48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638

General

Target
48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638
Size 2.5MB
Sample260816-qcf4lsde26
SHA256 48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638
MD5 72007f23d9a65553b8d96141989ff768
SHA1 1e766d5e8a3023a3449459b2c89a141db4012f73
SHA512 93c172ca2259f20d65a9adc3174501b53ebbcf07b21cbabf2fa96ccb2d28dc6dbe644fc41287c10dbedd5828bd552be6611f800b93f58d1b8d966a953ac72824
SSDEEP 49152:93o6Y8xllqwo8qWUdkdxWu6nos0t7XVmY:28x+woYy0xp6nN0tzVn
TLSH
T178C5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D369C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638

File Explorer

48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638

.exe 2.5MB

48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638

IMPHASH 5dbb7bcda197e66e5aa007adb6d32b7a
SHA256 48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638
MD5 72007f23d9a65553b8d96141989ff768
SHA1 1e766d5e8a3023a3449459b2c89a141db4012f73
SHA512 93c172ca2259f20d65a9adc3174501b53ebbcf07b21cbabf2fa96ccb2d28dc6dbe644fc41287c10dbedd5828bd552be6611f800b93f58d1b8d966a953ac72824
SSDEEP 49152:93o6Y8xllqwo8qWUdkdxWu6nos0t7XVmY:28x+woYy0xp6nN0tzVn
TLSH
T178C5E0B672043394D06B8830A123BE59B2F2221E4BA585FBB6D369C03B5B5D0F536F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

79:fe:bd:e3:dc:19:d8:ef:dd:71:95:c9:45:68:c2:09:3b:7d:ff:d7:15:e7:87:b6:da:3f:6f:51:79:d8:d0:39

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

PE Signature issue

Digest

8c:6f:0e:74:ea:f1:de:e4:41:0d:eb:30:5f:8f:63:fb:eb:14:de:f3

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 12, 2021

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Beijing SenseShield Technology Co.\, Ltd.,O=Beijing SenseShield Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

07:aa:52:5b:f1:73:f0:e5:e3:68:d8:ae:77:0f:8a:af

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2019 - Oct 12, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

10807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA Sleep GetTickCount HeapFree HeapAlloc GetCommandLineA HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer EncodePointer HeapCreate GetModuleHandleW GetStdHandle GetModuleFileNameW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FindFirstFileA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW RtlUnwind SetStdHandle WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers CreateFileW FindNextFileA FindClose GetModuleHandleA GetProcAddress GetSystemDirectoryA DeleteFileA CreateEventA CreateThread lstrcatA CreateProcessA WaitForMultipleObjects TerminateProcess GetCurrentDirectoryA GetLastError WaitForSingleObject GetExitCodeProcess ExitProcess GetVersionExA GetCurrentProcess SetEvent GetLocalTime CreateFileA SetFilePointer WriteFile CloseHandle FreeEnvironmentStringsW GetModuleFileNameA

shell32

ShellExecuteExA

advapi32

RegCreateKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges ReportEventA SetServiceStatus RegisterEventSourceA RegisterServiceCtrlHandlerExA StartServiceCtrlDispatcherA ControlService DeleteService CreateServiceA OpenSCManagerA OpenServiceA QueryServiceConfigA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus StartServiceA CloseServiceHandle OpenProcessToken GetTokenInformation RegSetValueExA

shlwapi

PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

48ff31b225a472d342e0381ffd309ba7a5062dc22515a17b61911b7c9a1c2638

PE Signature issue

PE Signature issue

kernel32

shell32

advapi32

shlwapi

generic