oneclient_app_2[.]2[.]0_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
oneclient_app_2.2.0_x64-setup.exe
Size 17.5MB
Sample260808-b4le3sxfpc
SHA256 5a94ad11df387590ba31b80ee2368632715520446ad4dd32de99c536e0970772
MD5 1e0f098eacd06a5cda04130c49db9337
SHA1 c11666ba04db4badb77e6c45a5e067d45278d289
SHA512 c13b51199adacccb88d8a63902daf6fa63fdda6c9d45d106f38523bd4c1de358d76fd453a03f30b630eb7d9ced1191c24b81f720e4f0521dd34594d73f270115
SSDEEP 393216:t31SGiwO/Hj11UUwmyA6yhIdujcvrims22gOs9SgVt292nmx6pEK:tlSGwJwjA6yiuQeLy9VI92nmM
TLSH
T18907338DC229E8CDCB0B2936435A6CF0642F7FA6A2DD6FA451605BD6F790714D4B8F08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/ApplicationID.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

oneclient_app_2.2.0_x64-setup.exe

.exe 17.5MB
$PLUGINSDIR/ApplicationID.dll

.dll 198KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 1.1MB
oneclient_app.exe

.exe 48.0MB
uninstall.exe.nsis

618KB

oneclient_app_2.2.0_x64-setup.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 5a94ad11df387590ba31b80ee2368632715520446ad4dd32de99c536e0970772
MD5 1e0f098eacd06a5cda04130c49db9337
SHA1 c11666ba04db4badb77e6c45a5e067d45278d289
SHA512 c13b51199adacccb88d8a63902daf6fa63fdda6c9d45d106f38523bd4c1de358d76fd453a03f30b630eb7d9ced1191c24b81f720e4f0521dd34594d73f270115
SSDEEP 393216:t31SGiwO/Hj11UUwmyA6yhIdujcvrims22gOs9SgVt292nmx6pEK:tlSGwJwjA6yiuQeLy9VI92nmM
TLSH
T18907338DC229E8CDCB0B2936435A6CF0642F7FA6A2DD6FA451605BD6F790714D4B8F08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

5e:dd:00:e3:16:7c:3f:8b:c2:f3:0f:df:89:00:75:35:09:9a:8a:aa:60:de:5b:99:da:ba:a6:50:a6:d5:40:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Aug 6, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

7a:bc:b8:11:90:59:42:5a:8a:0a:44:2e

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2026 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/ApplicationID.dll

IMPHASH 8c45ff8a205d07c8c17066afebcdfc91
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\src\NSIS-ApplicationID\ReleaseUnicode\ApplicationID.pdb

kernel32

lstrcpynW GlobalAlloc GlobalFree WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException GetLastError FreeLibrary LoadLibraryExW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize CreateFileW

shell32

SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

SHStrDupW

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855
MD5 a8c86996c4230c2209f5927f21321377
SHA1 45ce0ab93cb6a3a594e54878cce05df724024393
SHA512 69ee73496b916777936b0dddd2cc4a4f916e393f7d0b167cba77a4a239ee1e3f645d9b90dee1627c42a23eb6c3403e4d086546b9f78b3a2e4999c8f92f6a3bc3
SSDEEP 96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
TLSH
T154F1C776F3D20673F9AB427428632F231B2AF521576581A6490316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 3d02628e8a8651e903e8432db76ebaca
SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
MD5 1e38f56aba852b737f2866c48b823165
SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
TLSH
T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

SystemFunction036

kernel32

HeapAlloc GetProcessHeap HeapFree HeapReAlloc CloseHandle Sleep GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess lstrcpyW GlobalFree GlobalAlloc lstrcpynW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetModuleHandleA GetProcAddress TlsGetValue TlsSetValue GetCurrentThread InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree GetStdHandle GetLastError GetConsoleMode WaitForSingleObject MultiByteToWideChar WriteConsoleW SetLastError WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex GetEnvironmentVariableW GetModuleHandleW FormatMessageW CreateFileW GetFullPathNameW CreateDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW FindClose SetHandleInformation CreateThread SetThreadStackGuarantee QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime GetCurrentDirectoryW RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared SetFilePointerEx GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle HeapSize GetStringTypeW GetFileType DecodePointer LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameW GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeLibrary LoadLibraryExW RaiseException ExitProcess GetModuleHandleExW

