916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

Sharing

Copy URL Twitter E-mail

General

Target
916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6
Size 2.3MB
Sample260820-p4pdmaxdrg
SHA256 916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6
MD5 982821f3fe8006c6bed4933bdd654a5f
SHA1 a8a0be4ffa83de498e9610a3a315df04d7f5a432
SHA512 4568147fc1312c0db97ff43cb216a9642efc0d1f7cddc326e4ab058d104ace204e10cb805848b7a41aaf4a2aab31da2aeef1bf8a806f39fa0a33a12a3f96ee81
SSDEEP 49152:QeaAsJDiM/hmLSnyXTg5oJSkOWOxXPhmL2QmGThYD:QeaDBiMZmLtDXJexpmL7m
TLSH
T1FFB5BF02FF8284B1F5D3057561AB5B7F8D39AA202328C5D3D7D119799D302D2BA3E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

File Explorer

916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

.exe 2.3MB

916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

IMPHASH f795929da78996aaec2d9e222d45039f
SHA256 916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6
MD5 982821f3fe8006c6bed4933bdd654a5f
SHA1 a8a0be4ffa83de498e9610a3a315df04d7f5a432
SHA512 4568147fc1312c0db97ff43cb216a9642efc0d1f7cddc326e4ab058d104ace204e10cb805848b7a41aaf4a2aab31da2aeef1bf8a806f39fa0a33a12a3f96ee81
SSDEEP 49152:QeaAsJDiM/hmLSnyXTg5oJSkOWOxXPhmL2QmGThYD:QeaDBiMZmLtDXJexpmL7m
TLSH
T1FFB5BF02FF8284B1F5D3057561AB5B7F8D39AA202328C5D3D7D119799D302D2BA3E39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a5:28:e8:00:e5:2d:c6:70:74:c1:ba:bf:0f:7f:00:0b:e1:d3:ef:ac:ff:69:9f:89:76:8b:7f:b8:79:ad:0a:e0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Chains

Feb 18, 2025

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

fb:a1:46:89:77:a2:e4:28:ee:92:35:5c:39:75:1d:9f:0b:e7:8c:21

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Chains

Feb 18, 2025

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=北京华网智讯软件有限公司,O=北京华网智讯软件有限公司,ST=北京市,C=CN

Serial Number

07:32:e2:a9:4e:3f:6f:85:a2:6d:b0:9c:a0:3f:c4:8f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 22, 2024

Timespan

Oct 22, 2024 - Oct 21, 2025

Minor OS version

Major OS version

Entry point

1508114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

GetFileAttributesW GetFileAttributesExW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetCurrentProcessId GetEnvironmentVariableW GetDriveTypeW CreateDirectoryW CreateFileA WTSGetActiveConsoleSessionId GlobalAlloc GlobalFree LocalAlloc LocalFree OpenProcess TerminateProcess GetExitCodeProcess WaitForSingleObject CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualAlloc VirtualFree GetCurrentThreadId TerminateThread lstrcmpiW GetModuleHandleW ProcessIdToSessionId GetTickCount GetSystemInfo VirtualProtect SetLastError GetNativeSystemInfo LoadLibraryA IsBadReadPtr CreateThread RaiseException EnterCriticalSection LeaveCriticalSection SetEvent CreateEventW GetLocalTime lstrcpyW FindNextFileA FindFirstFileA FindResourceW SizeofResource LoadResource LockResource GetSystemWindowsDirectoryW OutputDebugStringW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer DeleteFileA DeleteFileW GetTempPathW CreateProcessW ReadFile GetStdHandle Sleep GetLongPathNameW WritePrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW lstrlenW GetPrivateProfileStringW GetVolumeInformationW GetSystemDirectoryW LoadLibraryW GetProcAddress FreeLibrary GetVersionExW SetPriorityClass LoadLibraryExW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode FileTimeToSystemTime FindClose WriteFile GetFileSize WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetModuleHandleExW VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe GetFileType WaitForMultipleObjects CreateFileW OutputDebugStringA CloseHandle DeviceIoControl GetLastError GetCurrentProcess GetThreadTimes FreeLibraryAndExitThread InitializeCriticalSection SleepEx FormatMessageA GetCPInfo GetStringTypeW SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle GetFullPathNameW GetCurrentDirectoryW FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleCP GetACP SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime ExitThread RtlUnwind WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW

user32

wsprintfW MessageBoxW GetUserObjectInformationW LoadStringW GetProcessWindowStation

advapi32

CryptAcquireContextW CryptGenRandom CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW ReportEventW RegisterEventSourceW DeregisterEventSource RegOpenKeyW RegEnumKeyW RegDeleteKeyW CreateProcessAsUserW LookupPrivilegeValueW SetTokenInformation DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken ImpersonateLoggedOnUser RevertToSelf RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey CryptReleaseContext

shell32

SHGetFolderPathW SHChangeNotify SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize

psapi

EnumProcesses GetProcessImageFileNameW

shlwapi

PathFileExistsW PathAddBackslashW StrStrIW PathAppendW SHGetValueA SHDeleteKeyW SHDeleteValueW SHGetValueW SHSetValueW

wininet

InternetReadFile InternetOpenUrlW InternetSetOptionW HttpQueryInfoW InternetCloseHandle InternetOpenW InternetQueryOptionW

wldap32

ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301

wtsapi32

WTSQueryUserToken

ws2_32

WSAIoctl getaddrinfo freeaddrinfo recvfrom socket WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs sendto accept listen ioctlsocket gethostname setsockopt

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

544KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

24KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.wtq

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

PE Signature issue

PE Signature issue

userenv

kernel32

user32

advapi32

shell32

ole32

psapi

shlwapi

wininet

wldap32

wtsapi32

ws2_32

generic