771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51

Sharing

Copy URL Twitter E-mail

General

Target
771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51
Size 4.4MB
Sample260805-e5n45syarh
SHA256 771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51
MD5 fd3b4699d9e8c78c0b1312891a7400a9
SHA1 10ed2ae0ef17ef42ee8f2b2814d61b224d1f1431
SHA512 2b159e1beb3d714a6375261fab901d4a470865028add89c13f60348883447a4b5a9fa584adc791d018037b9d1345bc75dffae3fa54ae9120408e8f4b161c3685
SSDEEP 98304:GPqrDyToojwpHyBMMK9eaz9Bjhrrtaz9BjhzP:+cSBc9bnxrQnBP
TLSH
T17826120ABB904BF8C57DC1F0918903555375F8060B31EBEF69DA4A362D92EA91F3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51

File Explorer

771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51

.exe 4.4MB

771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51

IMPHASH d9c2bdd299dffaea4ff5ab1ea94f18c0
SHA256 771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51
MD5 fd3b4699d9e8c78c0b1312891a7400a9
SHA1 10ed2ae0ef17ef42ee8f2b2814d61b224d1f1431
SHA512 2b159e1beb3d714a6375261fab901d4a470865028add89c13f60348883447a4b5a9fa584adc791d018037b9d1345bc75dffae3fa54ae9120408e8f4b161c3685
SSDEEP 98304:GPqrDyToojwpHyBMMK9eaz9Bjhrrtaz9BjhzP:+cSBc9bnxrQnBP
TLSH
T17826120ABB904BF8C57DC1F0918903555375F8060B31EBEF69DA4A362D92EA91F3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d4:c8:e4:2c:6f:3b:40:40:bd:c4:8e:5e:96:d0:41:a2:27:53:4d:84:2e:19:2c:56:16:39:34:a6:d5:10:34:e3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Sep 18, 2025

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ac:62:20:57:08:95:91:1b:4d:3e:b3:10:71:ec:76:a2:33:21:2f:65

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Sep 18, 2025

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2024 - Oct 17, 2027

Minor OS version

Major OS version

Entry point

520028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hello.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

MultiByteToWideChar WriteConsoleW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentVariableW HeapAlloc CreateDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose CreateFileW WaitForSingleObject GetModuleHandleW FormatMessageW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetModuleHandleA GetModuleFileNameW CloseHandle WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime CreateWaitableTimerExW SetWaitableTimer Sleep SwitchToThread ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread SetFilePointerEx SetFileInformationByHandle GetConsoleOutputCP IsDebuggerPresent GetConsoleMode FreeConsole FlushFileBuffers GetStdHandle GetLastError CreateMutexW LoadLibraryExA SetEvent HeapSize LCMapStringW CompareStringW FreeLibrary CreateEventW VirtualProtect HeapReAlloc GetProcessHeap InitializeCriticalSectionEx HeapFree GetTempPathW FlsFree FlsSetValue QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue

ntdll

RtlNtStatusToDosError NtOpenFile NtWriteFile NtCreateNamedPipeFile

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

d3d9

Direct3DCreate9

ole32

CoCreateGuid

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

oleaut32

SetErrorInfo SysAllocStringLen GetErrorInfo SysFreeString SysStringLen

Name

.text

Size

569KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

118KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

956B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

771e2a3f6744bf81ee25ae2aaa8582fb14c0511892d3c3e8bd1566f47e576b51

PE Signature issue

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

dxgi

d3d11

d3d9

ole32

bcrypt

advapi32

oleaut32

generic