user32

ShowWindow CreateWindowExW FindWindowExW SetWindowPos SetWindowTextW SendMessageW GetWindowLongW

ws2_32

WSASend WSARecv recv getsockname getsockopt closesocket WSAGetLastError getaddrinfo freeaddrinfo ioctlsocket accept WSACleanup WSAStartup send connect bind listen select getpeername setsockopt WSASocketW

ntdll

RtlNtStatusToDosError NtWriteFile

bcrypt

BCryptGenRandom

oneclient_app.exe

IMPHASH 7f7bd732123b9f25729664c74e77fa93
SHA256 7b8dc878d6ac45cebb9cb6fc5e77af8814319efb29a0493f3c05019a04e18157
MD5 7225aa8d276af5207e910844acec7727
SHA1 0ea80e15565ca00fa30659872e772b3c099b85d5
SHA512 53e4f74aeab1c3e630006b781766805aee82bdfbe6fd86cf05f747af2a44e68d40bf284c95aa49aeacac676a35169fbd9643566626e3b7e2d92f5c0368dc09e9
SSDEEP 393216:J8zWm91TUQ2+1Crd+nNMMyxdVKBxbXmI2/+wkpHiXUxY/iJ53IWhlVjEeIZE4a3:A91TUEa+y73VK+fux4a3
TLSH
T184B76C03F2A384EAD0BAC57486DA6233EA717C4D0B3465EB47D04F322E76BD06639B55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

97:bb:e3:2b:ac:57:bb:d6:ab:3b:37:be:fe:52:0b:7c:3b:ab:32:57:63:c3:52:fd:5d:00:d0:3b:30:ce:f0:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Aug 6, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

7a:bc:b8:11:90:59:42:5a:8a:0a:44:2e

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2026 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

31408768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oneclient_app.pdb

kernel32

ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock RaiseException SetFileInformationByHandle AreFileApisANSI HeapCreate AddVectoredExceptionHandler GetDiskFreeSpaceW WaitForMultipleObjects LockFile GetSystemInfo GetNativeSystemInfo VirtualQuery SetFilePointer GetFullPathNameA SetEndOfFile QueryPerformanceFrequency QueryPerformanceCounter UnlockFileEx OutputDebugStringA LoadLibraryExA CreateMutexW Process32FirstW Process32NextW GetStdHandle GetConsoleMode GetConsoleOutputCP UnregisterWaitEx GlobalMemoryStatusEx GetFileInformationByHandleEx UnmapViewOfFile HeapValidate K32GetPerformanceInfo LocalFree WriteConsoleW OpenProcess ReadProcessMemory ReadFileEx SleepEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection WriteFileEx AcquireSRWLockExclusive SetHandleInformation SetFileAttributesW HeapSize GetProcessId GetProcessIoCounters GetTempPathA GetDiskFreeSpaceA FindClose GetSystemTimes GetProcessTimes GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DeleteFileA HeapCompact TlsSetValue TlsGetValue TlsAlloc InitOnceExecuteOnce HeapDestroy UnlockFile FlushFileBuffers GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW LockFileEx SetFilePointerEx GetFileSize SetFileTime CreateHardLinkW MoveFileExW CancelIoEx VirtualQueryEx GetSystemTimeAsFileTime WriteFile SetFileCompletionNotificationModes CopyFileExW GetOverlappedResult ReadFile GetFinalPathNameByHandleW DeleteFileW RemoveDirectoryW DeviceIoControl GetFullPathNameW SetLastError GetTempPathW FindFirstFileExW GetModuleFileNameW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal TerminateProcess FreeLibrary CancelIo CreateEventW LoadLibraryW GetSystemTime ExitProcess CreateDirectoryW FormatMessageA CreateFileMappingW MapViewOfFile CreateFileMappingA LoadLibraryExW SetThreadErrorMode GetTickCount GetModuleHandleExA GetLocaleInfoEx CreateSemaphoreA ReleaseSemaphore GetExitCodeProcess WaitForSingleObject FormatMessageW FindNextFileW GetFileSizeEx GlobalFree Sleep GlobalSize MultiByteToWideChar GetSystemTimePreciseAsFileTime PostQueuedCompletionStatus CreateIoCompletionPort UnregisterWait GetQueuedCompletionStatusEx GlobalUnlock CreateSymbolicLinkW GlobalLock GlobalAlloc GetModuleHandleA WakeAllConditionVariable SleepConditionVariableSRW LocaleNameToLCID InitOnceBeginInitialize InitOnceComplete InitializeSListHead SetUnhandledExceptionFilter SetThreadStackGuarantee SwitchToThread SetWaitableTimer CreateWaitableTimerExW GetCurrentThreadId GetLastError CreateThread HeapReAlloc HeapAlloc HeapFree GetProcessHeap SystemTimeToFileTime GetTimeZoneInformationForYear RegisterWaitForSingleObject GetModuleHandleW CreateToolhelp32Snapshot lstrlenW CreateFileW GetFileInformationByHandle DuplicateHandle ReleaseMutex WideCharToMultiByte CreateMutexA GetCurrentProcessId GetCurrentProcess GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThread CloseHandle GetComputerNameExW

