??4CTXStringW@@QAEAAV0@ABV0@@Z ??BCTXStringA@@QBEPBDXZ ?Replace@CTXStringA@@QAEHPBD0@Z ?Insert@CTXStringA@@QAEHHPBD@Z ??1CTXStringA@@QAE@XZ ??0CTXStringA@@QAE@PBD@Z ?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z ?SetMainAndLogicMsgLoop@Misc@Util@@YAXPAVMessageLoopForUI@AsyncTask@@PAVMessageLoop@4@@Z ?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z ??BCTXStringW@@QBEPB_WXZ ??H@YA?AVCTXStringW@@_WABV0@@Z ??0CTXStringW@@QAE@PA_W@Z ??4CTXStringW@@QAEAAV0@PB_W@Z ?Compare@CTXStringW@@QBEHPB_W@Z ?GetString@CTXStringW@@QBEPB_WXZ ?CompareNoCase@CTXStringW@@QBEHPB_W@Z ?Trim@CTXStringW@@QAEAAV1@XZ ??ACTXStringW@@QBE_WH@Z ?FindOneOf@CTXStringW@@QBEHPB_W@Z ?Mid@CTXStringW@@QBE?AV1@HH@Z ??YCTXStringW@@QAEAAV0@PB_W@Z ?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z

gf

?SetDPIAdaptFlag@DPI@GF@Util@@YAXH@Z ?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z ?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z

asynctask

?PostDelayedTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@_J@Z ?PostTask@MessageLoop@AsyncTask@@QAEXPAVTask@2@@Z ??_7MessageLoopForUI@AsyncTask@@6B@ ?StartWithOptions@Thread@AsyncTask@@QAE_NABUOptions@12@@Z ??1Thread@AsyncTask@@UAE@XZ ??0Thread@AsyncTask@@QAE@PBD@Z ?Run@MessageLoopForUI@AsyncTask@@QAEXXZ ??1MessageLoop@AsyncTask@@UAE@XZ ??0MessageLoop@AsyncTask@@QAE@W4Type@01@@Z ?RegisterCallback@AtExitManager@AsyncTask@@SAXP6AXPAX@Z0@Z ??1AtExitManager@AsyncTask@@QAE@XZ ??0AtExitManager@AsyncTask@@QAE@XZ ?Unlock@LockImpl@AsyncTask@@QAEXXZ ?Lock@LockImpl@AsyncTask@@QAEXXZ ??1LockImpl@AsyncTask@@QAE@XZ ??0LockImpl@AsyncTask@@QAE@XZ

mautility

ord7 ord5 ord10 ord6 ord8 ord11

kernel32

WaitForSingleObject CloseHandle MultiByteToWideChar WideCharToMultiByte DeleteFileW CopyFileW InterlockedIncrement InterlockedDecrement InterlockedExchange EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetProcAddress CreateMutexW GetModuleHandleW WritePrivateProfileStringW GetSystemDirectoryW GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW GetVolumeInformationW LocalFree GetLongPathNameW FindClose GetPrivateProfileIntW GetTempPathW RemoveDirectoryW QueryPerformanceCounter GetFileAttributesW FindFirstFileW FindNextFileW IsBadReadPtr TerminateProcess FreeLibrary IsDebuggerPresent GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException InitializeSListHead OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess GetStartupInfoW GetCurrentProcessId ResumeThread GetCommandLineW GetTickCount SetFileAttributesW GetSystemTimeAsFileTime IsProcessorFeaturePresent

user32

PostMessageW IsWindow GetWindowThreadProcessId AttachThreadInput SystemParametersInfoW GetPropW GetDesktopWindow GetWindow PostQuitMessage SetPropW LoadIconW IsIconic ShowWindow IsWindowVisible SetActiveWindow GetForegroundWindow SendMessageTimeoutW AllowSetForegroundWindow SetForegroundWindow RemovePropW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey GetUserNameW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW BuildExplicitAccessWithNameW

shell32

CommandLineToArgvW SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteExW

ole32

OleUninitialize CoTaskMemFree OleInitialize

oleaut32

LoadRegTypeLi LoadTypeLi SysStringLen SysFreeString

shlwapi

PathGetArgsW PathAppendW PathFileExistsW PathFindExtensionW PathFindFileNameW PathRemoveBackslashW PathAddBackslashW wnsprintfW

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

wininet

InternetOpenW InternetOpenUrlW HttpQueryInfoW InternetReadFile InternetConnectW HttpOpenRequestW InternetGetConnectedState HttpSendRequestW InternetCloseHandle InternetCanonicalizeUrlW InternetCrackUrlW

rpcrt4

UuidCreateSequential UuidToStringA RpcStringFreeA

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memset _purecall memcpy memmove strchr __CxxFrameHandler3 memcmp _except_handler4_common

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free _recalloc calloc

api-ms-win-crt-runtime-l1-1-0

_controlfp_s terminate _beginthreadex _errno _register_thread_local_exe_atexit_callback _c_exit _invalid_parameter_noinfo_noreturn exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _invalid_parameter_noinfo _seh_filter_exe _set_app_type _exit

api-ms-win-crt-convert-l1-1-0

_itoa_s _wtol _wtoi atoi

api-ms-win-crt-string-l1-1-0

isalpha wcsncpy isdigit wcsncat wcscmp strncmp strlen wcslen isspace wcscpy_s

api-ms-win-crt-stdio-l1-1-0

fclose fread _wfopen_s _set_fmode __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ae0fa1eb711bf013944e64699c1adf7cfd587fb4c30e41e0514c7a51b5055a5a

PE Signature issue

comctl32

common

gf

asynctask

mautility

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp140

wininet

rpcrt4

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic