20260827_wps_office_inst[.]doc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
20260827_wps_office_inst.doc.exe
Size 5.5MB
Sample260827-g1659sysbw
SHA256 3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30
MD5 d23bbf6f75142b9a5cf8aeaa686feb9e
SHA1 7e415afa83b52ea1c38bac41198840c767e22c2a
SHA512 a4eb78303b387b9da9383d943dc06b9e615a68054276ffa41cfdb382db40c2fdff09c59d0abbb63ca4c96819042218e5d63b73b93ed043e1ef589521ba2c8059
SSDEEP 98304:umZ3eGE9jD37+nOlsYf3Njm2f6OFhKvszGZ9pDjAB/qZ:1uGE9/IOlbBRhKvn9pXApqZ
TLSH
T13946B012FB8680F1E5D101B0547BBB76583DAA284B2489D7E7D12E7588302D37A3BB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

20260827_wps_office_inst.doc.exe

.exe 5.5MB

20260827_wps_office_inst.doc.exe

IMPHASH 99463a4cb80a64095e8387d67c17630c
SHA256 3cb6d3f2237d6b9ff3a903de28d5ac3c691db1685f0cc67bc4070cca11b09a30
MD5 d23bbf6f75142b9a5cf8aeaa686feb9e
SHA1 7e415afa83b52ea1c38bac41198840c767e22c2a
SHA512 a4eb78303b387b9da9383d943dc06b9e615a68054276ffa41cfdb382db40c2fdff09c59d0abbb63ca4c96819042218e5d63b73b93ed043e1ef589521ba2c8059
SSDEEP 98304:umZ3eGE9jD37+nOlsYf3Njm2f6OFhKvszGZ9pDjAB/qZ:1uGE9/IOlbBRhKvn9pXApqZ
TLSH
T13946B012FB8680F1E5D101B0547BBB76583DAA284B2489D7E7D12E7588302D37A3BB5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

e7:0e:91:c6:91:e4:23:4d:0e:fb:29:61:88:f2:99:47:ab:dd:e1:6b:2f:0f:9c:bb:4a:e0:8a:9c:a7:b9:d5:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jan 22, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

a9:e5:5c:69:71:e7:a6:87:b8:15:f9:7f:27:aa:f0:7b:6d:a6:fd:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jan 22, 2026

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2024 - Oct 17, 2027

Minor OS version

Major OS version

Entry point

2854263

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_i18n_new_funnel_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource SetDefaultDllDirectories FindResourceW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount GetModuleHandleW VerSetConditionMask ExpandEnvironmentStringsA CreateDirectoryW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetShortPathNameW GetTempFileNameW GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetVersionExW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetProcAddress VerifyVersionInfoW GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemDirectoryW GetSystemWow64DirectoryW FreeLibrary LoadLibraryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree CreateFileW GetFileAttributesW GetFileSizeEx ReadFile GetCurrentThreadId GetProcessId GetFileInformationByHandle GetFileSize SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc VirtualFree ExitProcess FreeResource lstrcpyW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread lstrlenW GetPrivateProfileStringW ExpandEnvironmentStringsW ProcessIdToSessionId GetEnvironmentVariableW CreateProcessW GetPrivateProfileIntW GetLongPathNameW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe GetVersionExA GetWindowsDirectoryA GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock SetFileTime DuplicateHandle DosDateTimeToFileTime GetDiskFreeSpaceW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent OutputDebugStringW FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI MoveFileExW GetLocaleInfoEx EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle GetTimeZoneInformation IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile HeapCreate

Sharing

General

Malware Config

Signatures

File Explorer

20260827_wps_office_inst.doc.exe

kernel32

generic