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegOpenKeyExW SystemFunction036 AdjustTokenPrivileges OpenProcessToken ImpersonateAnonymousToken LookupPrivilegeValueW CopySid GetLengthSid RegCloseKey IsValidSid GetTokenInformation RevertToSelf

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetActiveWindow TrackMouseEvent SetCapture MonitorFromRect ScreenToClient GetMenu GetKeyboardLayout MapVirtualKeyExW SystemParametersInfoA SetWindowPlacement ChangeDisplaySettingsExW GetMonitorInfoW IsProcessDPIAware MonitorFromWindow SetWindowDisplayAffinity GetKeyState GetAsyncKeyState GetKeyboardState ReleaseCapture GetCursorPos SetWindowLongW SendMessageW ClipCursor GetSystemMenu ShowCursor DestroyIcon DestroyCursor GetWindowRect GetWindowLongW CreateWindowExW SetWindowLongPtrW RegisterRawInputDevices PeekMessageW AdjustWindowRectEx MsgWaitForMultipleObjectsEx TranslateMessage ToUnicodeEx GetRawInputData DispatchMessageW GetPropW GetClipCursor RegisterClassExW OpenClipboard SetPropW CallWindowProcW SystemParametersInfoW EmptyClipboard CloseTouchInputHandle GetTouchInputInfo UnhookWindowsHookEx CallNextHookEx SetWindowsHookExW CloseClipboard SetClipboardData RegisterClipboardFormatW GetClipboardData ClientToScreen RegisterTouchWindow DefWindowProcW EnableMenuItem RegisterWindowMessageA PostMessageW SetWindowPos InvalidateRgn GetWindowLongPtrW DestroyWindow RemovePropW GetClassInfoExW GetClassNameW GetWindowPlacement SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow IsIconic CreateIcon GetSystemMetrics SetCursor LoadCursorW RedrawWindow GetDC GetClientRect IsWindowVisible ValidateRect ReleaseDC ShowWindow

oleaut32

VariantClear SysAllocStringLen SetErrorInfo GetErrorInfo SafeArrayPutElement SafeArrayCreateVector SysStringLen SysFreeString

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoIncrementMTAUsage

gdi32

DeleteDC CreateCompatibleDC CreateDIBSection SelectObject SwapBuffers SetPixelFormat ChoosePixelFormat GetDeviceCaps DescribePixelFormat DeleteObject CreateRectRgn BitBlt

shell32

DragQueryFileW SHCreateItemFromParsingName DragFinish SHGetKnownFolderPath CommandLineToArgvW

ws2_32

getsockopt bind setsockopt WSAGetLastError WSAIoctl getpeername closesocket getsockname listen connect recvfrom sendto WSAStartup WSACleanup getaddrinfo freeaddrinfo recv send shutdown WSASend ioctlsocket accept WSASocketW

