5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf

Sharing

Copy URL Twitter E-mail

General

Target
5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf
Size 214KB
Sample260825-dvxg4astfv
SHA256 5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf
MD5 aa9187974f6cfaa489f30bb4dfa7f93a
SHA1 29bb3bf30afc71346fb49b18648862432b28c23c
SHA512 ec71aefbdde4c2d7b9257706cad63bf6996dacce9e6350d2451a14d5e3fc2656ad713f9d2534db7a9e16718c03e4dcefd1cff421d12ba25b10d74be850aa52ff
SSDEEP 3072:+2baCwYP2CkjL7F2J1D+1zOyDASYHlojiDnnUfxLtLLaAmsz2q88kHW:+cEvF2J1D+VOyDAz4tTmszKc
TLSH
T16F240756EB7251F9C4FEC1388296633BFE317C2D97A4679B8B4487161B62B90F839310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf

File Explorer

5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf

.exe 214KB

5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf

IMPHASH c9b194751a51375260bad58fe9400d0d
SHA256 5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf
MD5 aa9187974f6cfaa489f30bb4dfa7f93a
SHA1 29bb3bf30afc71346fb49b18648862432b28c23c
SHA512 ec71aefbdde4c2d7b9257706cad63bf6996dacce9e6350d2451a14d5e3fc2656ad713f9d2534db7a9e16718c03e4dcefd1cff421d12ba25b10d74be850aa52ff
SSDEEP 3072:+2baCwYP2CkjL7F2J1D+1zOyDASYHlojiDnnUfxLtLLaAmsz2q88kHW:+cEvF2J1D+VOyDAz4tTmszKc
TLSH
T16F240756EB7251F9C4FEC1388296633BFE317C2D97A4679B8B4487161B62B90F839310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

05:5d:26:50:ed:7d:68:c4:0a:3f:f0:c0:3c:77:29:92:2a:75:d3:35:29:91:4e:7f:5f:8e:f2:55:a3:07:24:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Gstarsoft Co.\,Ltd.,O=Gstarsoft Co.\,Ltd.,L=苏州市,ST=江苏省,C=CN

Chains

Jun 25, 2025

CN=Gstarsoft Co.\,Ltd.,O=Gstarsoft Co.\,Ltd.,L=苏州市,ST=江苏省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Gstarsoft Co.\,Ltd.,O=Gstarsoft Co.\,Ltd.,L=苏州市,ST=江苏省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=Gstarsoft Co.\,Ltd.,O=Gstarsoft Co.\,Ltd.,L=苏州市,ST=江苏省,C=CN

Serial Number

0c:df:17:cf:65:29:a8:80:93:7e:51:ed:e5:7e:13:fb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 3, 2023 - Nov 18, 2025

Minor OS version

Major OS version

Entry point

86624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc HeapFree DeviceIoControl InitializeCriticalSectionEx DeleteCriticalSection ExitProcess GlobalMemoryStatusEx GetSystemInfo GetSystemDirectoryW VirtualProtect CreateFileMappingW MapViewOfFile GetModuleFileNameW GetLastError GetProcAddress LoadLibraryA lstrcmpiW lstrcatW GetSystemPowerStatus WideCharToMultiByte K32GetModuleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetDiskFreeSpaceExW CreateFileW GetCurrentProcess Sleep GetModuleHandleW CloseHandle IsDebuggerPresent VirtualQuery GetModuleHandleExW FreeLibrary GetSystemTimeAsFileTime OutputDebugStringW TerminateProcess InitializeSListHead GetCurrentProcessId QueryPerformanceFrequency GetCurrentThreadId QueryPerformanceCounter

user32

EnumDisplayDevicesW

advapi32

RegCloseKey GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenProcessToken RegOpenKeyExW

wevtapi

EvtClose EvtCreateRenderContext EvtNext EvtQuery EvtRender

d3d11

D3D11CreateDevice

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

msvcrt

_aligned_malloc _callnewh _initterm _initterm_e _set_fmode _errno strcpy_s strlen ?terminate@@YAXXZ __getmainargs _msize _XcptFilter __set_app_type _ismbblead _acmdln realloc free ?_set_new_mode@@YAHH@Z _commode towlower memset memcmp memchr memmove __CxxFrameHandler3 _CxxThrowException _aligned_free malloc atoi _wtoi __C_specific_handler _amsg_exit

Sharing

General

Malware Config

Signatures

File Explorer

5fc4e10e7bdd5b91b2e76fc07065faa0f00178d9caa207285fdf68a7287a5fbf

PE Signature issue

kernel32

user32

advapi32

wevtapi

d3d11

ntdll

msvcrt

generic