49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36

Sharing

Copy URL Twitter E-mail

General

Target
49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36
Size 1.5MB
Sample260808-xf6a8sfb22
SHA256 49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36
MD5 d2d49a7791e5817da61ea3dcf20634e6
SHA1 76acc3fbf8eca7a97bee10fc4153e19db643d3df
SHA512 54c8c6c9cffd0cb11f7f71deff77ef9796cc1d4893bc2857bf9b2ef538a49fdcf5b5e85b52e83d283f61d8d18f703f7e482e9a3f6a5dc08be835ab08e158fb21
SSDEEP 24576:YprHyiGDxlP8Kha3KDASINhkVXo3r1bAS9:OyZlKKBINhecrJt
TLSH
T152656B12F682D0B1D8A201B119B6CB751A38EE90475466D763D43D7F7E7AAE03E393C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36

File Explorer

49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36

.exe 1.5MB

49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36

IMPHASH 7a2ef3907aecefcb0fefa46c70df0a32
SHA256 49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36
MD5 d2d49a7791e5817da61ea3dcf20634e6
SHA1 76acc3fbf8eca7a97bee10fc4153e19db643d3df
SHA512 54c8c6c9cffd0cb11f7f71deff77ef9796cc1d4893bc2857bf9b2ef538a49fdcf5b5e85b52e83d283f61d8d18f703f7e482e9a3f6a5dc08be835ab08e158fb21
SSDEEP 24576:YprHyiGDxlP8Kha3KDASINhkVXo3r1bAS9:OyZlKKBINhecrJt
TLSH
T152656B12F682D0B1D8A201B119B6CB751A38EE90475466D763D43D7F7E7AAE03E393C8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3f:16:e5:e7:be:5e:55:6d:b2:ed:57:22:e8:9b:30:80:34:99:51:f6:ea:50:74:00:a3:92:84:28:d3:e8:6c:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=文件批量重命名工具,O=欢哥工具铺,C=CN

Chains

Aug 8, 2026

CN=文件批量重命名工具,O=欢哥工具铺,C=CN

Subject

CN=文件批量重命名工具,O=欢哥工具铺,C=CN

Serial Number

42:9e:41:ad:ee:d8:f8:a6:4e:ba:a0:41:dc:2d:47:0a

Issuer

CN=文件批量重命名工具,O=欢哥工具铺,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2026 - Aug 8, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

494786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesA TzSpecificLocalTimeToSystemTime GetTimeZoneInformation InterlockedIncrement InterlockedDecrement IsBadWritePtr lstrlenW FatalAppExitA DebugBreak lstrcpyW FreeResource FindResourceW LoadResource GetCurrentProcess GetTickCount SizeofResource GetConsoleWindow GetFileAttributesW GetModuleFileNameW GetLongPathNameW LockResource CloseHandle GetFileSize _llseek WriteFile ReadFile CreateFileW VirtualFree FreeLibrary SetDllDirectoryW WaitForSingleObject GetDllDirectoryW CreateRemoteThread InitializeCriticalSection OpenProcess VirtualFreeEx LoadLibraryW ReadProcessMemory LeaveCriticalSection GetProcAddress VirtualAlloc EnterCriticalSection VirtualAllocEx OpenThread GetProcessId GetExitCodeThread GetSystemInfo DeleteCriticalSection GetCurrentThreadId GetCurrentProcessId WriteProcessMemory SetFilePointer GetCurrentThread TerminateThread Sleep SuspendThread ResumeThread WaitForMultipleObjects SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetSystemTimeAsFileTime GetLocalTime GetSystemTime AllocConsole SetEndOfFile FlushConsoleInputBuffer ReadConsoleW SetConsoleCP SetConsoleMode LocalFree GetStdHandle GetFileType SetConsoleCtrlHandler SetConsoleOutputCP SetConsoleWindowInfo SetConsoleTitleW GetNativeSystemInfo HeapAlloc HeapFree GetProcessHeap IsBadReadPtr SetLastError LoadLibraryA VirtualProtect GetCPInfo GetOEMCP IsValidCodePage GetModuleHandleW ExitProcess DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetFullPathNameW HeapReAlloc InterlockedExchange GetStringTypeW ExitThread CreateThread RtlUnwind GetTimeFormatW GetDateFormatW DuplicateHandle CreateProcessA DeleteFileW MoveFileW SetStdHandle InitializeCriticalSectionAndSpinCount CreateProcessW RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapCreate QueryPerformanceCounter GetConsoleCP GetConsoleMode FlushFileBuffers IsProcessorFeaturePresent CompareStringW CreateFileA CreatePipe GetExitCodeProcess HeapSize WriteConsoleW GetCurrentDirectoryW GetDriveTypeW SetEnvironmentVariableA SetEnvironmentVariableW GetLastError MultiByteToWideChar WideCharToMultiByte FormatMessageA GetModuleFileNameA GetModuleHandleA SetErrorMode GetConsoleOutputCP GetACP

user32

RegisterClassA GetClientRect CopyImage MapWindowPoints IsWindowVisible LoadIconA WinHelpA CallWindowProcA EqualRect GetActiveWindow SetWindowPos ShowWindow GetSystemMenu SetActiveWindow IsIconic ModifyMenuA GetWindowThreadProcessId GetMessageW MsgWaitForMultipleObjects TranslateMessage PeekMessageW DispatchMessageW SendMessageA SetForegroundWindow MessageBoxW SetWindowRgn GetWindowRect wsprintfA SetFocus OffsetRect IntersectRect MessageBoxA GetWindowLongA CreateWindowExA DefWindowProcA IsWindow

ole32

OleRegGetUserType CreateOleAdviseHolder CoTaskMemAlloc OleCreate OleSetContainedObject StringFromIID CLSIDFromString CLSIDFromProgID CoRegisterClassObject CoRevokeClassObject MkParseDisplayName CreateBindCtx CoCreateInstance GetRunningObjectTable CoTaskMemFree StringFromCLSID OleInitialize OleUninitialize CoLockObjectExternal

shlwapi

StrFormatByteSizeW SHDeleteKeyA

gdi32

SetViewportOrgEx SetWindowOrgEx DeleteObject CreateRectRgnIndirect SetViewportExtEx SetWindowExtEx SetMapMode

advapi32

RegQueryValueExA RegSetValueExA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumKeyExA RegOpenKeyExA

shell32

ord165

oleaut32

SysFreeString OleSavePictureFile UnRegisterTypeLi GetActiveObject VariantInit VariantCopyInd VariantClear LoadTypeLibEx SysAllocString SysAllocStringLen LoadRegTypeLi SysStringByteLen LHashValOfNameSys SafeArrayCreateVector VariantTimeToSystemTime SafeArrayAccessData VariantCopy SafeArrayDestroy SafeArrayCreate SystemTimeToVariantTime SafeArrayGetDim VariantChangeType SafeArrayGetElement SafeArrayUnaccessData SafeArrayPutElement DispGetIDsOfNames SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

49ef754763e3fba7d0055a50a248c749ccde74e33d57ead4aef850c6041f6d36

PE Signature issue

kernel32

user32

ole32

shlwapi

gdi32

advapi32

shell32

oleaut32

generic