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtOpenFile NtReadFile NtQueryInformationProcess RtlGetVersion RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtWriteFile

ole32

RevokeDragDrop OleInitialize CoInitializeEx RegisterDragDrop CoUninitialize CoCreateInstance

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CertAddEncodedCertificateToStore CertFreeCertificateContext CertVerifyTimeValidity CertGetEnhancedKeyUsage CertGetCertificateChain CertCreateCertificateChainEngine CertCloseStore CertFreeCertificateChainEngine CertFreeCertificateChain CertSetCertificateContextProperty CertOpenStore CertVerifyCertificateChainPolicy

uiautomationcore

UiaRaiseAutomationEvent UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaGetReservedMixedAttributeValue UiaReturnRawElementProvider

iphlpapi

GetAdaptersAddresses

psapi

GetProcessMemoryInfo EnumProcessModules GetModuleInformation GetModuleFileNameExW

powrprof

CallNtPowerInformation

pdh

PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhEnumObjectsW PdhOpenQueryW PdhRemoveCounter PdhCloseQuery PdhCollectQueryData

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

opengl32

wglCreateContext wglMakeCurrent wglShareLists wglGetCurrentContext wglGetProcAddress wglDeleteContext

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmAssociateContextEx ImmReleaseContext ImmGetCompositionStringW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

msvcp140

??0ios_base@std@@IEAA@XZ ??1_Lockit@std@@QEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_wait _Cnd_broadcast ?_Xbad_function_call@std@@YAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA _Mtx_unlock _Mtx_lock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xbad_alloc@std@@YAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z _Query_perf_frequency _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?fail@ios_base@std@@QEBA_NXZ ?classic@locale@std@@SAAEBV12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

memcmp memmove __CxxFrameHandler3 memset strchr strrchr __C_specific_handler memchr __RTDynamicCast _purecall strstr __RTtypeid __std_type_info_compare longjmp _CxxThrowException __intrinsic_setjmp memcpy __std_exception_destroy __std_exception_copy __current_exception __current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcscmp isalnum strncpy strcat tolower wcslen strcpy strcspn strspn strncmp strcmp strlen

api-ms-win-crt-runtime-l1-1-0

strerror _seh_filter_exe terminate _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _invoke_watson _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _beginthreadex _endthreadex abort _errno _wassert exit _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

ceil log tanhf _hypotf pow trunc floor __setusermatherr fmod powf sinf exp2f nextafterf sqrtf sqrt fmodf cosf acosf fma log2f cbrtf acos cbrt round exp roundf tanf sin cos exp2 erff ilogbf remainder tan sinh cosh tanh asin atan atan2 asinh acosh atanh log2 log10f ceilf floorf expf atan2f truncf

api-ms-win-crt-heap-l1-1-0

_callnewh calloc _set_new_mode _aligned_malloc _aligned_free free realloc _msize malloc

api-ms-win-crt-utility-l1-1-0

rand_s bsearch qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod strtoul mbstowcs

api-ms-win-crt-environment-l1-1-0

getenv getenv_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fflush __acrt_iob_func fputs fclose feof fputc ferror fgets fopen _fileno fread fseek ftell fwrite _setmode _set_fmode _wfopen _get_osfhandle __p__commode __stdio_common_vsscanf __stdio_common_vsnprintf_s __stdio_common_vfprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

Name

.text

Size

30.4MB

Virtual Size

30.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16.7MB

Virtual Size

16.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

231KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

452KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

oneclient_app_2.2.0_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/ApplicationID.dll

kernel32

shell32

ole32

shlwapi

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

advapi32

kernel32

user32

ws2_32

ntdll

bcrypt

generic

oneclient_app.exe

kernel32

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

user32

oleaut32

combase

gdi32

shell32

ws2_32

ntdll

ole32

bcrypt

crypt32

uiautomationcore

iphlpapi

psapi

powrprof

pdh

api-ms-win-core-winrt-l1-1-0

opengl32

imm32

dwmapi

uxtheme

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0